Aug 08 2023

INCIDENT RESPONSE IN 2023: TECHNOLOGIES AND TRENDS

Category: Security Incident — disc7 @ 1:06 pm
Incident Response in 2023: Technologies and Trends

WHAT IS INCIDENT RESPONSE? 

Incident response refers to the process followed by an organization to address and manage the aftermath of a security breach or cyber attack. The goal of incident response is to handle the situation in a way that limits damage, reduces recovery time and costs, and ensures that the incident is properly documented and reported to meet regulatory requirements.

In the simplest of terms, incident response is like a well-organized fire drill for cyber attacks. It’s a set of instructions that help IT staff and business owners identify, respond to, and recover from network security incidents. These instructions include steps to take when an attack is identified, who should be involved, how data should be collected and analyzed, and how to learn from the incident to prevent future attacks. See this detailed blog post for more background about incident response.

IMPORTANCE OF INCIDENT RESPONSE IN CYBERSECURITY

MINIMIZING IMPACT OF ATTACKS

One of the primary reasons for having an incident response plan is to minimize the impact of attacks. Cyber attacks can lead to significant financial losses, especially for businesses that rely heavily on online transactions. An effective incident response plan can help businesses identify attacks early, contain them quickly, and minimize potential damage.

Moreover, incident response is not just about dealing with the attack itself but also about dealing with the aftermath of the attack. This includes notifying affected parties, managing public relations, and fulfilling any legal obligations. Having a plan in place ensures that these tasks are handled efficiently and effectively, reducing the overall impact of the attack.

RECOVERY AND RESTORATION

Another critical aspect of incident response is recovery and restoration. After a cyber attack, it’s essential to restore systems and operations to normal as quickly as possible. Incident response teams work to eliminate the threat from the company’s systems, repair any damage, and restore data from backups.

The speed and efficiency of recovery can significantly impact a business’s bottom line. The longer it takes to recover, the more revenue is lost. Furthermore, prolonged recovery times can also damage a company’s reputation, leading to loss of customers and potential future business.

LEGAL AND REGULATORY COMPLIANCE

Cybersecurity incidents can have serious legal and regulatory implications for businesses. In many jurisdictions, businesses are required to report breaches to regulatory bodies and affected individuals. Failure to comply with these requirements can result in hefty fines and legal proceedings.

An incident response plan helps businesses meet their legal and regulatory obligations by ensuring that incidents are properly documented and reported. This includes keeping detailed records of the incident, the response actions taken, and the lessons learned. Such documentation can be crucial in defending against lawsuits or regulatory actions.

REDUCING DOWNTIME

Downtime is costly for any business. It leads to lost productivity, lost revenue, and can damage a company’s reputation. A well-prepared incident response team can significantly reduce the amount of downtime a business experiences after a cyber attack.

By quickly identifying and containing an attack, the team can minimize the amount of time systems are down. Moreover, by having a plan for recovery and restoration, the team can ensure that systems are back up and running as quickly as possible.

EMERGING TECHNOLOGIES INFLUENCING INCIDENT RESPONSE 

AI AND ML IN INCIDENT RESPONSE

Artificial intelligence (AI) and machine learning (ML) are changing the face of incident response. These technologies can automate many of the tasks involved in incident response, allowing teams to respond more quickly and effectively to attacks.

AI and ML can be used to detect anomalies in network traffic, identify malicious activity, and even predict future attacks. They can also automate the process of collecting and analyzing data, freeing up incident response teams to focus on more strategic tasks.

EXTENDED DETECTION AND RESPONSE (XDR)

Extended Detection and Response (XDR) is another technology that is shaping the future of incident response. XDR is a security approach that integrates multiple security tools into a single platform. This allows incident response teams to have a more holistic view of their environment and respond more effectively to threats.

XDR platforms can collect data from a wide range of sources, including network traffic, endpoint devices, and cloud services. This data is then analyzed to detect threats and automate response actions.

SIEM

Security Information and Event Management (SIEM) systems are another crucial tool in incident response. SIEM systems collect and analyze log data from various sources within an organization’s IT infrastructure. They provide real-time analysis of security alerts and can automate response actions.

By providing a centralized view of an organization’s security landscape, SIEM systems can help incident response teams identify, investigate, and respond to security incidents more efficiently.

THREAT INTELLIGENCE PLATFORMS

Threat Intelligence Platforms (TIPs) provide incident response teams with information about known threats and threat actors. This information can help teams identify attacks more quickly and respond more effectively.

TIPs collect and analyze data from a variety of sources, including open-source intelligence, social media, and internal data. They provide actionable intelligence that can be used to enhance an organization’s security posture and improve incident response efforts.

KEY TRENDS IN INCIDENT RESPONSE FOR 2023 

INCREASE IN REMOTE WORK AND ITS IMPACT ON INCIDENT RESPONSE

The shift to remote work has had a significant impact on incident response. With more employees working from home, the attack surface for cyber criminals has expanded. This has made incident response more challenging, as teams must now deal with threats on a wide range of devices and networks.

In 2023, we can expect to see more tools and strategies aimed at dealing with the challenges posed by remote work. This may include increased use of cloud-based incident response tools, as well as strategies for securing remote devices and networks.

SHIFT FROM REACTIVE TO PROACTIVE INCIDENT RESPONSE

Traditionally, incident response has been a reactive process. Teams would wait for an attack to occur and then respond. However, this approach is no longer sufficient in today’s threat landscape.

In 2023, we can expect to see a shift towards more proactive incident response. This means identifying and addressing vulnerabilities before an attack occurs. It also means monitoring for signs of an attack and taking action before the attack has a chance to cause damage.

EMPHASIS ON INCIDENT RESPONSE TESTING AND SIMULATION

Another trend we can expect to see in 2023 is an increased emphasis on incident response testing and simulation. Testing and simulation are crucial for ensuring that an incident response plan is effective.

Through testing, teams can identify gaps in the plan and make necessary adjustments. Simulation exercises can also help teams practice their response to an attack, ensuring that they are prepared when a real attack occurs.

GREATER REGULATORY SCRUTINY AND ITS IMPACT ON INCIDENT RESPONSE

Finally, in 2023, we can expect to see greater regulatory scrutiny of incident response. As cyber attacks continue to increase in frequency and severity, regulators are becoming more interested in how businesses respond to these incidents.

This means that businesses will need to ensure that their incident response plans meet regulatory standards. They will also need to be prepared to provide documentation of their response efforts in the event of a regulatory investigation.

CONCLUSION

In conclusion, mastering incident response is crucial for businesses in today’s digital world. By understanding what incident response is, recognizing its importance, staying up-to-date with emerging technologies, and keeping an eye on key trends, businesses can protect their digital assets, minimize the impact of attacks, and comply with legal and regulatory requirements.

CISSP training course

InfoSec tools | InfoSec services | InfoSec books

Tags: Incident Response

Aug 08 2023

Research Eyes Misconfiguration Issues At Google, Amazon and Microsoft Cloud

Category: Information Security — disc7 @ 10:01 am
Research Eyes Misconfiguration Issues At Google, Amazon and Microsoft Cloud

Cloud misconfiguration — incorrect control settings applied to both hardware and software elements in the cloud — are threat vectors that amplify the risk of data breaches. A new report from cloud security vendor Qualys, authored by Travis Smith, vice president of the company’s Threat Research Unit lifts the lid on risk factors for three major cloud service providers.

About the report

Smith wrote that Qualys researchers, analyzing misconfiguration issues at Amazon Web Services, Microsoft Azure and Google Cloud Platform, found that within Azure, 99% of the disks are either not encrypted or aren’t using customer-managed keys that give users control of encryption keys that protect data in software as a service applications.

The study, which reviewed encryption, identity and access management and failures to monitor external-facing assets examined risks to unauthorized access due to:

  • The complexity of cloud environments
  • Lack of expertise in keeping up with evolving technologies
  • Insecure settings and permissions caused by human errors
  • Rapid deployment compromising security implementation measures
  • Lack of control and visibility of cloud-resident unencrypted or sensitive data due to the dynamic nature of cloud environments

Smith wrote that the company’s reachers found that 85% of the keys aren’t rotated, meaning automatic key rotation isn’t enabled. Amazon offers automatic key rotation — generating new cryptographic material — on a 365 day cycle for keys.

Qualys also reported that in GCP environments, 97.5% of virtual machine disks for critical virtual machines lack encryption using customer-supplied encryption keys.

Jump to:

Identity and Access Management

Qualys found poor implementation levels of IAM in all three major providers:

  • Multifactor authentication: AWS isn’t enabled for 44% of IAM users with console passwords. IAM Access Analyzer isn’t enabled in 96% of the accounts scanned by Qualys.
  • In Azure, scans for enabling authentication and configuring client certificates within Azure App Service fail 97% of the time.

Exposure of external-facing assets from leaky S3 buckets

Qualys noted that a common mistake by users across the three platforms is public exposure of data:

  • Qualys reported 31% of S3 buckets are publicly accessible.
  • The misconfiguration of leaving public network access enabled was seen in 75% of the Azure databases.

SEE: What is cloud security?

Center for Internet Security work offers insights to remediation

Recommendations by the firm included reviewing research by the Center for Internet Security including work Qualys participated in: mapping of individual controls to the MITRE ATT&CK tactics and techniques.

Qualys contributed to developing these CIS benchmarks for AWS, Azure and GCP. The benchmarks will help offer some valuable insight and context for defenders to better prioritize the hundreds of hardening controls available in cloud environments.

Qualys also looked at how firms are deploying controls to harden their cloud postures across the three major platforms, noting that privilege escalation (96.03%), initial access (84.97%) and discovery (84.97%) are passing at the highest rates.

Efforts to control attacks early are helping to ameliorate more harmful consequences further along the the kill chain:

  • Impact passed at only 13.67%
  • Exfiltration at only 3.70%.
  • Exploitation of public facing apps passed at only 28.54%.
  • Exploitation of remote services, at only 17.92%, are failing at high rates.
  • Resource hijacking is passing at just 22.83%.

Smith wrote that since crypto mining malware is a threat to cloud environments, organizations should consider mitigating such controls to reduce their organizational risk in the cloud.

“The lesson from these data points is that almost every organization needs to better monitor cloud configurations,” said Smith, adding that scans for CIS controls failed 34% of the time for AWS, 57% for Microsoft Azure and 60% for GCP (Figure A).

“Even if you believe your cloud configurations are in order, the data tells us that not regularly confirming status is a risky bet. Scan the configurations often and make sure the settings are correct. It takes just one slip-up to accidentally open your organization’s cloud to attackers,” wrote Smith.

CISSP training course

InfoSec tools | InfoSec services | InfoSec books

Aug 07 2023

How an 8-Character Password Could be Cracked in Just a Few Minutes

Category: Password Security — disc7 @ 9:14 am
How an 8-Character Password Could be Cracked in Just a Few Minutes

Advances in graphics processing technology and AI have slashed the time needed to crack a password using brute force techniques, says Hive Systems.We may be compensated by vendors who appear on this page through methods such as affiliate links or sponsored partnerships. This may influence how and where their products appear on our site, but vendors cannot pay to influence the content of our reviews. For more info, visit our Terms of Use page.

Security experts keep advising us to create strong and complex passwords to protect our online accounts and data from savvy cybercriminals. And “complex” typically means using lowercase and uppercase characters, numbers, and even special symbols. But, complexity by itself can still open your password to cracking if it doesn’t contain enough characters, according to research by security firm Hive Systems.

Jump to:

CISSP training course

InfoSec tools | InfoSec services | InfoSec books

Tags: password security

Aug 06 2023

WiFi Penetration Testing Guide

Category: Wi-Fi Security — disc7 @ 8:37 am

Source: https://lnkd.in/ez5m5g6T

WIFI-Pen-testing-guideDownload

The Ultimate Kali Linux Book: Perform advanced penetration testing using Nmap, Metasploit, Aircrack-ng, and Empire, 2nd Edition

CISSP training course

InfoSec tools | InfoSec services | InfoSec books

Tags: WiFi Penetration Testing

Aug 05 2023

Open-source penetration testing tool BloodHound CE released

Category: Pen Test,Security Tools — disc7 @ 2:17 pm
Open-source penetration testing tool BloodHound CE released

SpecterOps released version 5.0 of BloodHound Community Edition (CE), a free and open-source penetration testing solution that maps attack paths in Microsoft Active Directory (AD) and Azure (including Azure AD/Entra ID) environments. It is available for free on GitHub.

Identifying simple Attack Paths between two objects is a straightforward “search and click” exercise

This update brings many enterprise-grade usability features to BloodHound CE, like containerized deployment, REST APIs, user management, and access control. It also significantly improves performance while streamlining development allowing for faster development and incorporation of community contributions.

“The way that BloodHound Community Edition maps out Attack Paths in AD and Azure is unique – there isn’t another tool (or feature within either of those) that can find hidden and unintentional relationships to identify complex Attack Paths that attackers can exploit. After this update, the tool will offer a user experience closer to an enterprise-grade product than an open-source tool,” Andy Robbins, co-creator of BloodHound and a Principal Product Architect at SpecterOps, told Help Net Security.

The entire UI is driven via RESTful APIs and includes a full Swagger spec within the application

New features

Support for REST APIs – BloodHound CE is a three-tier application with a database, an API layer, and a web-based user interface. Users can now use REST APIs to interact with data rather than needing to write queries directly to the database.

Containerized deployment – The tool will deploy as a containerized product. This much simpler process will reduce deployment time by 80%. This also makes it easier for users with different sized environments to manipulate the resources assigned to BloodHound.

Enterprise-grade user management – This update adds built-in full multi-user support with RBAC, the ability to create and assign user roles, and support for two-factor authentication and SAML to BloodHound CE.

Protected Cypher searches – Cypher queries will include available guardrails to automatically cancel queries that will cause performance or security issues.

Reliability and performance upgrade – Routine maintenance updates will make the tool faster, more resilient, and more reliable.

More frequent updates and community contributions – These changes will allow SpecterOps to increase the rate of updates and new features added to BloodHound CE going forward and will increase the number of pull requests from the community that can be implemented.

Better community support – More similarities between BloodHound CE and BloodHound Enterprise under the hood means users will have better access to support and documentation for both.

BloodHound was created in 2016 by Rohan Vazarkar, Will Schroeder, and Andy Robbins. It has been downloaded nearly 500,000 times and has over 12,000 users in the BloodHound Community Slack. The tool has been recommended by CISA and Microsoft to help secure Microsoft Active Directory and Azure AD.

Checkout our posts on security tools

Open Source Intelligence Methods and Tools: A Practical Guide to Online Intelligence

CISSP training course

InfoSec tools | InfoSec services | InfoSec books

Aug 05 2023

ISO 27001 Internal Audit Report Template

Category: ISO 27k — disc7 @ 11:45 am
How_to_perform_internal_audit_remotely_webinar_presentation_deckDownload

ISO 27001 Internal Auditor Course

Internal Auditing in Plain English: A Simple Guide to Super Effective ISO Audits 

Transition plan from ISO 27001 2013 to ISO 27001 2022

Why the updated ISO 27001 standard matters to every business’ security

Detailed explanation of 11 new security controls in ISO 27001:2022

6 Pocket eBooks every ISO professional should read

ISO 27001 Internal Audit

Tool for defining the ISO 27001 ISMS scope

Risk Management document templates

ISO 27001 & ISO 27017 & ISO 27018 CLOUD DOCUMENTATION TOOLKIT

IMPLEMENT ISO 27001 AND ISO 22301 EFFORTLESSLY

How to Maintain ISO 27001 Certification: 7 Top Tips

Implementing an ISMS – The nine Steps approach

ISO 27001 CyberSecurity Toolkit

Top 3 ITG ISO 27001 books 

Enhance your privacy management with ISO 27701

ISO/IEC 27701 2019 Standard and Toolkit

CISSP training course

InfoSec tools | InfoSec services | InfoSec books

Tags: ISO 27001 Internal Audit, ISO 27001 Internal Auditor Course, ISO 270012022, ISO 270022022

Aug 04 2023

What is Business Email Compromise (BEC) Attacks? – Prevention Guide

Category: Email Security — disc7 @ 9:13 am
https://gbhackers.com/bec-attacks/

BEC, an acronym for Business Email Compromise, is a sophisticated form of cybercrime. Cyber threats have become a pressing concern in a world where almost every aspect of our lives is digitized. One of these threats that have been growing exponentially in recent years is the BEC attacks.

What Are BEC Attacks? 

These attacks are carefully orchestrated scams perpetrated by cybercriminals to trick businesses into transferring money or sensitive information. The attackers usually impersonate a high-ranking official in the company, such as the CEO or CFO, and send an email request for a wire transfer or confidential data to another employee.

They’re not just any random email scams; BEC attacks are highly targeted and involve a great deal of planning and research. The cybercriminals behind them often know a lot about their targets and use this information to make their fraudulent requests seem legitimate. So, it’s no surprise that these attacks pose a significant threat to businesses of all sizes and industries worldwide.

Understanding BEC Attacks 

Process and Mechanics of a BEC Attack

Understanding how BEC attacks work is the first step in preventing them. The process often starts with extensive research. The attackers gather information about the target company and its employees. They look for information such as who is in charge of finances, who they report to, and when these officials will likely be out of the office.

Once they’ve gathered enough information, they craft a convincing email. This email is usually disguised as originating from a high-ranking official and sent to an employee with the authority to transfer funds or access sensitive information. The email will request a wire transfer, often with a sense of urgency to pressure the employee into acting quickly without questioning the request’s legitimacy.

The mechanics of these attacks are what makes them so effective. The attackers exploit the trust and authority of high-ranking officials to bypass traditional security measures. And because the emails are so well-crafted, they can be tough to detect.

Common Forms of BEC Attacks

There are several common forms of BEC attacks. The most common is ‘CEO Fraud,’ where the attacker impersonates the CEO or another top executive. They send an email to an employee in finance, requesting an urgent wire transfer.

Another form is ‘Invoice Scams.’ In these cases, attackers impersonate a vendor or supplier and send a fake invoice to the company. The invoice will typically request payment to a new account controlled by the attacker.

There’s also ‘Account Compromise.’ Here, an attacker hacks into an employee’s email account and sends fraudulent emails to vendors listed in their email contacts. The email will request that future payments are sent to a new account.

The Targets and Motives Behind BEC Attacks

The targets of BEC attacks are typically businesses that work with foreign suppliers or regularly perform wire transfer payments. However, any business can be a target. The motive behind these attacks is simple: money. Cybercriminals are looking for the easiest way to get their hands on your cash.

Prevention of BEC Attacks 

The best way to deal with BEC attacks is to prevent them from happening in the first place. Prevention requires a multi-faceted approach that includes technical, administrative, and human elements.

Email Security Measures

The first line of defense against BEC attacks is implementing robust email security measures. It is essential to use email filtering solutions that can detect and block phishing emails. These solutions can flag emails from outside your organization that are crafted to look like they’re from within.

Furthermore, you should also implement Domain-based Message Authentication, Reporting & Conformance (DMARC), an email authentication protocol. DMARC can prevent attackers from spoofing your organization’s domain in their phishing attempts, significantly reducing the chances of a successful BEC attack.

Multi-Factor Authentication (MFA)

Multi-factor authentication is another crucial element in preventing BEC attacks. MFA requires users to provide two or more forms of identification before they can access their email accounts or other sensitive systems. This could be something they know (like a password), something they have (like a physical token or a smartphone), or something they are (like a fingerprint or other biometric data).

By implementing MFA, even if a criminal manages to steal an employee’s login credentials through a phishing attack, they would still need the additional factor(s) to access the account. This significantly increases the difficulty for attackers, often deterring them from attempting to compromise your business.

Employee Training

The human element is often the weakest link in cybersecurity. Therefore, regular employee training is essential in preventing BEC attacks. Employees should be taught to identify phishing emails and be aware of the tactics used by cybercriminals in these attacks.

Moreover, it should be emphasized that everyone, regardless of their position in the company, could be a target. Regularly updated training programs can help employees stay abreast of the latest threats and the best practices to mitigate them.

Verify Requests

Given the nature of BEC attacks, it is crucial to establish a process to verify requests for funds or sensitive information, especially if they are unexpected or come from high-ranking individuals. This could be as simple as making a phone call to the person making the request.

The more significant the request, the more critical it is to verify it through multiple channels. This practice can significantly reduce the chances of an employee inadvertently complying with a fraudulent request.

Incident Response Plan

Even with the best preventative measures in place, it’s essential to be prepared for the worst-case scenario—a successful BEC attack. This is where an incident response plan comes into play.

An effective incident response plan should outline the steps immediately after detecting a BEC attack. This includes identifying and isolating affected systems, investigating the breach, notifying affected parties, and reporting the incident to the relevant authorities.

Use of Secure Email Gateways

Secure email gateways can be a valuable tool in the fight against BEC attacks. These solutions provide an additional layer of security, filtering incoming and outgoing emails to identify potential threats.

They use techniques such as link protection and attachment sandboxing to protect against malicious content. Moreover, they can also detect and block emails that attempt to spoof your organization’s domain, reducing the risk of BEC attacks.

Regular Monitoring

Last, regular monitoring of your email systems and network activity can help detect unusual behavior that may indicate a BEC attack. This could include abnormal login patterns, unexpected email forwarding rules, or sudden changes in email volume.

Monitoring tools can automate this process, alerting your IT team to potential threats so they can take swift action. Regular auditing of your systems can also help identify any security gaps that must be addressed.

Conclusion

To summarize, understanding and preventing BEC attacks is critical in today’s digital world. It requires a combination of robust technical measures, comprehensive employee training, and vigilant monitoring. Remember, the cost of preventing these attacks is far less than the potential financial and reputational damage they can cause. So, stay informed, stay prepared, and stay safe.

DON’T FALL FOR THE SCAM: How Business Email Compromise Scams Work And How To Avoid Them (The Digital Guardian Series: Navigating Online Dating, Scams, and Cybersecurity for a Safer Digital World)

InfoSec tools | InfoSec services | InfoSec books

Tags: Business Email Compromise, Email scams

Aug 03 2023

OWASP Top 10 for LLM (Large Language Model) applications is out!

Category: owasp — disc7 @ 12:45 pm
OWASP Top 10 for LLM (Large Language Model) applications is out!

The OWASP Top 10 for LLM (Large Language Model) Applications version 1.0 is out, it focuses on the potential security risks when using LLMs.

OWASP released the OWASP Top 10 for LLM (Large Language Model) Applications project, which provides a list of the top 10 most critical vulnerabilities impacting LLM applications.

The project aims to educate developers, designers, architects, managers, and organizations about the security issues when deploying Large Language Models (LLMs).

The organization is committed to raising awareness of the vulnerabilities and providing recommendations for hardening LLM applications.

“The OWASP Top 10 for LLM Applications Working Group is dedicated to developing a Top 10 list of vulnerabilities specifically applicable to applications leveraging Large Language Models (LLMs).” reads the announcement of the Working Group. “This initiative aligns with the broader goals of the OWASP Foundation to foster a more secure cyberspace and is in line with the overarching intention behind all OWASP Top 10 lists.”

The organization states that the primary audience for its Top 10 is developers and security experts who design and implement LLM applications. However the project could be interest to other stakeholders in the LLM ecosystem, including scholars, legal professionals, compliance officers, and end users.

“The goal of this Working Group is to provide a foundation for developers to create applications that include LLMs, ensuring these can be used securely and safely by a wide range of entities, from individuals and companies to governments and other organizations.” continues the announcement.

The Top Ten is the result of the work of nearly 500 security specialists, AI researchers, developers, industry leaders, and academics. Over 130 of these experts actively contributed to this guide.

Clearly the project is a work in progress, LLM technology continues to evolve, and the research on security risk will need to keep pace.

Below is the Owasp Top 10 for LLM version 1.0

LLM01: Prompt Injection

This manipulates a large language model (LLM) through crafty inputs, causing unintended actions by the LLM. Direct injections overwrite system prompts, while indirect ones manipulate inputs from external sources.

LLM02: Insecure Output Handling

This vulnerability occurs when an LLM output is accepted without scrutiny, exposing backend systems. Misuse may lead to severe consequences like XSS, CSRF, SSRF, privilege escalation, or remote code execution.

LLM03: Training Data Poisoning

This occurs when LLM training data is tampered, introducing vulnerabilities or biases that compromise security, effectiveness, or ethical behavior. Sources include Common Crawl, WebText, OpenWebText, & books.

LLM04: Model Denial of Service

Attackers cause resource-heavy operations on LLMs, leading to service degradation or high costs. The vulnerability is magnified due to the resource-intensive nature of LLMs and unpredictability of user inputs.

LLM05: Supply Chain Vulnerabilities

LLM application lifecycle can be compromised by vulnerable components or services, leading to security attacks. Using third-party datasets, pre-trained models, and plugins can add vulnerabilities.

LLM06: Sensitive Information Disclosure

LLM’s may inadvertently reveal confidential data in its responses, leading to unauthorized data access, privacy violations, and security breaches. It’s crucial to implement data sanitization and strict user policies to mitigate this.

LLM07: Insecure Plugin Design

LLM plugins can have insecure inputs and insufficient access control. This lack of application control makes them easier to exploit and can result in consequences like remote code execution.

LLM08: Excessive Agency

LLM-based systems may undertake actions leading to unintended consequences. The issue arises from excessive functionality, permissions, or autonomy granted to the LLM-based systems.

LLM09: Overreliance

Systems or people overly depending on LLMs without oversight may face misinformation, miscommunication, legal issues, and security vulnerabilities due to incorrect or inappropriate content generated by LLMs.

LLM10: Model Theft

This involves unauthorized access, copying, or exfiltration of proprietary LLM models. The impact includes economic losses, compromised competitive advantage, and potential access to sensitive information.

The organization invites experts to join it and provide support to the project.

You can currently download version 1.0 in two formats.  The full PDF and the abridged slide format.

Web Application Security: Exploitation and Countermeasures for Modern Web Applications

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | AIMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

At DISC InfoSec, we help organizations navigate this landscape by aligning AI risk management, governance, security, and compliance into a single, practical roadmap. Whether you are experimenting with AI or deploying it at scale, we help you choose and operationalize the right frameworks to reduce risk and build trust. Learn more at DISC InfoSec.

InfoSec tools | InfoSec services | InfoSec books

Aug 02 2023

How CISOs can succeed in a challenging landscape

Category: CISO,vCISO — disc7 @ 8:04 am

How CISOs can succeed in a challenging landscape Reimagining operational resilience and recovery in 2023

#CISOs face mounting demands to develop information security strategies that effectively safeguard their organizations against an ever-evolving threat landscape. A strong information security stance is imperative, but the requirements for security and risk management are intricate and distinct for each organization. The alignment of business priorities and suitable solutions may not always be apparent, while swift results and cost-effective measures are crucial.

How-ciso-can-succeed-in-challenging-landscapeDownload
Chief Information Security Officer

CISSP training course

In what situations would a vCISO or CISOaaS Service be appropriate?

DISC-vCISO-v3-0-1Download

Previous posts on vCISO/CISO

CISO Conversations: The Role of the vCISO

How to Start Your Own Cybersecurity Consulting Business: First-Hand Lessons from a Burned-Out Ex-CISO

InfoSec tools | InfoSec services | InfoSec books

Tags: How CISOs can succeed

Aug 02 2023

From tech expertise to leadership: Unpacking the role of a CISO

Category: CISO,vCISO — disc7 @ 7:45 am
From tech expertise to leadership: Unpacking the role of a CISO
In your opinion, what are the key characteristics of an effective CISO? How do you balance technical expertise and leadership skills?

A CISO needs to wear many hats across the business and juggle many competing priorities. They need to be a customer support representative, a product partner, a manager, a visionary, a strategist, and of course, a security expert.

I have found that some of the most important characteristics are to be friendly, honest, and emphatic. Being a friend to the organization and people you work with, rather than leading with just policies and demands, is critical to getting more done and the success of your team.

It may sound counterintuitive, but a good CISO must get out from behind the technology and understand the people they are serving. Of course, you must maintain a high level of technology knowledge, but if you find yourself only sitting in front of a firewall console, you’re probably in the wrong job.

Given the rapid rate of technological change, how should CISOs approach building an organization’s security posture?

With the more-rapidly-than-ever changing environment, you can rarely rely solely on multi-year strategies or multi-quarter roadmaps. You must be ready for constant change and quickly adapt to it.

CISOs must create a security strategy built around anticipating outcomes and a feedback loop to gather information during incidents, assessments, threat analysis, and research. The information gathered should then be turned into metrics which will give insights into if the strategy is working, and, if necessary, how to evolve the strategy.

In today’s business environment, a CISO must communicate complex security issues. How can you ensure you’re understood by all stakeholders, including those who aren’t as tech-savvy

Though CISOs play a lead role in managing an organization’s security posture, it is important that cybersecurity efforts manifest as a shared responsibility across an organization. From new hires to the C-suite, cybersecurity should be a communicated priority for all employees. Everyone should care about security, and if they don’t do it, it’s because they don’t understand something about the situation or ask.

Just as much as a CISO needs to learn about the business, they must also educate other business leaders on what’s out there and the landscape of evolving threats. Then, it’s important to connect these threats and the solutions back to the goals of that part of the business so teams can fully understand the role they can play in mitigating risk.

With declining trust in institutions, how can CISOs help organizations build and maintain trust among customers, employees, and stakeholders?

It’s important to prioritize security and proactively communicate initiatives with stakeholders. However, building and maintaining trust isn’t a one-size-fits-all approach. CISOs must possess the ability to effectively communicate and educate all stakeholders about the specific cyber risks relevant to their organization while also proactively outlining how it is prepared to address those risks. Implementing robust, proactive security measures and emphasizing the protection of sensitive data will reassure customers, stakeholders, and employees alike that their information is secure. Swiftly acting on emerging and existing security threats also reinforces trust and demonstrates an organization’s proactive efforts in addressing threats before they become detrimental.

The role of a CISO encompasses a wide range of responsibilities, including compliance, disaster recovery, and stakeholder management. How can a CISO effectively manage such a diverse portfolio of tasks?

There are three ways I manage competing priorities: Focus, transparency, and accountability. A CISO must focus on the tasks that have the biggest ROIs, and not get distracted by the noise. Leading with transparency will make it clear to everyone within the organization why we are making changes or asks. And finally, security posture and response can only be improved when accountability is clear. And not just accountability of the security team, but accountability from across the organization where everyone understands the responsibility.

By making data-driven decisions and conducting continuous risk assessments, CISOs can strategically allocate resources to high-priority tasks. The delicate balance lies in leading these various aspects while leveraging the expertise of a skilled team to ensure comprehensive security protection across the organization. By staffing a knowledgeable team of security experts and empowering them to take ownership of their day-to-day responsibilities, CISOs can focus their time on providing strategic and executive-level oversight on key issues.

Given the constantly evolving threat landscape, how can a CISO maintain its technological expertise while focusing on leadership and collaboration?

From a leadership standpoint, the CISO is so much more than just security. It’s truly a business leader position, they are collaborating with the other business leaders to share the same resources. CISOs must understand the organizational goals, the customer needs, and the capacity of each team to prioritize security in collaboration with product management, IT leaders, CTO, etc.

CISOs must maintain fundamental technology knowledge but rely on the team’s subject matter expertise for deeper technical aspects. It’s important to find the right training, like CISSP, and vendor-specific certifications, without overwhelming yourself.

Chief Information Security Officer

CISSP training course

In what situations would a vCISO or CISOaaS Service be appropriate?

DISC-vCISO-v3-0-1Download

Previous posts on vCISO/CISO

CISO Conversations: The Role of the vCISO

How to Start Your Own Cybersecurity Consulting Business: First-Hand Lessons from a Burned-Out Ex-CISO

InfoSec tools | InfoSec services | InfoSec books

Tags: role of a CISO

Aug 02 2023

HOW TO EASILY HACK TP-LINK ARCHER AX21 WI-FI ROUTER

Category: Hacking,Wi-Fi Security — disc7 @ 7:21 am
How to easily hack TP-Link Archer AX21 Wi-Fi router

TP-Link has released a fix for a severe vulnerability in its Archer AX21 router. This vulnerability might have allowed attackers to take control of the device and carry out arbitrary operations.

This vulnerability, which has been assigned the identifier CVE-2023-31710, was discovered after a heap-based buffer overflow bug was discovered in the TP-Link Archer AX21 router’s /usr/lib/libtmpv2.so component. Xiaobye, an adept security researcher, is the one who discovered this security weakness and exposed it in full, which made it possible for TP-Link to quickly devise a solution to the problem. The absence of input sanitization in relation to the variable content_length is at the heart of the problem that we are now facing. A clever adversary might potentially alter this variable, which provides information on the length of the data included in the TMP packet. This vulnerability may be exploited by a  hacker by submitting a request to the router that was painstakingly designed, which would then cause the router to carry out the commands. Archer routers only allow ‘admin’ users, who are endowed with full root access. This exacerbates the severity of the problem. Therefore, in the event that a threat actor is successful in getting command execution, that actor would therefore take control of the router and acquire administrative capabilities.

This security flaw affects particular router versions, including Archer AX21(US)_V3_1.1.4 Build 20230219 and Archer AX21(US)_V3.6_1.1.4 Build 20230219, among others. Nevertheless, TP-Link has released patches for these versions, which may be found under the names Archer AX21(US)_V3.6_230621 and Archer AX21(US)_V3_230621, respectively. It is recommended that consumers who are affected get their routers up to date as soon as they can.

Xiaobye has continued his commendable efforts to shed light on this matter by publishing a compelling video presentation of exploiting the CVE-2023-31710 vulnerability on his Github repository.

In order to strengthen the safety of your router, you should take additional precautions in addition to updating the firmware on it.

Hacking Exposed Wireless, Third Edition: Wireless Security Secrets & Solutions (Hacking Exposed)

CISSP training course

InfoSec tools | InfoSec services | InfoSec books

Tags: TP-LINK ARCHER AX21

Aug 01 2023

A step-by-step guide for patching software vulnerabilities

Category: Security patching,Security vulnerabilities — disc7 @ 8:59 am
A step-by-step guide for patching software vulnerabilities

The Cyber Threat Index 2023 by the Coalition anticipates a 13% increase in the average rate of Common Vulnerabilities and Exposures (CVEs) compared to 2022, projecting it to surpass 1,900 per month in 2023. This surge in CVEs poses a challenge for organizations as they grapple with managing the release of thousands of patches and updates every month.

Streamline your patch management process

First a quick disclaimer. Proper patch management relies on important factors like size of an organization, complexity of an IT environment, criticality of systems, and number of resources allocated to manage it all, so plan accordingly. Also, this advice assumes you already have some sort of endpoint management solution or function in place for deploying patches. If not, that’s step one.

Assuming you have a solution in place, the next step is to evaluate and prioritize patches.

Not all vulnerabilities are created equally, which means not all patches are either. But as vulnerabilities like WannaCry demonstrated, delayed patching can have catastrophic consequences. Therefore, it’s important to prioritize updates that have the highest severity of non-superseded vulnerabilities and/or the highest exposure for each environment. For example, if you have an update that impacts only a few devices out of a thousand, and another that impacts 80% of devices, but both are critical, focus on the one that could have the biggest negative impact, and then address the others.

Once the critical updates are addressed, plan to move onto the non-critical patches, which are often driver updates or new software that enhances user experience and prioritize those based on importance to business operations.

Many use the Common Vulnerability Scoring System (CVSS) to help prioritize updates, which is a good starting point. Just remember that many vulnerabilities rated at a medium severity level are ignored – and found to be the source of a breach later.

Once you’ve prioritized the types of updates, the next step is to create guidelines for testing them before they go into production.

The last thing you want to do is break the system. Start by researching the criteria of each update and identifying which components require testing. Next, install each update on at least five off-network devices to be tested against proven success criteria. Record the evidence and have another person review it. Be sure to find out if the update has an uninstaller and use it to ensure complete and safe removal of outdated programs.

If you’re like most organizations, you’ll likely plan on having tons of updates/patches happening all the time. But the more updates installed at any given time increases the risk of end-user disruption (i.e., greater volume of data needing to be downloaded, longer installation times, system reboots, etc.).

Therefore, the next step is to assess your system’s bandwidth, calculate the total number and size of the updates against the total number of devices and types. This can prevent system overloads. When in doubt, just plan to start with five updates and then reassess bandwidth.

Additionally, if you follow any change management best practices (such as ITIL, Prince2, or ServiceNow), it’s important you adhere to those processes for proper reporting and auditability. They usually require documentation on which updates are needed, the impact on a user, evidence of testing, and go-live schedules. Capturing this data properly through the above steps is often required for official approvals as it serves as a single source of truth.

We’ve now gotten to the point of deployment. The next step is to ensure deployment happens safely. I recommend using a patch management calendar when making change requests and when scheduling or reviewing new patch updates. This is where you define the baselines for the number of updates to be deployed and in which order. This should utilize information gathered from previous steps. Once that baseline is set, you can schedule the deployment and automate where necessary.

At last, we’ve made it to the final step: measuring success. This can be handled in a variety of ways. For example, by the number of registered help desk incidents, the ease of which the process can be followed or repeated, or the number of positive reports provided by your toolsets. But ultimately what matters is swift deployment, streamlined repeatable processes, a reduction in manual requirements, and in the end, an organization that is less vulnerable to exploit.

A quick note on where patching often goes awry

Believe it or not, some organizations still allow users to have local admin rights for patching. This creates major attack surfaces, and the reality is, no IT team should rely on end-users for patching (blanket admin rights are just too risky).

Some also rely on free tools, but these often do not deliver all the security needed for patching. They also generally don’t provide the necessary reporting to ensure systems are 100% patched (i.e., validation). And finally, there is an over-reliance on auto-updates. Auto-updates can provide a false sense of security and can impact productivity if they are triggered during work hours.

Conclusion

Whether large or small, organizations continue to struggle with patching. I hope this quick step-by-step guide of key considerations for patch management helps your organization create a new framework or optimize an existing one.

Vulnerability And Patch Management A Complete Guide

CISSP training course

InfoSec tools | InfoSec services | InfoSec books

Tags: Vulnerability Management Program

Jul 31 2023

Tools for cloud transition and securing cloud environments?

Category: Cloud computing,Security Tools — disc7 @ 10:06 am

CISA released a fact-sheet, listing some of the great tools that CISA offers for orgs to transition and secure their cloud environments?

Five tools are described in the fact-sheet, along with other guidance to “…provide network defenders and incident response/analysts open-source tools, methods, and guidance for identifying, detecting, and mitigating cyber threats, known vulnerabilities, and anomalies while operating a cloud or hybrid environment.”

1- The Cyber Security Evaluation Tool – CISA developed the Cyber Security Evaluation Tool (CSET) using industry-recognized standards, frameworks, and recommendations to assist organizations in evaluating their enterprise and asset cybersecurity posture.

2- Secure Cloud Business Applications (SCuBA) project – which provides guidance for FCEB agencies securing their cloud business application environments and protecting federal information created, accessed, shared, and stored in those environments.

3- Untitled Goose Tool – CISA, together with Sandia National Laboratories, developed the Untitled Goose Tool to assist network defenders with hunt and incident response activities in Microsoft Azure, AAD, and M365 environments.

4- Decider – assists incident responders and analysts in mapping observed activity to the MITRE ATT&CK framework.

5- Memory Forensic on Cloud – Memory Forensic on Cloud, developed by JPCERT/CC, is a tool for building a memory forensic environment on Amazon Web Services.

CISA-cloud-tools-for-migrationDownload

CISSP training course

InfoSec tools | InfoSec services | InfoSec books

Tags: CISA security tools

Jul 31 2023

How the best CISOs leverage people and technology to become superstars

Category: CISO,vCISO — disc7 @ 9:48 am
How the best CISOs leverage people and technology to become superstars

Superstar CISOs stand out from the rest due to their acute understanding of the growing threat landscape and the shortage of cybersecurity skills. However, they refuse to succumb to despair and instead leverage their existing assets effectively, notably by recognizing an overlooked security resource: their development teams.

In the era of DevSecOps hype, it’s common to say that security is everyone’s responsibility. But there are limits to what untrained and unmotivated workers – especially those who don’t work in IT – can do to make their organization more secure against cyberthreats.

For example, in the real world, travelers at a busy airport should feel responsible for reporting an unattended bag sitting alone in a suspicious location. However, they aren’t trained to inspect that bag to look for threats or empowered to take any actions on their own. At a company, it’s one thing to make everyone aware of cybersecurity, and another to educate them to make their organization more secure within the context of their role or to use the defensive tools they already have in place to counter threats and squash vulnerabilities.

For that, companies need to invest in upskilling. It’s far better, and oftentimes easier, to invest in the talented, loyal staff that are already a part of your organization than to try and hire new people from the outside. But even then, putting those learning resources in the best place to get the required results is key.

Developers already understand IT since they write much of the code for the programs being used by their organizations. And they are often ready, willing, and able to upskill in cybersecurity to help make them even more amazing at their jobs. Smart CISOs are tapping into that enthusiasm and providing developers with the education pathways they want and need, with the payoff being a reduction in common vulnerabilities (not to mention less pressure on overworked AppSec personnel).

Making sure developers get the right upskilling and support

The best CISOs know that upskilling is critical to success. But not just any training will do, especially for the development community who already have a good baseline understanding of IT. A “check-the-box” program won’t offer much return on investment and will likely frustrate developers into poor performance and a lifelong hatred of working with security teams.

Likewise, any solution that impedes their workflow, fails to stay agile with enterprise security goals, or cannot deliver the right education at the right time in an easily digestible format, is unlikely to result in foundational security awareness or skills.

Other secrets of superstar CISOs

Exemplary CISOs are also able to address other key pain points that traditionally flummox good cybersecurity programs, such as the relationships between developers and application security (AppSec) teams, or how cybersecurity is viewed by other C-suite executives and the board of directors.

For AppSec relations, good CISOs realize that developer enablement helps to shift security farther to the so-called left and closer to a piece of software’s origins. Fixing flaws before applications are dropped into production environments is important, and much better than the old way of building code first and running it past the AppSec team at the last minute to avoid those annoying hotfixes and delays to delivery. But it can’t solve all of AppSec’s problems alone. Some vulnerabilities may not show up until applications get into production, so relying on shifting left in isolation to catch all vulnerabilities is impractical and costly.

There also needs to be continuous testing and monitoring in the production environment, and yes, sometimes apps will need to be sent back to developers even after they have been deployed. A great CISO, with a foot in development and security, can smooth out those relations and keep everyone working as a team.

Getting other C-suite executives onboard with better security might be an even more difficult challenge, with leadership outside the CISO and CIO normally looking at business objectives and profits before anything else. To counter that, superstar CISOs know how to show a direct correlation between better, more mature cybersecurity and increased revenue, and how it can even provide a competitive advantage against the competition.

It’s not easy being a CISO, and certainly more challenging than at any other point in history. But those CISOs who master that adversity are becoming true superstars within their companies and communities. They competently employ agile developer upskilling, champion security culture, streamline relationships between the traditional rivals of development and AppSec teams, and encourage leadership to foster a security-first approach from the top down.

Chief Information Security Officer

CISSP training course

In what situations would a vCISO or CISOaaS Service be appropriate?

DISC-vCISO-v3-0-1Download

Previous posts on vCISO/CISO

CISO Conversations: The Role of the vCISO

InfoSec tools | InfoSec services | InfoSec books

Tags: CISOs

Jul 30 2023

Top 7 Open Source Firewall

Category: Firewall,next generation firewall — disc7 @ 2:39 pm

What is an Open Source Firewall?

An Open Source Firewall refers to a network security solution that is developed and distributed as open-source software. Open-source software is typically released with a license that allows users to view, modify, and distribute the source code freely. This means that anyone can access the inner workings of the firewall, make improvements, and share those improvements with the community.

Open Source Firewalls are popular because they offer several advantages:

  1. Transparency: Since the source code is open and accessible to the public, users can review the code to ensure there are no hidden functionalities or security vulnerabilities.
  2. Customizability: Organizations can modify the firewall’s source code to meet their specific security requirements and network configurations.
  3. Community Support: Open-source projects often have active communities of developers and users who collaborate, share knowledge, and provide support. This community-driven approach can lead to faster bug fixes, updates, and improvements.
  4. Cost-Effectiveness: Open Source Firewalls are typically free to use, reducing licensing costs and making them attractive to organizations with budget constraints.
  5. Stability and Reliability: Many open-source projects have been around for years and have undergone extensive testing and development, resulting in stable and reliable solutions.

Source: https://hackersonlineclub.com/open-source-firewall/

Top 7 open-source firewalls known for their reliability and robust network security features:

1. pfSense:

pfSense is a powerful open-source firewall and routing platform based on FreeBSD. It provides a feature-rich web interface that allows users to configure and manage their network security easily.

Key Features: VPN support, traffic shaping, intrusion detection and prevention, content filtering, and multi-WAN load balancing.

Practical OPNsense: Building Enterprise Firewalls with Open Source

2. OPNsense:

OPNsense is another FreeBSD-based open-source firewall that offers advanced security features and a user-friendly interface. It focuses on providing a secure and stable platform for network protection.

Key Features: Firewall rules, Virtual LAN (VLAN) support, captive portal, SSL decryption, and forward caching proxy.

Practical OPNsense: Building Enterprise Firewalls with Open Source

3. IPFire:

IPFire is a Linux-based  firewall designed with a modular architecture, allowing users to add various add-ons and extensions to enhance functionality.

Key Features: Intrusion detection and prevention system (IDPS), a proxy server, support for Virtual Private Networks (VPN), Quality of Service (QoS) capabilities, and compatibility with Wi-Fi access points.

4. Untangle NG Firewall:

Untangle NG Firewall is a Linux-based open-source solution that provides comprehensive network security and unified threat management (UTM) features.

Key Features: Web filtering, application control, antivirus, spam blocker, and intrusion prevention system.

5. ClearOS:

ClearOS is a Linux-based open-source firewall that offers a range of security features and is suitable for small businesses and home users.

Key Features: Web content filter, antivirus, intrusion protection, Virtual Private Network (VPN), and bandwidth manager.

6. Smoothwall:

Smoothwall is a Linux-based firewall that provides secure internet access and content filtering for schools, businesses, and organizations.

Key Features: Web proxy, bandwidth management, time-based access control, URL filtering, and reporting tools.

7. Endian Firewall Community:

Endian Firewall Community is an open-source UTM solution that offers essential security features to protect networks from various threats.

Key Features: Stateful inspection firewall, antivirus, spam filtering, VPN support, and content filtering.

Smoothwall and Endian Firewall Community have garnered a loyal user base due to their simplicity and effectiveness in securing networks. Regular updates and community support are crucial in maintaining a reliable and secure firewall solution, as with any open-source software.

The important thing is your network’s specific needs, and choose the best firewall that best aligns with your requirements and resources.

Each of the above open-source firewalls comes with its features and capabilities, so the choice as per the specific requirements and the level of complexity needed for your network. Stay updated with the latest releases and security patches to maintain a secure network environment.

When choosing an Open Source Firewall, it’s essential to consider factors such as the size and complexity of your network, the required features, and the level of community support available for the specific project. Proper configuration and ongoing maintenance are critical to ensure the firewall’s effectiveness in protecting your network from various cyber threats.

InfoSec books | InfoSec tools | InfoSec services

Tags: Open Source Firewall

Jul 30 2023

How can we solve cybersecurity talent issue?

Category: Cyber career,Security training — disc7 @ 11:18 am

The cybersecurity talent issue is a significant challenge faced by organizations worldwide. Solving this problem requires a combination of short-term and long-term strategies to attract, develop, and retain skilled cybersecurity professionals. Here are some steps that can help address the cybersecurity talent shortage:

  1. Education and Training: Invest in cybersecurity education and training programs at various levels, from primary education to advanced professional certifications. Collaborate with educational institutions and industry experts to design comprehensive and up-to-date curricula.
  2. Promote Cybersecurity as a Career Choice: Raise awareness about the importance of cybersecurity as a career option. Target students and professionals from diverse backgrounds to encourage them to pursue cybersecurity careers.
  3. Apprenticeships and Internships: Establish apprenticeship and internship programs to provide hands-on experience to aspiring cybersecurity professionals. This can help bridge the gap between theoretical knowledge and practical skills.
  4. Industry Collaboration: Foster collaboration between academic institutions and the private sector. Industry partnerships can help ensure that cybersecurity programs align with current industry needs and practices.
  5. Cyber Range and Simulations: Set up cyber ranges and simulations to provide a safe environment for individuals to practice and enhance their cybersecurity skills. These platforms allow trainees to learn through realistic scenarios without risking real-world systems.
  6. Mentorship Programs: Create mentorship programs where experienced cybersecurity professionals can guide and support newcomers in their career development. This can be especially helpful in retaining talent and promoting professional growth.
  7. Competitive Compensation and Benefits: Offer competitive salaries and benefits to attract skilled cybersecurity professionals. Recognize their value and contribution to the organization’s security posture.
  8. Continuous Professional Development: Encourage and facilitate continuous learning and professional development for existing cybersecurity teams. This can be achieved through regular training, attending conferences, and participating in workshops.
  9. Diversity and Inclusion: Promote diversity and inclusion within the cybersecurity workforce. A diverse team brings varied perspectives and problem-solving approaches, ultimately enhancing the overall security posture.
  10. Public-Private Partnerships: Encourage partnerships between government agencies, private companies, and non-profit organizations to address the talent shortage collectively. Collaboration can lead to resource-sharing and more comprehensive solutions.
  11. Automation and AI Solutions: Implement cybersecurity automation and AI technologies to augment the existing workforce. Automation can handle repetitive tasks, allowing professionals to focus on more complex issues.
  12. Retaining Talent: Focus on employee retention by providing a supportive and rewarding work environment. Recognize and celebrate cybersecurity achievements and milestones within the organization.
  13. Ethical Hacking Competitions and CTFs: Support and sponsor ethical hacking competitions and Capture The Flag (CTF) events. These challenges attract cybersecurity enthusiasts and offer valuable learning experiences.

By combining these strategies and adopting a long-term perspective, organizations can start making progress in solving the cybersecurity talent issue. Remember that cybersecurity is an ever-evolving field, and continuous efforts are needed to attract and retain skilled professionals.

Blended training course will give you what you need to develop your career and pass the challenging CISSP (Certified Information Systems Security Professional) exam first time.

Cybersecurity and information resilience – BSI Group

Computer Security

How Does Social Media Affect Teenagers, and Is It Positive?

InfoSec books | InfoSec tools | InfoSec services

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | AIMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

At DISC InfoSec, we help organizations navigate this landscape by aligning AI risk management, governance, security, and compliance into a single, practical roadmap. Whether you are experimenting with AI or deploying it at scale, we help you choose and operationalize the right frameworks to reduce risk and build trust. Learn more at DISC InfoSec.

Tags: CISSP, Computer security, Information resilience

Jul 29 2023

is there an underserved market segment in Cyber Security?

Category: cyber security — disc7 @ 4:53 pm

The cybersecurity industry is constantly changing, and market conditions can shift quickly. To identify potential underserved market segments, it is crucial to regularly conduct updated market research. Staying informed about the latest developments helps businesses recognize new opportunities and areas where cybersecurity solutions are in demand but currently lacking.

There are some areas where there might have been or still are underserved market segments in cybersecurity include:

  1. Small and Medium-sized Enterprises (SMEs): Smaller businesses often lack the resources and expertise to implement robust cybersecurity measures. They may not have access to dedicated cybersecurity teams or the budget to invest in expensive security solutions.
  2. Nonprofit Organizations: Nonprofits, especially smaller ones, may face similar challenges as SMEs when it comes to cybersecurity. They might not have the necessary funds or expertise to adequately protect their data and digital assets.
  3. Individuals and Consumers: With the increasing prevalence of cyber threats targeting individuals, there may be a market segment for user-friendly and affordable cybersecurity solutions tailored to the needs of regular consumers.
  4. Internet of Things (IoT) Devices: As the number of IoT devices continues to grow, there is a potential underserved market for specialized cybersecurity solutions designed to secure these devices and the data they generate.
  5. Cloud Security: With the widespread adoption of cloud computing, ensuring the security of cloud-based data and services has become critical. There may be opportunities for specialized cloud security solutions catering to different industries and use cases.
  6. Critical Infrastructure: Industries such as energy, transportation, and healthcare that rely heavily on interconnected systems and technologies may have specific cybersecurity needs that could be underserved.
  7. Emerging Technologies: As new technologies like artificial intelligence, blockchain, and quantum computing gain traction, there may be a need for cybersecurity solutions that address the unique risks associated with these technologies.
  8. Cybersecurity Workforce Development: With the growing demand for cybersecurity professionals, there may be an underserved market segment for training and educational programs to address the workforce shortage in the industry.

It’s important to note that while some segments may have been underserved, the cybersecurity industry is competitive, and companies are continually looking for new opportunities. As the threat landscape changes, new niche areas may emerge, and existing underserved segments may receive more attention from cybersecurity companies and entrepreneurs.

Cyber Security Innovation for the Digital Economy

Digital Disruption: Implications and opportunities for Economies, Society, Policy Makers and Business Leaders

InfoSec books | InfoSec tools | InfoSec services

Tags: Cyber Security Innovation, underserved market

Jul 29 2023

My Adventures as the World’s Most Wanted Hacker 

Category: Hacking — disc7 @ 4:12 pm

“Ghost in the Wires” is an autobiography written by Kevin Mitnick, co-authored by William L. Simon, published in 2011. The book details the life and adventures of Kevin Mitnick, one of the most famous and notorious hackers in computer history. Mitnick’s story is not only a thrilling tale of hacking, intrigue, and escapes but also provides valuable insights into the world of cybersecurity, privacy, and the vulnerabilities of information systems.

The book showcases Mitnick’s skills as a hacker, which allowed him to gain unauthorized access to computer networks and systems of major companies during the 1980s and 1990s. He used various techniques to exploit security weaknesses and evade detection by law enforcement agencies. Mitnick’s activities led to a high-profile chase by the FBI and other authorities as they tried to capture him.

The “Ghost in the Wires” title alludes to Mitnick’s ability to remain elusive and undetected, much like a ghost haunting the digital realm. The book delves into the tactics he used to cloak his identity, manipulate phone switches, and navigate through complex computer and cellular networks, staying one step ahead of the authorities.

Throughout the story, Mitnick shares the mindset and strategies he employed, giving readers an insight into the mind of a hacker and how cybersecurity measures were inadequate in that era. It also highlights the need for companies to reevaluate their security protocols and protect their sensitive information from cyber threats.

As a hacker turned cybersecurity consultant, Mitnick ultimately uses his experiences to shed light on the importance of improved security practices, awareness, and the dangers of social engineering. The book serves as a cautionary tale for individuals and organizations alike, emphasizing the need to stay vigilant and proactive in the face of evolving cyber threats.

Overall, “Ghost in the Wires” is not only an enthralling tale of a skilled hacker’s escapades but also a valuable resource for understanding cybersecurity and the significance of protecting digital information in the age of Big Data and pervasive surveillance.

“Mitnick manages to make breaking computer code sound as action-packed as robbing a bank.” — NPR

Tags: Kevin Mitnick, World's Most Wanted Hacker

Jul 29 2023

NEW ATTACK TECHNIQUE TO HACK APACHE TOMCAT SERVERS

Category: Cyber Attack,Hacking,Web Security — disc7 @ 11:56 am
New attack technique to hack Apache Tomcat Servers

The article discusses a new cyberattack targeting Apache Tomcat servers, a popular open-source web server environment written in Java. Apache Tomcat supports various technologies and is widely used by developers.

The attack is orchestrated by the Mirai botnet and bitcoin miners, specifically targeting improperly configured Apache Tomcat servers lacking sufficient security measures. The research, conducted by Aqua, involved setting up Tomcat server honeypots to monitor the attacks over a two-year period.

During the research, more than 800 attacks were recorded, with an overwhelming 96% of them linked to the Mirai botnet. Out of these attempts, 20% (152 attacks) utilized a web shell script named “neww,” originating from 24 different IP addresses. Interestingly, 68% of these attacks were attributed to a single IP address, 104.248.157[.]218. Fortunately, the attacks using the “neww” web shell script were unsuccessful in compromising the targeted servers.

A brute force attack was carried out by the threat actor against the scanned Tomcat servers in order to acquire access to the web application management using a variety of different credential combinations.

After successfully gaining entrance, threat actors will install a WAR file containing a web shell called ‘cmd.jsp’ on the Tomcat server that has been hacked. This will allow for remote command execution.

The “downloading and running” of the “neww” shell script is an integral part of the whole attack chain. The “rm -rf” command is then used to remove the script once it has been executed. The software then retrieves 12 binary files that are customized to the architecture of the system that is being attacked.

While all of these components work together to expedite the web app deployment on compromised Tomcat servers in an effective manner.

The last step of the malware is a variation of the Mirai botnet that uses infected systems for the purpose of coordinating distributed denial-of-service (DDoS) assaults.

Threat actor infiltrates web app manager by using legitimate credentials, uploads disguised web shell in WAR file, remotely executes commands, and starts the attack.The statistics shed light on the profitable expansion of cryptocurrency mining, which is projected to have a 399% increase and 332 million cryptojacking assaults worldwide in H1 2023.

Flaw in Apache Tomcat forces server to perform DoS attacks against itself & the network

Recommendation
In order to protect against attacks of this kind, specialists in the field of cybersecurity suggested the following measures:

Make sure that each of your environments has the appropriate configuration.
Be careful to do regular scans of your servers to look for any dangers.
Cloud-native tools that scan for vulnerabilities and misconfigurations should be made available to your development, DevOps, and security teams so that they can better do their jobs.
It is imperative that you use runtime detection and response technologies.

Web Security for Developers: Real Threats, Practical Defense

InfoSec books | InfoSec tools | InfoSec services

Tags: APACHE TOMCAT SERVERS, web security

« Previous Page — Next Page »