DISC InfoSec blogYou searched for vciso | Page 21 of 42

vCISO Guide for Small & Mid Sized Businesses

Tags: CISO accountability, The CISO Playbook

Comments (1)

Dec 17 2024

Criminals Exploit Windows Management Console to Deliver Backdoor Payloads

Category: Backdoor,Cybercrime,Windows Security — disc7 @ 12:42 pm

Cybercriminals have launched a campaign known as FLUX#CONSOLE, exploiting Microsoft Common Console Document (.MSC) files to infiltrate systems with backdoor malware. This method allows attackers to bypass traditional antivirus defenses by leveraging lesser-known Windows features. The campaign represents a shift from the previously common use of LNK files in phishing attacks.

The attack begins with phishing emails that use tax-related themes to deceive users into opening seemingly legitimate documents. These emails contain attachments disguised as PDFs, such as “Income-Tax-Deduction-and-Rebates202441712.pdf,” which are actually .MSC files. The default setting in Windows hides file extensions, making it easier for these malicious files to masquerade as harmless documents.

When a user opens the .MSC file, it executes embedded malicious scripts under the legitimate mmc.exe process. The attackers employ advanced obfuscation techniques to conceal the malicious code, which is often written in JavaScript or VBScript. This method allows the malware to run unnoticed, as it appears to be part of a standard administrative tool.

The .MSC file serves as both a loader and dropper for the malware payload. It delivers a malicious DLL file named DismCore.dll, which is sideloaded through the legitimate Dism.exe process. To maintain persistence on the infected system, the malware creates scheduled tasks, such as “CoreEdgeUpdateServicesTelemetryFallBack,” ensuring it executes every five minutes, even after system reboots.

This campaign highlights the increasing sophistication of phishing techniques and the exploitation of trusted Windows features. By abusing .MSC files and legitimate system processes, attackers can evade detection and establish persistent access to compromised systems. Users and organizations should be cautious of unexpected emails with attachments and consider adjusting settings to display file extensions to better identify potentially malicious files.

For further details, access the article here

Tags: Deliver Backdoor Payloads, Windows Management Console

vCISO Guide for Small & Mid Sized Businesses

Dec 16 2024

This ZIP File Hack Could Let Malware Bypass Your Antivirus

Category: Antivirus,Malware — disc7 @ 2:38 pm

WinRAR and ZIP File Exploits

A recently discovered exploit leverages ZIP file concatenation to bypass antivirus detection and deliver malware. This technique involves appending malicious data to a legitimate ZIP file in a manner that confuses some file-handling software. While certain tools may fail to display or detect the appended content, others expose the malicious files, creating a dangerous inconsistency.

The ZIP file format organizes compressed files with a central directory at the end of the archive. By appending new ZIP data to an existing archive, attackers create a “concatenated” file. This approach takes advantage of discrepancies in how ZIP file structures are processed by different software, leaving some tools vulnerable to malicious payloads.

The primary threat lies in how antivirus programs handle these concatenated files. Many fail to fully scan the appended portions of a ZIP archive, allowing embedded malware to evade detection. When unsuspecting users extract such files, they risk executing harmful code, potentially compromising their systems.

Recursive Extraction Defenses: Traditional detection solutions may lack recursive unpacking capabilities, which means they do not parse every layer of a concatenated ZIP file. Threat actors leverage this gap to keep malicious content hidden in nested or concatenated layers that security software may overlook.

Popular tools like WinRAR, which is widely used for managing ZIP archives, are particularly impacted by this flaw. The issue doesn’t stem from the ZIP format itself but from how specific tools and antivirus solutions interpret concatenated data. This underscores the need for both robust software engineering and thorough security testing.

To mitigate the risk, it’s crucial for users to keep their antivirus software up to date. Security tools are being enhanced to detect these sophisticated attack methods, but vigilance remains key. Users should be cautious when handling ZIP files, especially those from unfamiliar or untrusted sources, and ensure all files are scanned before opening.

Organizations can further protect themselves by educating employees and enforcing strict file-handling policies. Training users to identify suspicious files and avoid extracting archives without proper scanning can greatly reduce exposure to these attacks. This layered approach, combining technology, awareness, and policy, is essential to defend against evolving cybersecurity threats.

For further details, access the article here

Tags: Bypass, ZIP File Hack

The ripple effects of regulatory actions on CISO reporting

Dec 12 2024

We need to redefine and broaden the expectations of the CISO role

Category: CISO,vCISO — disc7 @ 11:09 am

CISOs must distinguish between “good risks” that promote innovation and “bad risks” that could jeopardize business operations.

The role of a Chief Information Security Officer (CISO) has become increasingly complex, evolving beyond technical oversight into a strategic leadership position. Modern CISOs must safeguard digital assets, manage cyber threats, and ensure data integrity while aligning security goals with business objectives. Their responsibilities demand a mix of technical expertise, risk management, and strong communication skills to bridge the gap between technical teams and executive stakeholders.

CISOs today face challenges stemming from rapid digital transformations, such as the adoption of cloud services and emerging technologies. They must work closely with technology vendors and other stakeholders to ensure security is embedded in the organization’s processes. Effective CISOs prioritize scenario-based thinking, adapt to evolving risks, and foster agility in their teams to keep pace with business demands and external pressures.

Building relationships across the organization is critical for managing risks effectively. CISOs must distinguish between “good risks” that promote innovation and “bad risks” that could jeopardize business operations. This balancing act involves maintaining trust and constant communication across departments. Additionally, agility, adaptability, and a culture of continuous learning are essential for managing change and organizational resilience.

To communicate effectively with boards and non-technical audiences, CISOs should tailor their messages using relevant examples and simple metaphors. Understanding the audience’s background and aligning cybersecurity discussions with their perspectives fosters clarity and trust. This skill is increasingly crucial as CISOs work to align security strategies with broader organizational goals and rapidly changing regulatory landscapes.

Source: We must adjust expectations for the CISO role

How CIOs, CTOs, and CISOs view cyber risks differently

Why CISOs face greater personal liability

What are the Common Security Challenges CISOs Face?

How vCISO Services Empower SMBs

How Professional Service Providers Can Add vCISO Service

Why Choose vCISO Services?

Enhance Your Security Framework with DISC LLC

5 key tasks for a vCISO to accomplish in the first three months

Expertise in Virtual CISO (vCISO) Services

In what situations would a vCISO or CISOaaS service be appropriate?

The Elemental Truth of vCISO Services: vCISO Guide for Small & Mid Sized Businesses

The Phantom CISO: Time to step out of the shadow

Comprehensive-vCISO-Services Download

Tags: CISO role

Comments (6)

Dec 03 2024

Why your Company may Need a Virtual CISO?

Category: CISO,vCISO — disc7 @ 9:52 am

Why Companies Turn to Virtual CISOs
The need for a virtual chief information security officer (vCISO) often arises from specific scenarios, such as expanding security strategies, responding to breaches, or navigating mergers and acquisitions. Managed security service providers (MSSPs), incident response firms, venture capitalists, and cyber insurers increasingly recommend vCISOs to help businesses establish robust security practices. By providing expertise and consistency, vCISOs assist companies in developing and managing comprehensive security programs while offering a fresh, big-picture perspective.

Cost-Effective Security Leadership
Hiring a full-time CISO is challenging and costly due to the shortage of skilled cybersecurity professionals. A vCISO offers a flexible alternative, delivering part-time leadership tailored to the company’s needs. Unlike consultants, vCISOs provide continuity and align with an agreed-upon strategy, bringing specialized knowledge in areas like operational technology or regional regulations. This approach makes vCISOs an attractive option for companies looking for expert guidance without the overhead of a full-time executive.

Strategic Security Planning
A vCISO can help organizations develop long-term security strategies, particularly in response to regulatory requirements, industry standards, or competitive pressures. They offer actionable plans and ensure companies are not merely meeting the minimum requirements, such as those for cyber insurance. By addressing evolving threats and regulatory landscapes, vCISOs guide businesses in staying proactive and prepared.

Bridging Capability Gaps
While vCISOs provide strategic direction, companies may also need operational support to execute these plans. In cases where internal capabilities are insufficient, vCISOs can assess and recommend managed security services to fill the gaps. This dual role—strategy and evaluation—helps businesses align their security programs with realistic goals and resources.

Specialized Expertise for Emerging Threats
vCISOs are especially valuable for addressing emerging challenges, such as new technologies or shifts in the threat landscape. Their specialized expertise allows them to pinpoint and address gaps that internal teams may lack the capacity or knowledge to handle. This makes vCISOs an invaluable resource for companies seeking to strengthen their risk profiles and adapt to an ever-evolving cybersecurity environment.

How Professional Service Providers Can Add vCISO Service

Why Choose vCISO Services?

Enhance Your Security Framework with DISC LLC

5 key tasks for a vCISO to accomplish in the first three months

Expertise in Virtual CISO (vCISO) Services

In what situations would a vCISO or CISOaaS service be appropriate?

The Elemental Truth of vCISO Services: vCISO Guide for Small & Mid Sized Businesses

The Phantom CISO: Time to step out of the shadow

Tags: CISO, CISOs, vCISO, vCISO as a service, vCISO services

10 key benefits of ISO 27001 Cert for SMBs

Dec 03 2024

Why Your Organization Needs ISO 27001 Amid Rising Risks

Category: Information Security,ISO 27k — disc7 @ 8:04 am

Why ISO 27001 Is Essential for Thriving Businesses

The Growing Importance of ISO 27001
Data breaches, ransomware attacks, and increasing compliance requirements pose significant risks to businesses of all sizes. Without a structured approach to safeguarding sensitive data, organizations remain vulnerable. ISO 27001, the international standard for information security management, provides a proven framework to protect businesses and reassure stakeholders. Its structured methodology can address security gaps and mitigate risks effectively.

Sign 1: Rising Cybersecurity Threats
With cyberattacks becoming more sophisticated, businesses of all sizes are targets. Small companies, in particular, face devastating consequences, as 60% fail within six months of a breach. ISO 27001 offers a systematic, risk-based approach to identify vulnerabilities, prioritize threats, and establish protective controls. For instance, an e-commerce company can use ISO 27001 to secure payment data, safeguard its reputation, and maintain customer trust.

Sign 2: Client Expectations for Security Assurance
Clients and partners increasingly demand proof of robust security practices. Questions about how sensitive information is managed and requests for certifications highlight the need for ISO 27001. Certification not only enhances security but also demonstrates commitment to data protection, building trust and offering a competitive edge in industries like finance, healthcare, and technology. For example, a marketing agency could avoid losing key clients by implementing ISO 27001 to showcase its security measures.

Sign 3: Navigating Regulatory Challenges
Strict regulations such as GDPR, PCI DSS, CPRA, and HIPAA mandate stringent data protection protocols. Non-compliance risks legal penalties, financial losses, and eroded customer trust. ISO 27001 simplifies compliance by aligning with various regulatory requirements while improving operational efficiency. For example, a software company handling EU data avoided GDPR fines by adopting ISO 27001, enabling regulatory compliance and global expansion.

Take Action Before It’s Too Late
If your business faces inconsistent security practices, data breach fears, or rising regulatory pressures, ISO 27001 is the solution. Scalable and adaptable for organizations of any size, it ensures consistent security across teams, prevents breaches, and facilitates recovery when incidents occur. Starting with a gap analysis and prioritizing high-risk areas, ISO 27001 provides a strategic path to safeguarding your business, strengthening trust, and gaining a competitive edge. Don’t wait—start your journey toward ISO 27001 certification today.

ISO 27001: Building a Culture of Security and Continuous Improvement

Penetration Testing and ISO 27001 – Securing ISMS

Secure Your Digital Transformation with ISO 27001

Significance of ISO 27017 and ISO 27018 for Cloud Services

The Risk Assessment Process and the tool that supports it

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

OWASP updated 2025 Top 10 Risks for Large Language Models (LLMs), a crucial resource for developers, security teams, and organizations working with AI.

Tags: iso 27001, ISO 27001 2022, iso 27001 certification

Comments (6)

Dec 02 2024

AI-based tools designed for criminal activity are in high demand

Category: Cyber crime,Cybercrime,Ransomware — disc7 @ 9:13 am

The landscape of ransomware attacks has shifted dramatically, with cybercriminals increasingly using AI to automate, accelerate, and scale their operations. These attacks now target sectors like healthcare, manufacturing, and critical infrastructure, exploiting their reliance on uptime and historical underinvestment in cybersecurity. The rise in ransomware attacks—up 67% in 2023—has expanded attack surfaces, making businesses of all sizes vulnerable. Small to medium enterprises are particularly at risk, as many lack adequate cybersecurity resources

AI, while leveraged by attackers, also offers a robust countermeasure for defenders. It enables organizations to automate detection, flag anomalies in administrative activities, and track malware proliferation through advanced techniques like hash-based monitoring. Generative AI tools, such as copilots, can guide IT teams in assessing vulnerabilities, crafting recovery strategies, and implementing tailored protection policies. These innovations reduce manual errors and enhance rapid response to ransomware incidents

Ransomware tactics are evolving, with a growing focus on data theft over traditional encryption methods. Stolen intellectual property, financial records, or customer data provides leverage in negotiations and inflicts lasting reputational damage on victims. Furthermore, attackers are exploiting dual-use tools like remote access software and file-sharing utilities, which blend into legitimate activity. Detecting such misuse requires behavioral analysis and proactive exposure management rather than traditional signature-based defenses

To mitigate these threats, businesses must adopt comprehensive cyber resilience strategies. These include maintaining a 3-2-1 backup model, integrating AI capabilities for automated responses, and regularly rehearsing recovery plans. Such preparation ensures faster containment and recovery, ultimately reducing the operational and financial impact of ransomware incidents

For further details, access the article here

How CISOs Can Drive the Adoption of Responsible AI Practices

The CISO’s Guide to Securing Artificial Intelligence

AI in Cyber Insurance: Risk Assessments and Coverage Decisions

Hackers will use machine learning to launch attacks

To fight AI-generated malware, focus on cybersecurity fundamentals

4 ways AI is transforming audit, risk and compliance

AI security bubble already springing leaks

Could APIs be the undoing of AI?

The Rise of AI Bots: Understanding Their Impact on Internet Security

The Little Book on Big Cyber Crime

Comprehensive vCISO Services

Tags: AI based tools

ISO 27001: Building a Culture of Security and Continuous Improvement

Nov 30 2024

10 key benefits of ISO 27001 Cert for SMBs

Category: ISO 27k — disc7 @ 9:19 am

Here are 10 key benefits of ISO 27001 certification for small and medium-sized businesses (SMBs)

Enhanced Data Security: Protect sensitive information against breaches, reducing the risk of financial loss or reputational damage.
Customer Trust: Demonstrate a commitment to safeguarding client data, boosting customer confidence and loyalty.
Regulatory Compliance: Meet legal and regulatory requirements (e.g., GDPR, HIPAA), avoiding penalties and ensuring smooth operations.
Competitive Advantage: Stand out in the marketplace by showcasing internationally recognized security standards.
Improved Risk Management: Identify and mitigate risks proactively with structured risk assessments and controls.
Operational Efficiency: Streamline security processes and eliminate redundancies, reducing inefficiencies and costs.
Scalability: Adapt security measures to grow alongside your business, ensuring protection as operations expand.
Incident Response: Prepare robust plans to detect, respond to, and recover from incidents quickly, minimizing downtime.
Employee Awareness: Cultivate a security-conscious workforce through regular training and awareness programs.
Partnership Opportunities: Meet vendor and partner requirements for security certifications, enabling new collaborations and business growth.

Overcoming Challenges

Resistance to Change: Highlight benefits to gain employee buy-in.
Resource Constraints: Use a phased approach to certification.
Integration Complexity: Leverage common principles with other frameworks like ISO 9001 for seamless integration.

The Way Forward
ISO 27001 isn’t just about protecting data—it’s about building trust, improving operations, and achieving competitive advantage. Start embedding its principles today for a stronger, more secure organization.

Being certified with ISO 27001 can bring numerous advantages for medium to enterprise level organizations:

Minimizes the risk of cyber-attacks on your company.
Facilitates the demonstration of compliance with various regulations and standards.
Lowers operational expenses by implementing only necessary controls.
Prevents damage to reputation and financial penalties.
Enhances customer retention through a compelling security narrative.
Attracts new business opportunities by confidently addressing security concerns.
Streamlines the process of completing security questionnaires, freeing up valuable time.
Cultivates a stronger security culture and awareness within the organization.
Reduces Cyber Liability Premiums by potentially over 200%

Penetration Testing and ISO 27001 – Securing ISMS

Secure Your Digital Transformation with ISO 27001

Significance of ISO 27017 and ISO 27018 for Cloud Services

The Risk Assessment Process and the tool that supports it

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

Penetration Testing and ISO 27001 – Securing ISMS

Tags: isms, iso 27001 certification, SMB

Comments (8)

Nov 29 2024

ISO 27001: Building a Culture of Security and Continuous Improvement

Category: Information Security,ISO 27k — disc7 @ 9:19 am

ISO 27001: Building a Culture of Security and Continuous Improvement

More Than Compliance
ISO 27001 is not just a certification; it’s a framework that embeds security into the core of your organization, fostering trust, efficiency, and resilience.

Security as a Journey
ISO 27001 promotes a proactive, continuous approach to security, adapting to ever-evolving cyber threats and embedding security as a company-wide mindset.

Key Practices for Continuous Improvement

Regular Risk Assessments: Periodically evaluate vulnerabilities and prioritize mitigation measures to stay ahead of potential threats.
Employee Engagement: Train employees to actively participate in protecting information and identifying risks early.
Performance Monitoring: Use metrics, audits, and reviews to refine and align security measures with business goals.
Incident Learning: Develop robust response plans, analyze incidents, and strengthen systems to prevent future issues.

Why a Security Culture Matters
A strong security culture builds trust, fosters innovation, and enables safe adoption of technologies like cloud computing and remote work, giving organizations a competitive edge.

Practical Steps to Embed Security

Set Clear Objectives: Align ISO 27001 goals with business priorities like risk reduction and client trust.
Engage Leadership: Secure top management’s active participation to drive initiatives.
Integrate Security: Make security a shared responsibility across all departments.
Focus on Risks: Prioritize and allocate resources effectively based on risk impact.
Encourage Communication: Foster open discussions about security concerns and solutions.
Scale with Growth: Adjust security practices as your organization evolves.

Overcoming Challenges

Resistance to Change: Highlight benefits to gain employee buy-in.
Resource Constraints: Use a phased approach to certification.
Integration Complexity: Leverage common principles with other frameworks like ISO 9001 for seamless integration.

Secure Your Digital Transformation with ISO 27001

Significance of ISO 27017 and ISO 27018 for Cloud Services

The Risk Assessment Process and the tool that supports it

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

Open Source Intelligence Methods and Tools: A Practical Guide to Online Intelligence

Tags: iso 27001, security culture

Comments (5)

Nov 28 2024

5 cybersecurity open-source tools

Category: Open Source — disc7 @ 7:53 am

1. MISP (Malware Information Sharing Platform & Threat Sharing)

Purpose: Designed to facilitate sharing threat intelligence between organizations, MISP is invaluable for building a collaborative defense strategy against cyber threats.
Key Features:
- Collects, stores, and shares indicators of compromise (IOCs) efficiently.
- Supports STIX/TAXII for standardized threat intelligence sharing.
- Offers real-time alerts, advanced tagging, and classification of incidents.
Use Case: Organizations use MISP to streamline incident response and threat intelligence management, making it a cornerstone of cybersecurity strategies.
Learn More: MISP Project

2. OSForensics

Purpose: A digital forensics tool enabling investigators to uncover critical evidence from digital devices.
Key Features:
- Recovers deleted files, emails, and passwords from devices.
- Tracks USB interactions and recently accessed websites.
- Supports memory forensics with tools like Volatility Workbench.
- Generates detailed forensic reports.
Use Case: Widely used in legal investigations, incident response, and by forensic professionals to analyze compromised systems.
Learn More: OSForensics

3. ELK Stack (Elasticsearch, Logstash, Kibana)

Purpose: A highly adaptable SIEM solution for monitoring, detecting, and analyzing security threats.
Key Features:
- Elasticsearch indexes and searches log data.
- Logstash processes and enriches the log data from multiple sources.
- Kibana visualizes security metrics and logs with interactive dashboards.
- Provides seamless scaling for growing datasets and integration with third-party tools.
Use Case: Ideal for enterprises needing real-time log analysis and monitoring to proactively address threats.
Learn More: Elastic.co

4. AlienVault OSSIM

Purpose: Combines open-source tools into a cohesive SIEM platform for comprehensive security monitoring.
Key Features:
- Asset discovery and vulnerability assessment.
- Intrusion detection (IDS/HIDS) and behavioral anomaly detection.
- Incident response with robust reporting tools.
Use Case: Suitable for small to medium businesses looking for affordable yet powerful threat detection capabilities.
Learn More: AlienVault OSSIM

5. FreeIPA

Purpose: An IAM tool tailored for centralized authentication, authorization, and account management in Linux/UNIX environments.
Key Features:
- Built-in SSO via Kerberos.
- Integration with DNS and certificate management.
- Offers both CLI and GUI options for flexibility.
Use Case: Enterprises needing streamlined IAM solutions for securing access across Linux-based systems.
Learn More: FreeIPA

Here are some implementation tips for the highlighted tools:

1. MISP

Initial Setup:
- Deploy MISP on a Linux server (CentOS, Ubuntu, or Debian). Prebuilt virtual machines are also available.
- Use Docker containers for easier installation and maintenance.
- Configure database settings and enable HTTPS for secure communication.
Best Practices:
- Regularly update the taxonomy and tags for organizing IOCs.
- Leverage the API to integrate MISP with SIEMs or ticketing systems.
- Use its sharing groups feature to limit access to sensitive threat intelligence.
Resources:
- Official installation guide: MISP Documentation.

2. OSForensics

Deployment:
- Install on a forensic workstation or USB stick for portable use.
- Combine with additional forensic tools like FTK or EnCase for broader capabilities.
Tips:
- Use OSFClone to create disk images for analysis without modifying evidence.
- Regularly train staff on the Volatility Workbench module for memory forensics.
- Automate reporting templates for quicker investigations.
Resources:
- Tutorial and guides: OSForensics Help.

3. ELK Stack

Installation:
- Set up Elasticsearch, Logstash, and Kibana on Linux. Docker and Helm charts for Kubernetes simplify deployment.
- Use Filebeat to collect logs from endpoints and forward them to Logstash.
Optimization:
- Configure indices carefully to handle high-volume logs.
- Implement role-based access control (RBAC) for Kibana to secure dashboards.
- Enable alerts and anomaly detection using Kibana’s machine learning features.
Resources:
- Elastic’s official guide: ELK Documentation.

4. AlienVault OSSIM

Setup:
- Install on-premises or use its hosted version. The installation ISO is available on its website.
- Configure plugins for data collection from firewalls, IDS/IPS, and endpoint devices.
Usage Tips:
- Regularly update correlation rules for detecting modern threats.
- Use its vulnerability scanner to complement other risk assessment tools.
- Train analysts to leverage its HIDS/IDS for actionable insights.
Resources:
- OSSIM setup and usage: AT&T AlienVault Documentation.

5. FreeIPA

Installation:
- Deploy FreeIPA on a Linux-based system. Red Hat-based distributions offer built-in packages.
- Integrate with Active Directory for hybrid environments.
Best Practices:
- Configure Kerberos for single sign-on and enable password policies.
- Regularly monitor and audit access logs using built-in features.
- Secure FreeIPA with SELinux and periodic updates.
Resources:
- FreeIPA admin guide: FreeIPA Documentation.

Checkout previous posts on Open Source here

Tags: open source tools

Practical Threat Intelligence and Data-Driven Threat Hunting: A hands-on guide to threat hunting with the ATT&CK(TM) Framework and open source tools

Nov 27 2024

Why Security Leaders Should Prioritize the MITRE ATT&CK Evaluation

Category: Attack Matrix,Information Security — disc7 @ 10:19 am

The article emphasizes the importance of the MITRE Engenuity ATT&CK Evaluations for security leaders in navigating the complex cybersecurity landscape. These evaluations simulate real-world threats to test how vendors’ solutions detect, respond to, and report adversary tactics, techniques, and procedures (TTPs). The evaluations leverage the globally recognized MITRE ATT&CK framework, which categorizes TTPs into a structured model, helping organizations assess and address security gaps effectively.

Key factors that set MITRE ATT&CK Evaluations apart include their focus on real-world conditions, transparent results, and alignment with the ATT&CK framework. Unlike traditional assessments, these evaluations emulate attack scenarios, enabling vendors to demonstrate their capabilities under realistic conditions. The transparency of the results allows organizations to evaluate performance metrics directly, helping security leaders choose solutions tailored to their unique threat environments.

The 2023 MITRE ATT&CK Evaluation highlighted notable advancements, with Cynet achieving 100% visibility and analytic coverage without configuration changes—a first in the evaluation’s history. For 2024, MITRE plans to introduce more targeted evaluations, testing vendor solutions against adaptable ransomware-as-a-service variants and North Korean state-sponsored tactics, expanding coverage to Linux, Windows, and macOS platforms.

Cybersecurity leaders are encouraged to closely monitor the upcoming results, which will offer valuable insights into the strengths and weaknesses of vendor solutions. By leveraging these findings, organizations can refine their defenses, mitigate risks, and strengthen resilience against evolving threats. The Cynet-hosted webinar provides an opportunity to understand and act on these evaluations, making them a critical resource for informed decision-making.

For further details, access the full article here

Previous articles on Mitre Att&ck Framework

Tags: CISO, MITRE ATT&CK Evaluation, Security Leaders

Penetration Testing : Step-By-Step Guide

Nov 27 2024

Penetration Testing and ISO 27001 – Securing ISMS

Category: ISO 27k,Pen Test — disc7 @ 9:06 am

The document highlights the integration of penetration testing within ISO 27001’s framework, emphasizing its critical role in identifying system vulnerabilities and maintaining security posture. It links pen testing to the standard’s risk management and continuous improvement principles, focusing on Annex A controls, such as Operations Security and Compliance.

It details the importance of scoping, balancing business needs with potential risks. The guide underscores embedding pen testing into broader risk assessment efforts to enhance resilience.

How does penetration testing fit into my ISO 27001 ISMS project?

There are three stages in your ISMS project when penetration testing can make a
significant contribution:

As part of the risk assessment process, to uncover vulnerabilities in any
Internet-facing IP addresses, web applications or internal devices and
applications, and link them to identifiable threats.
As part of the risk treatment plan, to ensure that security controls work
as designed.
As part of the ongoing performance evaluation and improvement
processes, to ensure that controls continue to work as required and that
new and emerging vulnerabilities are identified and dealt with.

ISO 27001 says that you must identify information security risks within the scope of
the ISMS (Clause 6.1.2.c). This involves identifying all assets and information systems
within scope of the ISMS, and then identifying the risks and vulnerabilities those
assets and systems are subject to.

A penetration test can help identify these risks and vulnerabilities. The results will
highlight detected issues and guide remedial action, and are a key input for your risk
assessment and treatment process. Once you understand the threats you face, you
can make an informed decision when selecting controls.

For further details, access the full document here.

Secure Your Digital Transformation with ISO 27001

Significance of ISO 27017 and ISO 27018 for Cloud Services

The Risk Assessment Process and the tool that supports it

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

Significance of ISO 27017 and ISO 27018 for Cloud Services

Tags: isms, iso 27001, Penetration Testing

Comments (4)

Nov 26 2024

Secure Your Digital Transformation with ISO 27001

Category: Cloud computing,ISO 27k — disc7 @ 10:25 am

Secure Your Digital Transformation in Cloud with ISO 27001

In today’s fast-paced digital transformation era, cloud computing drives innovation, scalability, and global competitiveness. But with these opportunities come critical responsibilities—especially in protecting sensitive data.

Enter ISO 27001: the globally recognized standard for information security management. For organizations adopting cloud solutions, ISO 27001 provides a structured roadmap to safeguard data, build trust, and ensure compliance.

Why ISO 27001 is Essential in the Cloud Era

While cloud computing offers flexibility, it also introduces risks. ISO 27001 addresses these challenges by:

Adopting a Risk-Based Approach: Identifying and mitigating cloud-specific risks like breaches and misconfigurations. ISO 27001 Risk Management
Establishing Clear Policies: Developing tailored security controls for cloud environments.
Enhancing Vendor Management: Ensuring third-party agreements align with security objectives.
Strengthening Incident Response: Promoting readiness for potential cloud threats or breaches.

ISO 27001 + Digital Transformation = Success

When integrated into your digital strategy, ISO 27001 helps you:

Build Trust: Demonstrate commitment to security to customers, partners, and regulators.
Simplify Compliance: Align with GDPR, HIPAA, and other regulations.
Enable Secure Scalability: Grow your operations without compromising security or agility.

Elevate Your Cloud Security Strategy

Embracing ISO 27001 ensures you not only mitigate cloud risks but also gain a competitive edge. Certification showcases your dedication to safeguarding client data, fostering trust and long-term partnerships.

How secure is your cloud strategy? Let’s discuss how ISO 27001 can help you enhance your security while accelerating your digital transformation goals.

In the 2022 update, ISO 27001 introduces specific Cloud controls (Annex A, clause 5.23 – the control that specifies the processes for acquiring, using, managing, and exiting cloud services), highlighting key areas where organizations can tighten security:

Defining security requirements using the CIA Triad
Establishing supplier selection criteria based on your risk profile and needs
Assigning and tracking roles and responsibilities (Governance) for Cloud security
Ensuring data protection and privacy throughout operations
Implementing procurement lifecycle policies for Cloud services, from acquisition to termination

Given today’s reliance on Cloud services—and the risks posed by issues like faulty vendor updates—it’s critical to go deeper into Cloud security controls.

ANNEX A CLAUSE 8.26 APPLICATION SECURITY REQUIREMENTS

The Risk Assessment Process and the tool that supports it

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

Information Security Risk Management for ISO 27001/ISO 27002

Tags: Digital Transformation, Securing Cloud Services

Comments (5)

Nov 25 2024

Adding Value with Adding Value with Risk-Based Information Security

Category: ISO 27k,NIST CSF,Risk Assessment,Security Risk Assessment — disc7 @ 8:27 am

The article emphasizes the importance of integrating risk management and information security management systems (ISMS) for effective IT security. It recommends a risk-based approach, leveraging frameworks like ISO/IEC 27001 and NIST Cybersecurity Framework (CSF) 2.0, to guide decisions that counteract risks while aligning with business objectives. Combining these methodologies enhances control accuracy and ensures that organizational assets critical to business goals are appropriately classified and protected.

An enterprise risk management system (ERMS) bridges IT operations and business processes by defining the business value of organizational assets. This alignment enables ISMS to identify and safeguard IT assets vital to achieving organizational objectives. Developing a registry of assets through ERMS avoids redundancies and ensures ISMS efforts are business-driven, not purely technological.

The NIST CSF 2.0 introduces a “govern” function, improving governance, priority-setting, and alignment with security objectives. It integrates with frameworks like ISO 27001 using a maturity model to evaluate controls’ effectiveness and compliance. This approach ensures clarity, reduces redundancies, and provides actionable insights into improving cybersecurity risk profiles and resilience across the supply chain.

Operationally, integrating frameworks involves a centralized tool for managing controls, aligning them with risk treatment plans (RTP), and avoiding overlaps. By sharing metrics across frameworks and using maturity models, organizations can efficiently evaluate security measures and align with business goals. The article underscores the value of combining ISO 27001’s holistic ISMS with NIST CSF’s risk-focused profile to foster continual improvement in an evolving digital ecosystem.

For example, let’s consider an elementary task such as updating the risk policy. This is part of control 5.1 of ISO27001 on information security policies. It is part of the subcategory GV.PO-01 of the NIST CSF on policies for managing cybersecurity risks, but it is also present in the RTP with regard to the generic risk of failure to update company policies. The elementary control tasks are evaluated individually. Then, the results of multiple similar tasks are aggregated to obtain a control of one of the various standards, frameworks or plans that we are considering.

Best method for evaluating the effectiveness of control activities may be to adopt the Capability Maturity Model Integration (CMMI). It is a simple model for finding the level of maturity of implementation of an action with respect to the objectives set for that action. Furthermore, it is sufficiently generic to be adaptable to all evaluation environments and is perfectly linked with gap analysis. The latter is precisely the technique suitable for our evaluations – that is, by measuring the current state of maturity of implementation of the control and comparing it with the pre-established level of effectiveness, we are able to determine how much still needs to be done.

In short, the advantage of evaluating control tasks instead of the controls proposed by the frameworks is twofold.

The first advantage is in the very nature of the control task that corresponds to a concrete action, required by some business process, and therefore well identified in terms of role and responsibility. In other words, something is used that the company has built for its own needs and therefore knows well. This is an indicator of quality in the evaluation.
The second advantage is in the method of treatment of the various frameworks. Instead of building specific controls with new costs to be sustained for their management, it is preferable to identify each control of the framework for which control tasks are relevant and automatically aggregate the relative evaluations. The only burden is to define the relationship between the companys control tasks and the controls of the chosen framework, but just once.

More details and considerations on pros and cons are described in recent ISACA Journal article, “Adding Value With Risk-Based Information Security.”

Source: National Institute of Standards and Technology, The NIST Cybersecurity Framework (CSF) 2.0, USA, 2024, https://www.nist.gov/informative-references

Information Security Risk Assessment Workshop

Tags: Risk-Based Information Security

Comments (1)

Nov 22 2024

Explore the new Atomic Red Team website

Category: Attack Matrix,Information Security — disc7 @ 11:35 am

The redesigned Atomic Red Team website features a new browser interface, improved search capabilities, and easier test execution

Red Canary’s Atomic Red Team is an open-source framework designed to help security teams test their detection capabilities against adversary tactics defined in the MITRE ATT&CK framework. It provides small, portable tests, enabling organizations to simulate specific attacker techniques in a controlled environment. This framework empowers defenders to validate their security controls, identify gaps in detection, and better understand malicious behaviors. Atomic Red Team offers a highly flexible approach, supporting manual execution via command-line scripts or automated tools like Invoke-Atomic, a PowerShell module that simplifies running tests

The platform focuses on making security testing accessible to teams of all sizes by offering easy-to-follow documentation and a community-driven approach. Tests are mapped to MITRE ATT&CK tactics, allowing users to tailor simulations to their environment while ensuring compliance with security protocols. By leveraging these tests, organizations can proactively enhance their detection capabilities, address visibility gaps, and prepare for real-world threats effectively

The new site provides several long-requested feature additions such as an easier method to execute the sometimes complex command lines in your environment, more detailed searching and filtering capabilities, and a generally more streamlined interface. This convenient interface ensures that even a casual user can learn about and launch tests in their own environment to help improve their security posture.

Previous posts on Att&ck Matrix

3 ISO 27001:2022 Controls That Help Secure Your Cloud Services

Nov 22 2024

Significance of ISO 27017 and ISO 27018 for Cloud Services

Category: Cloud computing — disc7 @ 9:26 am

ISO 27017 and ISO 27018 are critical standards for enhancing information security, specifically in cloud environments.

ISO 27017: This standard provides guidelines for information security controls in cloud services. It extends the general ISO 27001 framework to address cloud-specific risks, such as shared resources, multi-tenancy, and data location. It offers recommendations for both cloud service providers (CSPs) and customers to ensure the security of cloud infrastructure, operations, and data. Key areas include responsibilities of CSPs, customer monitoring, and cloud-specific risk management.
ISO 27018: This standard focuses on protecting Personally Identifiable Information (PII) in cloud computing environments. It ensures CSPs comply with privacy laws and practices by offering controls specifically tailored for PII processing. These include requirements for data access, consent management, incident notification, and restricting data usage for marketing without explicit approval. It promotes trust by addressing privacy in a structured and transparent way.

Together, these standards build confidence in cloud adoption by mitigating risks associated with data security and privacy in shared digital ecosystems. They are particularly valuable for organizations handling sensitive data, such as financial institutions and healthcare providers.

Cloud Security Toolkit – ISO 27017 & ISO 27018

Cloud Security Toolkit – Start the journey to ISO 27017 and ISO 27018 compliance for Cloud services security with customizable templates, documents, policies and records.
Designed to integrate with our ISO 27001 DocumentKits toolkit to ensure you have complete control over the security of your Cloud services.
Get professional guidance and become an expert in securing your Cloud services, putting you fully in control of managing your information security.
Guarantee full coverage of ISO 27017 and ISO 27018 with comprehensive documentation covering topics including backup and restoration, compliance checking, information security planning and risk assessments.
Reduce your implementation costs and time spent generating your documentation.
Get compliant and stay compliant with more than 500 free annual updates.
Benefit from using the world’s only fully Cloud-based toolkit platform, making collaboration and accessibility easier than ever.
This is an annual subscription product, however, you can cancel at any time. (T&Cs apply)

Previous posts on cloud computing

Tags: cloud services, CSP, iso 27017, ISO 27018

Comments (6)

Nov 22 2024

Researchers crack RSA and AES data encryption

Category: cyber security,Data encryption,Information Security — disc7 @ 7:19 am

For the first time ever researchers crack RSA and AES data encryption

Chinese scientists reveal D-Wave’s quantum computers can break RSA encryption, signaling an urgent need for new cryptography solutions.

A group of Chinese researchers has successfully cracked RSA and AES encryption using D-Wave quantum computers. This breakthrough marks the first time such widely used encryption methods have been defeated. RSA, used in digital security protocols like HTTPS, relies on the difficulty of factoring large prime numbers. AES, on the other hand, protects sensitive data by converting it into unintelligible code. Both encryption methods are foundational to modern cybersecurity and global data protection systems.

The researchers employed a combination of advanced quantum computing and innovative algorithms to break the encryption. Quantum computers, unlike classical systems, process information using quantum bits (qubits), enabling parallel computations at an unprecedented scale. This capability makes them uniquely suited to solving problems like factoring large numbers or solving complex mathematical challenges—processes essential for breaking RSA and AES.

This achievement signals an urgent need for post-quantum cryptography, which can withstand quantum attacks. Governments and technology organizations worldwide are now accelerating the development of cryptographic systems designed for this new era. This breakthrough emphasizes the importance of adopting quantum-resistant encryption to ensure long-term security for sensitive information in areas like banking, healthcare, and national defense.

The implications of this research extend beyond encryption. Quantum computing’s power could revolutionize fields such as medicine, artificial intelligence, and materials science. However, it also presents significant challenges to current cybersecurity practices. Researchers and policymakers must urgently address these dualities to harness quantum computing’s potential while mitigating its risks.

You can access the details here

The value of quantum-resistant cryptography, post-quantum cryptography, and decentralized technologies just skyrocketed.

The research team’s experiments focused on leveraging D-Wave’s quantum technology to solve cryptographic problems. (CREDIT: DWave)

Inside Cyber: How AI, 5G, IoT, and Quantum Computing Will Transform Privacy and Our Security

Advancing Cyber Security Through Quantum Cryptography

Tags: PQC, QuantumComputing, Web3

Nov 21 2024

How to Create a Strong Security Culture

Category: Security Awareness — disc7 @ 12:45 pm

Building a robust cybersecurity culture within the workplace requires a comprehensive approach that integrates technical measures, employee training, and leadership commitment. Organizations must prioritize educating their workforce on cybersecurity risks and best practices, emphasizing their role in safeguarding sensitive data. Practical measures include implementing regular staff awareness training and fostering a proactive attitude toward identifying and reporting threats

A successful cybersecurity culture hinges on leadership involvement. Executives should model the importance of cybersecurity by prioritizing it in organizational strategies and communications. This leadership sets the tone for employees, demonstrating that security is not just an IT issue but a company-wide priority. Encouraging cross-departmental collaboration helps embed cybersecurity in every aspect of the business

Technology and policy also play vital roles. Organizations should maintain updated cybersecurity policies tailored to their specific risks, covering areas like secure password practices, remote access controls, and patch management. Regular reviews of these policies ensure they evolve with emerging threats and business changes, reinforcing their relevance and effectiveness

Lastly, fostering a culture of accountability and openness is critical. Employees should feel encouraged to report mistakes or incidents without fear of blame, as honest communication allows for quick and effective responses. Investing in ongoing training, including simulated phishing exercises, can reinforce vigilance and adaptability against evolving threats

For more details on the topic here

But to ensure that all staff truly take note of security and apply the knowledge gained from any staff awareness training, security should be embedded in your organization’s culture.

“As cyber security leaders, we have to create our message of influence because security is a culture and you need the business to take place and be part of that security culture.”

– Britney Hommertzheim

Build a security culture

Previous security awareness posts

Tags: security culture

The Risk Assessment Process and the tool that supports it

Nov 20 2024

3 ISO 27001:2022 Controls That Help Secure Your Cloud Services

Category: Cloud computing,Information Security,ISO 27k — disc7 @ 12:52 pm

The article highlights three critical controls from ISO 27001:2022 to enhance cloud security, providing organizations with guidance on how to protect sensitive data stored in the cloud effectively:

Contractual Assurance: Control 5.10 emphasizes acceptable use and handling of information, particularly third-party assets like cloud services. It stresses the importance of establishing contractual agreements with cloud providers to ensure data security. Organizations should verify providers’ compliance with standards like ISO 27001 or other independent certifications, check for business continuity guarantees, and ensure compliance with regulations like GDPR or PCI DSS where applicable.
Cloud-Specific Policies: Control 5.23 introduces the need for processes and policies tailored to cloud services. These should cover the acquisition, use, management, and exit strategies for cloud services. Organizations are advised to define security requirements and clarify roles, responsibilities, and controls between the organization and the provider. Policies should also include handling incidents and outlining exit procedures to maintain security throughout the service lifecycle.
Extending ISMS: While ISO 27001:2022 offers foundational controls, organizations can enhance their information security management system by adopting supplementary standards like ISO 27017 (focused on cloud-specific controls) and ISO 27018 (privacy in cloud services). However, these extensions currently align with the older ISO 27001:2013 Annex A, necessitating careful integration with updated frameworks.

These controls underscore the importance of robust policies, contractual due diligence, and clear delineation of responsibilities to secure cloud environments effectively. More details can be found here.

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k

ISO 27001 Standard, Risk Assessment and Gap Assessment

The Risk Assessment Process and the tool that supports it

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot

Tags: cloud services, ISO 27001 2022

Comments (1)

Nov 19 2024

Choosing the Right ISO 27001 Certification Body

Category: ISO 27k — disc7 @ 3:45 pm

A Strategic Guide

This guide emphasizes the importance of choosing the right certification body for ISO 27001 certification. Key points include:

Why the Choice Matters:

Credibility: A recognized certification body adds legitimacy.
Expertise: Industry-specific knowledge ensures relevant audits.
Global Recognition: Important for organizations with international reach.
Rigorous Audits: Ensures compliance and resilience.

Factors to Consider:

Accreditation: Look for reputable accreditations (e.g., ANAB, UKAS, IAF).
Industry Expertise: Ensure familiarity with your sector’s needs.
Global Reach: Necessary for multinational operations.
Reputation: Verify through reviews and recommendations.
Cost vs. Quality: Prioritize quality to avoid re-certification issues.

Recommended Certification Bodies:

TÜV SÜD
Bureau Veritas
DNV GL
BSI
UL

Practical Tips:

Request multiple proposals for comparison.
Interview representatives to gauge fit.
Check references and past client experiences.
Align the choice with your business needs.

The guide stresses that selecting the right body ensures long-term success and strengthens your ISMS’s value. You can access the full guide here

Selecting the right certification body for ISO 27001 can turn your certification into a strategic advantage, enhancing your security framework and boosting your brand’s reputation. A thoughtful decision ensures long-term success and resilience.

Feel free to contact us to explore ISO 27001 strategies tailored to your organization’s needs!

What will the certification auditor ask regarding risk assessment and treatment?

During the audit, an auditor might ask for the following evidence regarding ISO 27001 clause 6.1 Actions to address risks and opportunities:
1. The risk assessment methodology.
2. The report about the performed risk assessment and treatment, together with the list of all the risks.
3. If each risk has impact, likelihood, level of risk, and risk owner listed, and whether it is considered acceptable.
4. If each unacceptable risk has been treated with at least one option; if the option is decreasing the risk, then the risk needs to have appropriate controls selected.
5. If the selected controls are marked as applicable in the Statement of Applicability.
6. If you have planned the implementation of your controls through the Risk Treatment Plan.
7. If the risk owners have accepted the Risk Treatment Plan and the residual risks.

What is the significance of ISO 27001 certification for your business?

ISO/IEC 27001:2022 – Mastering Risk Assessment and the Statement of Applicability

Risk Register Templates: Asset and risk register template system for cybersecurity and information security management suitable for ISO 27001 and NIST

ISO 27001 implementation ISO 27002 ISO 27701 ISO 27017 ISO27k