Just complete a DFIR investigation engagement. Instead of repeatedly sharing the ransomware actors’ TTP, I want to point out quite some first responders on how they handle the artifact collection may jeopardize the whole investigation. #BattlefieldDFIR #ShutdowntheEdgeDevice #MissingLog #CherryPickRootCause #NoSiteVisitbutRemote #SeeingPretendNotSeeing #BlametheMalware #BlameNoMFA #BlameNoPatch #BlameNoPentesting #BlameOutdatedProduct …

21

Guide:  The Ultimate Pentest Checklist for Full-Stack Security: Pentest Checklists Are More Important Than Ever Given the expanding attack surface coupled with the increasing sophistication of attacker tactics and techniques, penetration testing checklists have become essential for ensuring thorough assessments across an organization’s attack surface, both internal and external. By providing a structured approach, these checklists help testers systematically https://lnkd.in/g82Hn-nU

1

The Intelligence Cycle in an OSINT Context Hey everyone! If you're diving into the world of Open Source Intelligence (OSINT), you need to get a grip on the intelligence cycle. This is the backbone of any effective OSINT operation, ensuring that your intelligence gathering is structured, efficient, and actionable. Let's break it down in a way that's easy to digest: Direction First things first, you need a game plan. What are your goals? What do you need to find out? Whether it's tracking trends, identifying threats, or supporting business decisions, setting clear objectives is key. Think of this as your roadmap. Consider your OPSEC measures and make an Intelligence Collection Plan ( DM me for a downloadable template!) Collection Now it's time to gather your data. This is where the "open source" part comes in. Scour the web, social media, news sites, public records, and other accessible sources. Use tools and techniques to automate and streamline this process, but always keep your eyes peeled for those golden nuggets of info. Processing You’ve got a heap of data – great! But raw data is just noise without processing. Clean it up, organize it, and convert it into a usable format. This step is all about making sense of the chaos so you can move on to the good stuff. Analysis Here’s where your true skills get to shine. Analyse the processed data to extract meaningful insights. Look for patterns, correlations, and anomalies. This is where raw data transforms into valuable intelligence that can inform decisions and actions Dissemination Your insights are only valuable if they reach the right people. Package your findings in a clear, concise, and actionable format. Whether it’s a report, a presentation, or a dashboard, make sure your audience can easily understand and use the intelligence. You have to create a compelling story. Feedback The cycle doesn’t stop here. Get feedback on your intelligence products. Did they meet the objectives? What can be improved? This feedback loop is crucial for refining your processes and improving future OSINT efforts. And there you have it – the intelligence cycle in an OSINT context. It’s all about staying organized, methodical, and adaptable. Happy hunting! 🕵️‍♂️🌐 #OSINT #IntelligenceCycle #DataAnalysis #CyberSecurity #InformationGathering #LinkedInLearning #TechTips

62

8 Comments

The NIST Cybersecurity Framework 2.0. States that- Cybersecurity Risk Management is Part of Organizational Culture. Is Your Culture in Alignment with Your Cybersecurity Risk Management Program? Sign up for our FREE Beta today at https://lnkd.in/degjngmy The DVMS Cultural Assessment Tool (DVMS-CAT™) survey and resulting report explore the essence of that force, using the Johnson and Scholes culture web¹ as a lens to examine the complex tapestry woven within an organization. Just as a spider diligently constructs its web, thread by thread, culture also quietly binds organizational values, behaviors, and beliefs together. This intricate network, often invisible to the naked eye, exerts a powerful influence on every facet of the organization, from collaboration and innovation to decision-making and engagement. Our objective in creating the cybersecurity culture assessment tool was to unearth the implicit perceptions that guide interactions, the shared assumptions that inform choices, and the narratives that bind. The resulting data presents a nuanced picture of the cultural landscape, revealing both areas of undeniable strength and opportunities for strategic improvement. The survey should be conducted across multiple departments and management levels to illuminate this hidden web. The survey attempts to reveal and, therefore, understand the implicit rules that guide interactions, the shared assumptions that underpin choices, and the stories that bind the organization together. The results paint a portrait of the current cultural landscape, revealing both strengths and areas for growth.

8

Hackers Abuse EDRSilencer Tool to Bypass Security and Hide Malicious Activity: Threat actors are attempting to abuse the open-source EDRSilencer tool as part of efforts to tamper endpoint detection and response (EDR) solutions and hide malicious activity. Trend Micro said it detected "threat actors attempting to integrate EDRSilencer in their attacks, repurposing it as a means of evading detection." EDRSilencer, inspired by the NightHawk FireBlock tool from MDSec, is https://lnkd.in/gd4tP6bw

1

Vigilocity is closely tracking this. https://lnkd.in/gGWcmUis

23

Pegasus is adept at hiding itself, but like all spyware, it might display some common signs: Unusual sounds during calls — The spyware tries to intercept and listen to your calls. You might hear unusual sounds before picking up or during the call. Surprising battery drain — Spyware runs multiple processes in the background and is always in tracking mode. An unexplained drop in battery life might indicate the presence of spyware. Performance issues — Round-the-clock tracking consumes a lot of hardware resources. You might experience sluggish performance, even with basic actions like calling, texting, or web browsing. Unusual data usage — The spy tool needs an internet connection to send data to the server, which can increase overall data consumption. Even if you have unlimited data or Wi-Fi plans, it’s a good idea to track your usage and look for anything odd. Delayed notifications, calls, and messages — Multiple tracking elements, like a keylogger and screen recorder, try to capture every incoming call or message, which may result in delayed notification prompts. Less storage space — Tracking all phone activity takes a toll on phone storage. All the tracked data, including photos and recordings (video and audio), can reduce the available storage space on your phone. Unknown apps — Spyware can install other apps or packages that extend its tracking abilities. These apps won’t appear in the app drawer or on the home screen, but you can find them by checking the file directory. Uncommon screen behavior — The phone’s screen can exhibit weird behavior, like random app launches or shutdowns, even when you aren’t interacting with it.

3

"Data without Analytics is the Noise before the Breach" 4 million - A Job shortage, or the number of excuses not to transform your SOC... 2024 report from ICS2, states a 4 million job shortage in cybersecurity. How do they come to this conclusion? 1) Data Collection of surveys from 15,852 targeting cybersecurity practitioners, decision-makers globally 2) Workforce Estimation, a proprietary methodology to estimate the total number of people engaged in cybersecurity roles 3) Gap Analysis, comparing current, against demand for cybersecurity professionals, unfilled positions and growth in staffing needs.  Gap represents 𝗮𝗱𝗱𝗶𝘁𝗶𝗼𝗻𝗮𝗹 𝗽𝗲𝗼𝗽𝗹𝗲 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝗱 𝘁𝗼 𝗮𝗱𝗲𝗾𝘂𝗮𝘁𝗲𝗹𝘆 𝗽𝗿𝗼𝘁𝗲𝗰𝘁 𝗼𝗿𝗴𝗮𝗻𝗶𝘀𝗮𝘁𝗶𝗼𝗻𝘀 𝗱𝗶𝗴𝗶𝘁𝗮𝗹 𝗶𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 - - - - Three common obstacles from customers in their SOC 1) 𝘋𝘢𝘪𝘭𝘺 𝘨𝘳𝘰𝘸𝘵𝘩 𝘰𝘧 𝘈𝘭𝘦𝘳𝘵𝘴 𝘢𝘯𝘥 𝘍𝘢𝘭𝘴𝘦 𝘱𝘰𝘴𝘪𝘵𝘪𝘷𝘦𝘴 2) 𝘙𝘦𝘥𝘶𝘤𝘦𝘥 𝘝𝘪𝘴𝘪𝘣𝘪𝘭𝘪𝘵𝘺 (𝘤𝘰𝘮𝘱𝘳𝘰𝘮𝘪𝘴𝘦𝘴 𝘰𝘯 𝘵𝘰𝘰𝘭𝘴, 𝘭𝘰𝘨 𝘥𝘢𝘵𝘢 𝘷𝘰𝘭𝘶𝘮𝘦𝘴, 𝘵𝘰 𝘤𝘰𝘯𝘵𝘳𝘰𝘭 𝘤𝘰𝘴𝘵 𝘰𝘧 𝘥𝘢𝘵𝘢 𝘢𝘯𝘥 𝘰𝘱𝘦𝘳𝘢𝘵𝘪𝘰𝘯) 3) 𝘕𝘰𝘵 𝘦𝘯𝘰𝘶𝘨𝘩, 𝘵𝘪𝘮𝘦, 𝘱𝘦𝘰𝘱𝘭𝘦 𝘢𝘯𝘥 𝘮𝘰𝘯𝘦𝘺 𝘵𝘰 𝘢𝘥𝘥𝘳𝘦𝘴𝘴 1 + 2 - - - - If ICS2 estimation is correct, how do you move the band from the back of the Titanic? 1) Automation. Two most common time and soul-crushing of talented people's time are A) Artifact Enrichment, the act of collecting data from other tools, sources to begin an investigation of an Alert. B) De-duplication of alerts. Two straightforward use cases, which SOAR tools solve, unlocking your people from 85% of the tedious, repetitive work. So they can focus on what is most important, time to investigate, make and take decisive action. 2) Analytics. One action by a user on a website can trigger alerts from multiple tools deployed in the organisation. Endpoint, Web, Identity. You might have them collected in a single log destination, but they are still disconnected in nature, expansive in volume, costly in time and money. What if you applied Machine Learning, AI across all your enterprise, network, cloud, and endpoint data. Using Analytics, the idea of telling a story of the specific incident (not thousands of alerts that make up this incident) in a proper context for the SOC Team. Automation, Analytics. Shifting right from a "Defender under Duress" to a "Protector with Purpose". - - - - You have bought your people time. What can they do with time? 1) Continue to investigate automation use cases, driving out manual and repetitive tasks (even no Security ones which annoy them) 2) Test and Implement tighter security controls. Are you using ALL the capabilities in the security tools you invested in today? Fear not about increasing alerts. Your Automation and Analytics handle the grunt work for you Interesting work, improving security effectiveness, making retention of talent easier #analytics #automation #cybersecurity

4

4 Comments

What is the DFARS requirement for protecting controlled unclassified information and why does it matter? 🛡️ Our Compliance Consultant Victor Cich explains that DFARS 7012 (or DFARS 252.204-7012) mandates that contractors safeguard CUI. This requirement is based on NIST 800-171, Revision 2, which outlines 110 specific cybersecurity measures that contractors must implement to secure sensitive data. Is your organization aligned with these DFARS requirements? #DFARS #CUIProtection #CyberCompliance #DefenseContracting

3

Recent shifts within The NIST NVD operations have raised alarms among researchers and practitioners. ⚠️ These changes have led to delays in vulnerability analysis and a noticeable decline in enriching CVEs with critical data such as CPEs, CVSS scores, CWEs, and references. This creates significant hurdles for organizations striving to effectively identify and prioritize vulnerabilities. 💡 Meet DeviceTotal, a transformative solution reshaping this vulnerable pyramid. Our AI-powered technology propels vulnerability management into a new era, offering substantial enhancements in accuracy, speed, and automation. 🚀 DeviceTotal sources security information directly from vendors, ensuring data is updated well before it reaches the NVD. This proactive approach empowers organizations with timely insights, enabling swift and informed actions to mitigate threats. 💪 On top of that, DeviceTotal provides actionable insights for every threat, offering precise indications for available updates, mitigation options, workarounds, End-of-Life alerts, and more.  And the best part? No agents, no installations—just swift value delivered directly to your organization. Don't let your vulnerability management strategy crumble—elevate it with DeviceTotal. Experience the difference today. #VulnerabilityManagement #CyberSecurity #DeviceTotal #cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement #nationalsecurity (cartoon copyright by XKCD.com)

31

1 Comment