What are the top cyber trends to watch out for in 2019? Here’s what I have been hearing and reading:
First I present a new information security term: Virtual Security = Manufacturers claim that their products are secure. but in reality they are not.
New APT groups, and more regulations around data privacy, 2019 is set to be another big year in the cybersecurity space. Security is hard and getting harder in 2019. Good operational security is non trivial. Next generation dark markets are making cybercrime easier than ever before.
Gartner expects that the security market is expected to grow 8.7% in 2019 and hit $124 billion. Global spending on security products and services closed in 2018 in excess of $114 billion, marking a 12.4% increase from 2017.
A New Year’s Resolution: Security is Broken…Let’s Fix It. There are three strategies that show real promise for defending against tomorrow’s threats: Deploy Deception, Leverage Threat Intelligence, Think Proactively. Plan Now for Emerging Threats. Defending against these threats will require two things. The first is understanding the economic drivers of the criminal community, and the second is to adopt strategies and solutions that address and disrupt those drivers. Getting in front of the cyber-threat paradigm requires organizations to rethink their security strategies in 2019.
Many organizations have learned, it’s no longer a matter of if you’ll face a cyberattack, but when – and when they will finally find the hack has happened. For example it Marriott disclosed a four-year-long breach involving the personal and financial information of 500 million guests. Anytime we see such a colossal intrusion go undetected for so long, the ultimate cause is usually a failure to adopt the most important principle in cybersecurity defense that applies to both corporations and consumers: Assume you are compromised.
In today’s world, attackers intentionally look normal to evade automated defenses. With the rise of ransomware, fileless and non-malware attacks, it’s harder than ever to protect your endpoints with confidence. To prevent this, threat hunting has emerged as an essential process for organizations to preempt destructive attacks. This process is a proactive approach to cybersecurity that identifies gaps in defenses and stops attacks before they go too deep. The adversary is hunting for your security gaps…why aren’t you?
Is it fair to judge an organization’s information security posture simply by looking at its Internet-facing assets for weaknesses commonly sought after and exploited by attackers, such as outdated software or accidentally exposed data and devices? Attackers scan those systems for vulnerabilities actively in 2019. What’s remarkable is how many organizations don’t make an effort to view their public online assets as the rest of the world sees them — until it’s too late. Measure how good is your security. Data protection tools have been developed to measure the maturity of data protection issues in organization.
CEOs should ask the following questions about potential cybersecurity threats:
How could cybersecurity threats affect the different functions of my business, including areas such as supply chain, public relations, finance, and human resources?
What type of critical information could be lost (e.g., trade secrets, customer data, research, personally identifiable information)?
How can my business create long-term resiliency to minimize our cybersecurity risks?
What kind of cyber threat information sharing does my business participate in? With whom does my business exchange this information?
What type of information sharing practices could my business adopt that would help foster community among the different cybersecurity groups where my business is a member?
What can CEOs do to mitigate cybersecurity threats?
How Well Are You Protecting Your Brand from Digital Risk? Having a website is just the baseline for existing in digital world. Companies of all sizes are actively using social media to engage with customers and build loyalty for their brand. The Internet is an essential tool to grow your business, but it also poses digital risks to your brand reputation and integrity. Bad actors can spoof social media profiles of your company or brands. Cyber criminals will register and use web domains extremely similar to your actual domain names. Malicious apps that impersonate brands may use spyware to steal information from users. You might need to develop a brand protection program in 2019. Digital risk from brand exposure can lead to reputation damage, loss of intellectual property and customer trust and, ultimately, loss in revenue. This is what the brand managers need to think about in 2019. Successful hacking campaigns used to be all about keeping under the radar. But, for some, making a big splash is now now more important than lurking in the shadows.
Today, cybersecurity is moving beyond the financial impact to concerns over public safety, national security, and even cyberwarfare. The tech industry is becoming more worried about a cyberwar arms race. Microsoft boss thinks that cyber war cannot be won. High impact cyber attacks often affect the electricity network, water supply, financial markets, hospitals, and military families. Preparations for various cyber attacks in different sectors vary greatly. Energy and finance are the most advanced. We should all keep in mind two things: The proliferation of cyberweapons is already happening and arms control of cyberweapons hasn’t caught up. “Cyber is so wide that states alone cannot be sufficient in providing security” It seems also that authoritarian forces are trying to claw back control and even re-purposing the web in ways that undermine democracy.
It would be good for the company to be able to manage risks, prepare for major disruptions, and plan and practice recovery. Risk management requires the company to detect the attack itself. A large coordinated attack could attack our elections, our press, our telecommunications, our banks, and our military. According to a new report on digital freedom, authoritarian forces are clawing back control and even re-purposing the web in ways that undermine democracy. Tim Cook says that tech firms should prepare for ‘inevitable’ regulation.
We need to build cyber resilience to our networked systems. Getting to cyber resilience means federal agencies must think differently about how they build and implement their systems. “Cybersecurity, infrastructure security, is not a competitive advantage,” Bradford Willke, a top official in DHS’s Cybersecurity and Infrastructure Security Agency. If a good product or company fails because of a breach that could have been thwarted by sharing threat information, “there’s something that we’ve all lost.”
Did you remember to test the security? Every developer team should know how to code securely and how to test security. This kind of basic hygiene with information security creates the basis for genuinely intact applications. The basic thing for the tester in terms of data security is user identification and access, securing stability, encryption, firewalls, intruder detection, anonymization of information. All these things can be tested with different techniques, tools and methods. It is a good idea to ask a security professional if you do not know how to do this.
You will see many big data beaches also in 2019. Cybersecurity headlines in recent years have been dominated by companies losing money by being hacked and leaking the data of millions of customers. 2018 was again a banner year for breaches, check for example list of Biggest cyber security breaches 2018. In 2018 the mantra became “another day, another data breach.” 2018 has been the year par excellence for data protection, when data leaks, exfiltrations, and abuses have made headlines all over the world. Some companies have worked on improving their security, but overall there has not been so much activity going on that it would considerably change the situation for better in 2019. And against this backdrop of increased awareness about the challenges that working with sensitive data can entail, there is one regulation that has come to the fore: the GDPR (General Data Protection Regulation), which has been mandatory since May 25 this year.
How much are the first fines for GDPR infringement? It remains to be seen in 2019 as sanctions on big 2018 leaks start to appear. Infringement of GDPR regulation can incur fines of up to 4% of a company’s annual global turnover, or up to €20 million. The economic sanctions that we have seen so far in 2018 have clearly relatively conservative compared to the highest possible penalties, but with the recent spate of high profile data leaks – Marriott, British Airways, Quora – it won’t be long before harsher fines start to appear. Remember that by having appropriate protection for the personal data that your company manages, you can avoid sanctions.
IoT malware and email hacks are on the rise again. Blackmail demand claims will continue unfortunately also in 2019 and will become more innovative. In 2018 we first saw blackmail extortion with claims to have nailed you watching porn and the sender infected your computer by hacking your account or placing malware. All sorts of variants exist. There was also Spammed Bomb Threat Hoax that demands Bitcoin.Then there has been a New Extortion Email Threatens to Send a Hitman Unless You Pay $4,000 in bitcoin. As long as ransoms are paid and relatively easy attacks, such as phishing campaigns, are successful, bad actors will continue to use these techniques.
The number of attacks using IoT hardware is increasing in 2019. IoT is still insecure. As the number of IoT devices, such as smart home network monitoring systems, increase, the threat is constantly increasing. According to Nokia report IoT botnet operations accounted for 78 percent of malware detection events in the communications service provider (CSP) networks in 2018.
Many IoT protocols are still implemented without proper security. The CoAP protocol is the next big thing for DDoS attacks. Constrained Application Protocol (CoAP), is about to become one of the most abused protocols in terms of DDoS attack. That is because most of today’s CoAP implementations forgo using hardened security modes for a “NoSec” security mode that keeps the protocol light, but also vulnerable to DDoS abuse.
Mirai botnet has been active since 2016. And several followers to it are still active. Mirai malware has strong records of infecting poorly managing IoT devices and performing DDOS attacks on various platforms. And you will not get rid of the new variations of it in 2019. Latest example is With Mirai Comes Miori: IoT Botnet Delivered via ThinkPHP Remote Code Execution Exploit. Similarly Miori taking advantage of Internet connected device and compromise it by exploiting various vulnerabilities and also it constantly evolving to target the smart devices. Miori is just one of the many Mirai offshoots. There is another very similar variant called Shinoa.
Regulating cyber security features on networked devices seems to be on rise. Germany proposes router security guidelines. It would like to regulate what kind of routers are sold and installed across the country. California became the first state with an Internet of Things cybersecurity law: Starting on January 1st, 2020, any manufacturer of a device that connects “directly or indirectly” to the internet must equip it with “reasonable” security features, designed to prevent unauthorized access, modification, or information disclosure. If it can be accessed outside a local area network with a password, it needs to either come with a unique password for each device, or force users to set their own password the first time they connect. That means less generic default credentials for a hacker to guess. In Finland security label created by FICORA’s Cybersecurity Center promises that will make it easy for consumers to identify a sufficiently secure devices in 2019.
Ransomware attack will continue in 2019. Hospital cybersecurity seems to be a pressing problem in 2019. The healthcare industry’s accelerating adoption of sophisticated networks, connected devices and digital records has revolutionized clinical operations and patient care but has also left modern hospitals acutely vulnerable to cyber attack. Recent high-profile hacks have brought these mounting threats sharply into focus. One in four (27%) employees of healthcare organizations in North America admit to being aware of a ransomware attack targeting their employer over year 2018. There is a number of technological, cultural and regulatory issues that complicate healthcare cybersecurity.
DNS system is still full of “ugly hacks” that keep it running. Malicious actors have found innovative ways to take down the DNS and the landscape growing more problematical. Hopefully it will get robust in 2019. Vendors of DNS software, as well as large public DNS providers, are going to remove certain workarounds on February 1st, 2019, otherwise known as DNS Flag Day. Don’t Let DNS Flag Day Become Your DNS Doomsday. The result of this “line in the sand” means that all domains hosted on these poorly coded DNS servers will fail to resolve correctly across all the recursive resolvers built by and run by the consortium. So your SPF, DKIM, DMARC, most TXT and PTR records will fail. This will be a very bad day for anyone who doesn’t take time to address this issue BEFORE February 1st, 2019.
TLS 1.3 was published as of August 2018. It has been over eight years since the last major encryption protocol update. With the HTTP/2 protocol update in late 2015, and now TLS 1.3 in 2018, encrypted connections are now more secure and faster than ever. With OpenSSL 1.1.1 library many applications can gain many of the benefits of TLSv1.3 simply by dropping in the new OpenSSL version. Since TLSv1.3 works very differently to TLSv1.2 though there are a few caveats that may impact a minority of applications. Add this to list of existing TLS ecosystem woes. Malicious sites will increasingly use SSL certificates to look legitimate.
Remember to update your PHP version early in 2019. PHP 5.6 support and security updates have ended. PHP 5. is still widely used in many web services. FICORA’s Cybersecurity Center recommends giving up the use of old PHP versions, especially for services that are publicly available on the Internet. Currently the latest version is 7.3. Each version is actively developed for two years, after which security updates are offered for one year. Currently the latest PHP version is 7.3. Each version is actively developed for two years, after which security updates are offered for one year. Because the new PHP7 is not fully compatible with the old PHP5, so many sites need also updates to the site PHP code. If you can’t for some reason update PHP version, special attention should be paid to the security of the server and its environment.
Cloud security is still a problem for many organizations in 2019. The 2018 Cloud Security Spotlight Report noted that 84% of respondents claim traditional security solutions either don’t work at all or have limited functionality in the cloud. Misconfiguration of the cloud platform took the top spot in this year’s survey as the single biggest threat to cloud security (62%). Lack of staff resources and expertise to manage cloud security seems to be the largest barrier to cloud adoption for many companies. Many clouds are nowadays relatively secure, but Are You Using Them Securely? It’s time to stop obsessing over unsubstantiated cloud security worries and start focusing more on new approaches to cloud control. It is time to better manage your cloud deployments in 2019.
The Cybersecurity Industry Doesn’t Have Artificial Intelligence Right Yet. AI in security will be talked on in 2019. 2018 was The Year Machine Intelligence Arrived in Cybersecurity. “Intelligence” is a word heavily freighted in cybersecurity technology because it covers a wide variety of techniques and product: Expert systems, machine learning, deep learning, and artificial intelligence are all represented in the whole, with each being used and promoted by different vendors and service organizations. Antivirus protection is one of the tasks to which companies are applying intelligence. The vast majority of intelligence being used in security is “machine learning” rather than “artificial intelligence.” The application of artificial intelligence (AI) via the implementation of machine learning (ML) is the fastest growing area of cybersecurity, but it seems Artificial Intelligence in Cybersecurity is Not Delivering on its Promise at least yet. What has been largely missing from this assertion is independent verification that the theoretical benefits promoted by ML vendors translate to actual benefits in use. Also cyber-criminals start to use AI to make better attacks.
Machine learning can reduce the usefulness of CAPTCHA. Machine learning model breaks CAPTCHA systems on 33 highly visited websites very quickly.
Destructive malware has been employed by adversaries for years. Destructive targeted attacks have a critical impact on businesses, causing the loss of data or crippling business operations. NotPetya and Wannacry affected several companies around the world. OlympicDestroyer affected the Olympic Games organization.
Old destructive attacks can persist for a long time. Wannacry is not dead when 2019 starts. Eighteen months after the initial outbreak of the WannaCry Ransomware infection, the malware continues to rear its head on thousands, if not hundreds of thousands, of infected computers. The kill switch has been activates so the ransomware component would not activate, but the infection continues to run silently in the background, while routinely connecting to the kill switch domain to check if it was still live.
Spectre and Meltdown vulnerabilities that were found in 2017 and became public the beginning of 2018 will continue. I have been following this saga since I reported it first in Finland at Uusiteknologia.fi on-line magazine. Spectre-like variations continued to be discovered, just as academics predicted at the start of 2018. Intel and other processor manufacturers have worked on fixed, but there has been numerous new vulnerability variation reported over the year on the same theme, latest published in late 2018. Is Spectre making a comeback? I expect you will not get rid of new variations on this vulnerability theme in 2019. There are still many side channel flaws to be found on modern processors.
USB security is still fundamentally broken in 2019. USB drives are a security threat to process control systems because USB drives can cause serious disruption to process facilities through unsecure or malicious files. USB-borne malware continues to present a major threat to industrial control systems (ICS) nearly a decade after the Stuxnet attacks on Iran’s nuclear infrastructure first highlighted the danger.
The air gap is low-tech but still has value as a barrier against cyber attacks. But air gaps, once a valuable barrier against cyberattacks, are disappearing from industrial control systems. As smart shipping and other network-connected industrial control systems (ICS) grow, the air gap loses value as a barrier against cyber attacks. The use of air gaps has eroded or disappeared altogether, thanks to increasingly intertwined OT (operational technology) and IT (information technology). Also air gaps can’t protect against “an ill-informed person’s actions,” as was the case with the notorious 2010 Stuxnet attack on Iran’s nuclear facilities.
There are still major problems cyber security in industrial system. Major problems in industrial cyber security are inadequate software updates, the following non-upgraded systems, and common usage ids for updating. While the Common Vulnerability Scoring System (CVSS) can be useful for rating vulnerabilities, the scores assigned to flaws affecting industrial control systems (ICS) may be misleading.
Perimeter-less security is hot in 2019. You can’t build anymore well defined perimeters around all of your systems. Welcome to a World of Zero Trust. Zero Trust Privilege approach is based on six fundamental elements: Verify Who, Contextualize the Privileged Access Request, Establish a Secure Admin Environment, Grant Least Privilege, Audit Everything, Apply Adaptive Security Controls.
Can You Mitigate Against Mission Impossible? Most probably you can’t. Focus on the Countless Manageable Vulnerabilities That You Can Control and Protect Against Them. Cybersecurity risks need help from contracts and insurance beyond technologies, policies, and people. Pretending cybersecurity risks aren’t there isn’t on any list of best practices.
Credential abuse is at the core of many hacks in 2019. Usually the easiest way for a cyber-attacker to gain access to sensitive data is by compromising an end user’s identity. Equipped with the right credentials, cyber adversaries and malicious insiders can wreak havoc on an organization’s network, exfiltrate sensitive data, or even siphon off funds — all while concealing their malicious activities from threat detection solutions.
Good database security planning is essential for protecting a company’s most important assets because if attackers can shut companies out of their own data can quickly cripple an organization. Leaked data can also become costly with costs of data leak itself, regulatory costs (including GDPR fines) and bad reputation that can affect revenue for a long time.
Just on the end of 2018 there was reports on SQLite vulnerabilities. Magellan is a number of vulnerabilities that exist in SQLite that were able to successfully implement remote code execution in Chromium browsers (already fidex). This vulnerability can have a wide range of influence in 2019 because SQLite is widely used in all modern mainstream operating systems and software. There is potential that Critical SQLite Flaw Leaves Millions of Apps Vulnerable to Hackers. I expect to see reports against attacks against many different systems and system users failing to secure their systems.
DevSecOps is having a positive impact on security, but the state of security still has a long way to go as over 13 percent of applications contain at least one critical vulnerability. According to Veracode’s State of Software Security (SOSS) report, 87.5 percent of Java applications, 92 percent of C++ applications, and 85.7 percent of .NET application contain at least one vulnerability. Even with a stronger focus on security in 2019, most software will still riddled with security vulnerabilities.
Misconfigured server infrastructure is often considered one of the most significant causes of data breaches within the IT industry. This human error phenomenon is usually unintentional, but it can have catastrophic consequences regarding the exposure of sensitive personal information as well as potentially damaging the reputation of your business.Misconfiguration of the cloud platform took the top spot in this year’s survey as the single biggest threat to cloud security.
4 mobile security threats that companies must fight in 2019: Cryptojacking, Data breaches, Insecure networks and Social engineering attacks. Also Mobile Spear phishing campaigns will form the cornerstone for targeted attacks on organizations. The Wi-Fi attack vector isn’t going away any time soon, despite 5G hype. I don’t expect the assault on mobile to slow down as according to Gartner’s Market Guide to Mobile Threat Defense, 42 million mobile malware attacks take place each year.
Google says that Android 9 Brings Significant Security Advancements. Google has focused on aspects such as platform hardening, anti-exploitation, hardware-backed security. There are also new protections for the Application Sandbox.
Ultrasonic Tracking are Beacons on the Rise. It is an inaudible sound with encoded data that can be used on a listening device with suitable application to receive information that could be just about anything. There are numerous scenarios in which ultrasonic tracking beacons can be surreptitiously used and misused.
PUAs are being weaponized. PUA is the acronym for “Potentially Unwanted Application.” This is a general category used by all vendors to tag particular applications that can be misused by malicious people. Recently, an active campaign was spotted in the well-known Emotet Banking Trojan, which makes use of Freeware system tools but with an obscure purpose.
Microsoft has officially announced ‘Windows Sandbox’ for running applications in isolation. Microsoft’s coming ‘Windows Sandbox’ feature is a lightweight virtual machine that allow users to run potentially suspicious software in isolation. Windows 10 19H1 Build 18305 adds support for a new sandbox feature for isolating potentially suspicious apps, plus several other new security fixes.
It seems that Security Teams Need to Maintain Packet-level Visibility Into All Traffic Flowing Across Their Networks. The most destructive disaster is the one you do not see coming. While there is no evacuating cyberspace to avoid a storm of hackers, prior warning gives security teams a chance to stop cybercriminals before they can wreak havoc and make off with sensitive customer data or company secrets. There is an all too common adage that it is not a question of if a company will be hacked, but when they will find the hack. The realities of the cyberspace make it too difficult to reliably keep hackers out of corporate networks. That is not to say security teams should give up, but rather that they need to shift their goals.
Is 5G Technology a Blessing or a Curse for Security? Depends Who You Ask. It is best to Prepare for the Coming 5G Security Threats. But do we understand the 5G security threats to come? Most probably not, because it seems that the general understanding of 5G is pretty shallow for very many organizations. Many countries are not comfortable with the Chinese building its 5G network.
Somewhat quietly over the past couple of years there has been a flurry of breakthroughs in biometric technology (especially face and fingerprint recognition). New Boom in Facial Recognition Tech Prompts Privacy Alarms. Tech advances are accelerating the use of facial recognition as a reliable and ubiquitous mass surveillance tool, privacy advocates warn. Now facial recognition appears to be on the verge of blossoming commercially. There is potential risk that Surveillance Inhibits Freedom of Expression.
Old outdated encryption technologies refuse to die. MD5 and SHA-1 are still used in 2018 and their use does not seen to end in 2019. The current state of cryptanalysis against MD5 and SHA-1 allows for collisions, but not for pre-images. Still, it’s really bad form to accept these algorithms for any purpose.
Law is trying to weaken encryption in some countries. A newly enacted law rushed through Australia’s parliament will compel technology companies such as Apple, Facebook and Google to disable encryption protections so police can better pursue terrorists and other criminals. “I think it’s detrimental to Australian and world security,” said Bruce Schneier, a tech security expert affiliated with Harvard University and IBM. It could be a be a boon to the criminal underworld by undermining the technical integrity of the internet, hurting digital security and user privacy. We need good encryption in 2019 to keep Internet safe.
The payment card industry is thinking about security standards such as EMV 3D Secure and emerging technologies such as contactless payments.
The use of bug bounty programs to find security vulnerabilities in software and services is increasing.In January, the EU starts running Bug Bounties on Free and Open Source Software where European Commission to start offering bug bounties on 14 Free Software projects like Notepad++ and VLC that the EU institutions rely on. Going into 2019, the cybersecurity community will continue to learn about the world of threat hunting and how organizations can implement an effective threat hunting program.
You might need a password manager in 2019 more than you needed it now. If you thought passwords will soon be dead, think again. They’re here to stay — for now. Passwords are cumbersome and hard to remember and sometimes are easily hackable. Nobody likes passwords but they’re a fact of life. How do you make them better? You need a password manager. Some examples for proposed alternatives to passwords include biometric identification, disposable passwords, certificate-based systems and FIDO2 USB sticks.
You might also need two-factor authentication can save you from hackers. If you find passwords annoying, you might not like two-factor authentication much. But security experts say it’s one of the best ways to protect your online accounts and it usually (when implemented well) only adds a few extra seconds to your day.
Two factor authentication has been considered as best practice for some time, but even that alone might not be enough in 2019. Assuming you have your strong passwords in place and your two-factor authentication set up, you think your accounts are now safe? Think again. There’s much more to be done.
Two factor authentication can be hacked. Phishing Attempts That Bypass 2FA are here to stay. As we try to up our security game, the bad guys up their tactics too. Amnesty.org shared an interesting write up about phishing attacks that are bypassing 2FA. If you’re an at risk user, that extra two-factor security code sent to your phone may not be enough to protect your email account as Hackers Bypass Gmail 2FA at Scale. Although 2FA is generally a good idea, hackers can still phish certain forms of 2FA, such as those that send a code or token over text message. Some users likely need to switch to a more robust methods.
Keep in mind that your phone number can be a key for a hacker to many of your services. You might think your Social Security or bank account numbers are the most sensitive digits in your life. Nowadays, hackers can do far more damage with little effort using just your cell phone number. Whether you’re an AT&T, Verizon, Sprint or T-Mobile customer, every cell phone number can be a target for hackers. And it takes remarkably little effort to wreak havoc to your online life.
810 Comments
Tomi Engdahl says:
Chat Services: Be Diligent With This Must-Have Data Source for Intelligence Programs
https://www.securityweek.com/chat-services-be-diligent-must-have-data-source-intelligence-programs
Deep & Dark Web (DDW) forums and marketplaces have long served as hubs for illicit activity and, consequently, as invaluable data sources for defenders looking to combat such activity. However, threat actors continue to be drawn to the immediacy—and in many cases, the enhanced security and privacy—of encrypted chat services such as Telegram and Discord. These types of platforms have quickly emerged alongside DDW (and select open-web) communities as go-to venues for discussions, transactions, and media dissemination pertaining to cybercrime, fraud, and even drug trafficking operations, among many others.
Naturally, these platforms have since also become critical data sources for threat intelligence teams. But due to the numerous types of encrypted chat services, their decentralized yet pervasive nature, and the many different illicit—and legitimate—ways in which they are used, it can be difficult for teams to determine how to obtain and incorporate data from these platforms into their collection strategies in a meaningful way. Here are some key points to consider:
Chat services aren’t inherently malicious
Gleaning value from chat-services data starts with intelligence requirements
Be prepared to augment chat-services data with data from other sources
Tomi Engdahl says:
Finding Weaknesses Before the Attackers Do
https://www.fireeye.com/blog/threat-research/2019/04/finding-weaknesses-before-the-attackers-do.html
FireEye Mandiant red team consultants perform objectives-based assessments that emulate real cyber attacks by advanced and nation state attackers across the entire attack lifecycle by blending into environments and observing how employees interact with their workstations and applications. Assessments like this help organizations identify weaknesses in their current detection and response procedures so they can update their existing security programs to better deal with modern threats.
The key objectives of this engagement were to accomplish the following actions without detection:
Compromise Active Directory (AD): Gain domain administrator privileges within the client’s Microsoft Windows AD environment.
Access financial applications: Gain access to applications and servers containing financial transfer data and account management functionality.
Bypass RSA Multi-Factor Authentication (MFA): Bypass MFA to access sensitive applications, such as the client’s payment management system.
Access ATM environment: Identify and access ATMs in a segmented portion of the internal network.
Based on Mandiant’s investigative experience, social engineering has become the most common and efficient initial attack vector used by advanced attackers.
Tomi Engdahl says:
A Year Later, Cybercrime Groups Still Rampant on Facebook
https://krebsonsecurity.com/2019/04/a-year-later-cybercrime-groups-still-rampant-on-facebook/
Tomi Engdahl says:
Bracing Medical AI Systems for Attacks
https://spectrum.ieee.org/the-human-os/telecom/security/bracing-medical-ai-systems-for-attacks
Tomi Engdahl says:
Top five application security pitfalls to avoid
https://www.scmagazine.com/home/opinion/top-five-application-security-pitfalls-to-avoid/
Tomi Engdahl says:
Women Are 20% of Cyber Security Field – Conference Works to Bridge Gap
https://www.snhu.edu/about-us/newsroom/2019/04/women-in-cyber-security-field
Tomi Engdahl says:
Feeling Safe in the Surveillance State
https://www.nytimes.com/2019/04/10/opinion/china-internet-surveillance.html
In China, facial recognition cameras are celebrated, and many citizens believe the rest of the world is dangerous without them.
The other reason that my people seem not to worry about the violation of their privacy is that they believe they are law-abiding citizens. “Only criminals need to be afraid,” they say. But I’ve heard other stories.
Because she’d been a victim of a financial fraud — and therefore had grievances — she was now considered a threat to public safety and order.
Tomi Engdahl says:
China’s internet laws are catching on across the world as Washington, US tech giants face ideological battle in budding Southeast Asia
https://www.scmp.com/news/asia/southeast-asia/article/3006144/chinas-internet-laws-are-catching-across-world-washington?utm_medium=Social&utm_source=Facebook#Echobox=1555296819
Much of the world is adopting China’s vision for a tightly controlled internet over the unfettered American approach
Vietnam and Thailand are among the neighbouring nations warming to a governance model that combines sweeping content curbs with uncompromising data controls – because it helps preserve the regime in power
The more freewheeling Silicon Valley model once seemed unquestionably the best approach, with stars from Google to Facebook to vouch for its superiority. Now, a remoulding of the internet into a tightly controlled and scrubbed sphere in China’s image is taking place from Russia to India.
“For authoritarian countries in general, the idea of the state being able to wall off to some extent its internet is deeply appealing,”
Southeast Asia
a region home to more than half a billion people whose internet economy is expected to triple to US$240 billion by 2025.
“This is about the regimes’ survival in an authoritarian situation.”
Tomi Engdahl says:
New York Times:
Some companies attacked in 2017′s NotPetya ransomware plague have been denied insurance coverage over “war exclusion” clauses
Big Companies Thought Insurance Covered a Cyberattack. They May Be Wrong.
https://www.nytimes.com/2019/04/15/technology/cyberinsurance-notpetya-attack.html
Within days of a cyberattack, warehouses of the snack foods company Mondelez International filled with a backlog of Oreo cookies and Ritz crackers.
Mondelez, owner of dozens of well-known food brands like Cadbury chocolate and Philadelphia cream cheese, was one of the hundreds of companies struck by the so-called NotPetya cyberstrike in 2017.
Even with teams working around the clock, it was weeks before Mondelez recovered. Once the lost orders were tallied and the computer equipment was replaced, its financial hit was more than $100 million, according to court documents.
After the ordeal, executives at the company took some solace in knowing that insurance would help cover the costs. Or so they thought.
Mondelez’s insurer, Zurich Insurance, said it would not be sending a reimbursement check. It cited a common, but rarely used, clause in insurance contracts: the “war exclusion,” which protects insurers from being saddled with costs related to damage from war.
Mondelez was deemed collateral damage in a cyberwar.
When the United States government assigned responsibility for NotPetya to Russia in 2018, insurers were provided with a justification for refusing to cover the damage. Just as they wouldn’t be liable if a bomb blew up a corporate building during an armed conflict, they claim not to be responsible when a state-backed hack strikes a computer network.
The disputes are playing out in court.
The legal fights will set a precedent about who pays when businesses are hit by a cyberattack blamed on a foreign government. The cases have broader implications for government officials, who have increasingly taken a bolder approach to naming-and-shaming state sponsors of cyberattacks, but now risk becoming enmeshed in corporate disputes by giving insurance companies a rationale to deny claims.
“You’re running a huge risk that cyberinsurance in the future will be worthless,”
Cyberattacks have created a unique challenge for insurers. Traditional practices, like not covering multiple buildings in the same neighborhood to avoid the risk of, say, a big fire don’t apply. Malware moves fast and unpredictably, leaving an expensive trail of collateral damage.
NotPetya — which picked up the odd name because security researchers initially confused it with a piece of so-called ransomware called Petya — was a vivid example. It was also a powerful assault on computer networks that incorporated a stolen National Security Agency cyberweapon.
“We still don’t have a clear idea of what cyberwar actually looks like,” said Jake Olcott, vice president at BitSight Technologies, a cyber risk adviser. “That is one of the struggles in this case. No one has said this was an all-out cyberwar by Russia.”
In the past, American officials were reluctant to qualify cyberattacks as cyberwar, fearing the term could provoke an escalation.
The description of the Sony attack was deliberate
Obama administration had worried, in part, that the use of “cyberwar” would have triggered the liability exclusions and fine print that Mondelez is now challenging in court.
“You have insurers who are sitting on insurance policies that were never underwritten or understood to cover cyber risk,” Mr. Kannry said. “Zurich didn’t underwrite the policy with the idea that a cyber event would cause the kind of losses that happened to Mondelez. Nobody is at war with Mondelez.”
Many insurance companies are rethinking their coverage.
“I don’t want to scare people, but if a country or nation state attacks a very specific segment, like national infrastructure, is that cyberterrorism or is that an act of war?” Ms. Fort asked. “There is still a bit of gray area.”
Collateral damage from attacks that get out of control are going to become more and more common, he added. “That is what cyber is today,” Mr. Sagalow said. “And if you don’t like it, you shouldn’t be in the business.”
Tomi Engdahl says:
Bloomberg:
Governments across Southeast Asia, including Vietnam and Thailand, are adopting Chinese-style internet and data controls, raising alarms in the US
The U.S. Is Losing a Major Front to China in the New Cold War
https://www.bloomberg.com/news/articles/2019-04-14/china-wins-allies-for-web-vision-in-ideological-battle-with-u-s
A swathe of the world is adopting China’s vision for a tightly controlled internet over the unfettered American approach, a stunning ideological coup for Beijing that would have been unthinkable less than a decade ago.
Vietnam and Thailand are among the Southeast Asian nations warming to a governance model that twins sweeping content curbs with uncompromising data controls — because it helps preserve the regime in power. A growing number of the region’s increasingly autocratic governments watched enviously the emergence of Chinese corporate titans from Tencent Holdings Ltd. to Alibaba Group Holding Ltd. — in spite of draconian online curbs. And now they want the same.
The more free-wheeling Silicon Valley model once seemed unquestionably the best approach, with stars from Google to Facebook to vouch for its superiority. Now, a re-molding of the internet into a tightly controlled and scrubbed sphere in China’s image is taking place from Russia to India.
Tomi Engdahl says:
Rogue Waves: Preparing the Internet for the Next Mega DDoS Attack
https://threatpost.com/future-mega-ddos-attacks/143752/
Why many attack techniques can be reused – but organizations can’t defend against them.
When you think of a distributed denial-of-service (DDoS) attack at this point in the age of the internet, you might be thinking they’re old news. But when a multi-million-dollar business can be easily taken offline by an unskilled adversary and a $5 rent-a-DDoS service, I would argue that the issue is still very much relevant. Because of this, I decided to take a look at what might be on the horizon for malicious attackers, not in terms of who they’re going to hit next (that’s a game everyone can play but no one wins), but instead how it’s most likely to happen, and possibly from where.
Tomi Engdahl says:
90% of Infrastructure Security Pros Have Been Hacked in the Last Two Years
https://www.designnews.com/design-hardware-software/90-infrastructure-security-pros-have-been-hacked-last-two-years/213044111660594?ADTRK=UBM&elq_mid=8200&elq_cid=876648
According to a report commissioned by Tenable, 62% of respondents said their organizations have suffered multiple attacks.
Tomi Engdahl says:
Social engineering – It’s not just about phishing
https://blog.avast.com/social-engineering-hacks
Top 10 Best Preventive Methods to Secure Email Accounts from Email Hackers
https://gbhackers.com/secure-email-accounts/
Tomi Engdahl says:
Credential-stuffing attacks behind 30 billion login attempts in 2018
https://www.welivesecurity.com/2019/04/10/credential-stuffing-attacks-login/
Streaming media feature among services that take the spotlight in a report on credential-stuffing attacks in 2018
Hackers made 30 billion attempts last year that involved testing out purloined or leaked login details en masse in a bid to invade other people’s online accounts, reads a report by content delivery network provider Akamai.
Tomi Engdahl says:
ThreatList: Bad Bots Account for a Fifth of All Web Traffic, FinServ Hit the Worst
https://threatpost.com/bad-bots-web-traffic-finserv/143859/
The financial services industry sees nearly half of all website traffic coming from malicious bots.
About a fifth of all web traffic (20.4 percent) comes from bad bots, which continue to attack daily in automated offensives on websites, mobile apps and APIs. That’s worse for some verticals, like the banking and finance sector, which was hit the hardest last year.
Tomi Engdahl says:
Respect Is Key for Retaining Top Security Talent
https://www.securityweek.com/respect-key-retaining-top-security-talent
There are No Shortcuts or Easy Fixes for Retaining Top Security Talent, but Respect is Key
Tomi Engdahl says:
To the Depth of TLS Invisibility and Beyond
https://blogs.cisco.com/security/to-the-depth-of-tls-invisibility-and-beyond
Encrypted traffic is changing the threat landscape. Today’s digital businesses rely on encryption of application traffic for information sharing. The fact that the Internet is becoming increasingly “dark” is not debated with all indicators showing a steady increase. Compounding this issue is the potential of East/West traffic within an environment that could be hiding threats such as data hoarding or exfiltration that doesn’t leave over the Internet boundary.
Encryption technology enables greater privacy and security to communicate and transact business online. Mobile, cloud, and web applications rely on well-implemented encryption mechanisms, using keys and certificates, to ensure confidentiality and trust. Bad actors leverage these same benefits to evade detection, hiding malicious activities.
The encryption ecosystem is a significant portion of the IT organization’s charter and not without its challenges. Security and Network administrators need the firewalls to decrypt / analyze benign and malicious encrypted traffic to enforce policy without significantly affecting the user experience, while maintaining required privacy. Shadow IT adds another degree of complexity. Most of the modern applications communicate over TLS-encrypted sessions and are used by employees without IT knowledge or approval. Common threats lurking within TLS include: command and control, data exfiltration, malware downloads, and compromised website access.
Tomi Engdahl says:
How to Defend Your Organization Against Fileless Malware Attacks
https://securityintelligence.com/how-to-defend-your-organization-against-fileless-malware-attacks/
Share How to Defend Your Organization Against Fileless Malware Attacks on Twitter
Share How to Defend Your Organization Against Fileless Malware Attacks on Facebook
Share How to Defend Your Organization Against Fileless Malware Attacks on LinkedIn
The threat of fileless malware and its potential to harm enterprises is growing.
Fileless malware leverages what threat actors call “living off the land,” meaning the malware uses code that already exists on the average Windows computer. When you think about the modern Windows setup, this is a lot of code: PowerShell, Windows Management Instrumentation (WMI), Visual Basic (VB), Windows Registry keys that have actionable data, the .NET framework, etc. Malware doesn’t have to drop a file to use these programs for bad intentions.
Tomi Engdahl says:
How Not to Acknowledge a Data Breach
https://krebsonsecurity.com/2019/04/how-not-to-acknowledge-a-data-breach/
I’m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally I feel obligated to publish such accounts when companies respond to a breach report in such a way that it’s crystal clear they wouldn’t know what to do with a data breach if it bit them in the nose, let alone festered unmolested in some dark corner of their operations.
And yet, here I am again writing the second story this week about a possibly serious security breach at an Indian company that provides IT support and outsourcing for a ridiculous number of major U.S. corporations
On Monday, KrebsOnSecurity broke the news that multiple sources were reporting a cybersecurity breach at Wipro, the third-largest IT services provider in India and a major trusted vendor of IT outsourcing for U.S. companies.
Wipro asked me to give them several days to investigate the request and formulate a public comment. Three days after I reached out, the quote I ultimately got from them didn’t acknowledge any of the concerns raised by my sources. Nor did the statement even acknowledge a security incident.
Six hours after my story ran saying Wipro was in the throes of responding to a breach, the company was quoted in an Indian daily newspaper acknowledging a phishing incident.
Less than 24 hours after my story ran, Wipro executives were asked on a quarterly investor conference call to respond to my reporting. Wipro Chief Operating Officer Bhanu Ballapuram told investors that many of the details in my story were in error, and implied that the breach was limited to a few employees who got phished. The matter was characterized as handled, and other journalists on the call moved on to different topics.
the opportunity to ask Wipro’s executives what portion(s) of my story was inaccurate.
Ballapuram took issue with my characterization that the breach had lasted “months,” saying it had only been a matter of weeks
Ballapuram also claimed that his corporation was hit by a “zero-day” attack.
Wipro has so far ignored specific questions about the supposed zero-day
Ballapuram added that Wipro has gathered and disseminated to affected clients a set of “indicators of compromise,” telltale clues about tactics, tools and procedures used by the bad guys that might signify an attempted or successful intrusion.
So let’s recap Wipro’s public response so far:
-Ignore reporter’s questions for days and then pick nits in his story during a public investor conference call.
-Question the stated timing of breach, but refuse to provide an alternative timeline.
-Downplay the severity of the incident and characterize it as handled, even when they’ve only just hired an outside forensics firm.
-Say the intruders deployed a “zero-day attack,” and then refuse to discuss details of said zero-day.
-Claim the IoCs you’re sharing with affected clients were discovered by you when they weren’t.
WHAT DID THE ATTACKERS DO?
The criminals responsible for breaching Wipro appear to be after anything they can turn into cash fairly quickly.
https://krebsonsecurity.com/2019/04/experts-breach-at-it-outsourcing-giant-wipro/
Tomi Engdahl says:
Weaponized USB devices as an attack vector
https://www.kaspersky.com/blog/weaponized-usb-devices/26495/
USB devices are the main source of malware for industrial control systems, said Luca Bongiorni of Bentley Systems during his talk at #TheSAS2019. Most people who are in any way involved with security have heard classic tales about flash drives “accidentally” dropped in parking lots — it’s a common security story that is just too illustrative not to be retold again and again.
The first such devices were written up back in 2010. Based on a small programmable board called Teensy and equipped with a USB-connector, they were able to act like HIDs, for example, sending keystrokes to a PC.
The person who invented PHUKD quickly came up with an idea and created a trojanized mouse with a pentesting board inside
The second generation of weaponized USB devices was created during 2014–2015 and included the infamous BadUSB-based devices.
The modern state of weaponized USB devices
The third generation of USB pentesting tools brings them to a whole new level. One such tool is WHID Injector, which is basically Rubberducky with a Wi-Fi connection. Because it has Wi-Fi, there’s no need to program it initially with all that it is supposed to do; a hacker can control the tool remotely, which provides more flexibility and also the ability to work with different operating systems. Another third-gen tool is P4wnP1, which is based on Raspberry Pi and is like Bash Bunny with some additional functionality, including wireless connectivity.
Tomi Engdahl says:
Configuring MTA-STS and TLS Reporting For Your Domain
https://isc.sans.edu/forums/diary/Configuring+MTASTS+and+TLS+Reporting+For+Your+Domain/24840/
Currently, the majority of HTTP traffic uses TLS (HTTPS) [1]. This is in part due to free and easy to manage certificates from Let’s Encrypt, but also due to HTTP Strict Transport Security, an HTTP header that will tell browsers to only connect to your site via HTTPS [2].
For email, we typically use TLS to connect from our mail client to our mail server. But for email, the weak link is connections between mail servers as they forward email. Years ago, STARTTLS became a popular feature. It does allow servers to discover that the other server supports TLS, and upgrades can happen “on the fly”. The system is very simple and efficient, but suffers a major shortcoming: The initial connection is in the clear without TLS, and an adversary may easily alter the content, removing the TLS header, so users will never know that their server sent the email in the clear [3].
Tomi Engdahl says:
Liikesalaisuuslaki suojaa kriittisiä tietoja
https://blogi.kauppakamaritieto.fi/liikesalaisuuslaki-kriittisten-tietojen-suojana?utm_campaign=KKT_Liikesalaisuuslaki&utm_content=88297649&utm_medium=social&utm_source=facebook&hss_channel=fbp-261377387213264
Tomi Engdahl says:
Malicious Attacks On Open Source Are Going to Get Worse; Developers Need to Take Notice
https://blog.sonatype.com/malicious-attacks-on-open-source-are-going-to-get-worse?utm_campaign=JG%20-%20SM%20-%20Organic&utm_source=Malicious%20attacks%20on%20open%20source%20blog
Two years ago our CTO, Brian Fox, started chronicling a disturbing turn of events that showed that a shifting landscape of attacks based on OSS consumption was emerging. Since then, we’ve seen a consistent increase in malicious open source and supply chain attacks that make one thing clear– it’s only going to get worse. Most recently it was the Bootstrap-sass hack and before that, the event-stream attack.
A little background on how we got here: five years ago, large and small enterprises alike witnessed the first prominent Apache Struts vulnerability.
Simply stated, hackers profit handsomely when companies are asleep at the wheel and fail to react in a timely fashion to public vulnerability disclosures.
the community has witnessed Shellshock, Heartbleed, Commons Collection and others, including the 2017 attack on Equifax
This new form of attack on our software supply chains, where OSS project credentials are compromised and malicious code is intentionally injected into open source libraries, allows hackers to poison the well. The vulnerable code is then downloaded repeatedly by millions of software developers who unwittingly pollute their applications to the direct benefit of bad actors.
It’s become clear that we are in the middle of a systematic attack on the social trust and infrastructure used to distribute open source.
vital for enterprises to understand what open source components they’re using and where; and increasingly important for open source developers to pay attention to their own security.
Tomi Engdahl says:
Deep fakes pose threat in 2020 race -US officials
https://mobile.reuters.com/video/2019/04/09/deep-fakes-pose-threat-in-2020-race-us-o?videoId=535655433&videoChannel=118208
Deep fakes are making a lot of people nervous, especially ahead of the 2020 election. Deep-learning computer applications can now generate fake video and audio that’s so slick, you can’t tell what’s real and what’s not. But now Congress and some states are considering legislation to criminalize the malicious creation and distribution of deep fakes.
Tomi Engdahl says:
The Privacy Implications of Self-Driving Cars
https://www.oif.ala.org/oif/?p=17589
Tomi Engdahl says:
Scaling up Security with DevOps and CI/CD practices
https://blog.detectify.com/2019/04/03/scale-up-security-in-devops-teams/
Tomi Engdahl says:
Graphically manage SSH keys with Seahorse
https://opensource.com/article/19/4/ssh-keys-seahorse?sc_cid=7016000000127ECAAY
Seahorse, also referred to as Passwords and Keys, allows you to manage SSH key generation and distribution even if you’re not comfortable working on the command line
Tomi Engdahl says:
Do SSL warranties protect you? As much as rocks keep tigers away…
https://www.venafi.com/blog/do-ssl-warranties-protect-you-much-rocks-keep-tigers-away?utm_source=socialmedia&utm_medium=Bora&utm_campaign=SSL-warranties-useless-blog
Tomi Engdahl says:
Unmasked:
What 10 million passwords reveal
about the people who choose them
https://wpengine.com/unmasked/
Tomi Engdahl says:
How to enable SSH access using a GPG key for authentication
https://opensource.com/article/19/4/gpg-subkeys-ssh?sc_cid=7016000000127ECAAY
Learn how to eliminate SSH keys and use a GNU Privacy Guard (GPG) subkey instead
Tomi Engdahl says:
Leaders of the G7: A Safer World Means Strong, Secure Communication
https://www.internetsociety.org/blog/2019/04/leaders-of-the-g7-a-safer-world-means-strong-secure-communication/
In the recent G7 outcome document “Combating the use of the Internet for Terrorism and Violent Extremist Purposes“, Ministers of the Interior made commitments on content filtering and “lawful access solutions” for encrypted content, which, if implemented, would greatly weaken the security of the Internet, G7 economies and their citizens.
While there is an urgent need to prevent terrorists and violent extremists from exploiting Internet platforms, facing down terrorist threats and cybercrime requires strong, secure communications. Not the opposite.
Tomi Engdahl says:
Microsoft Realizes Password Expiration Is Poor Security
https://uk.pcmag.com/windows-10/120665/microsoft-realizes-password-expiration-is-poor-security
Tomi Engdahl says:
https://pentestmag.com/do-you-know-where-your-data-is/
Complex and obscure data supply chains are making it difficult for users to understand where their data is captured, transacted and exposed.
Tomi Engdahl says:
Scaling up Security with DevOps and CI/CD practices
https://blog.detectify.com/2019/04/03/scale-up-security-in-devops-teams/
Today companies are hit by hacker attacks whether they are aware of it or not. On average a hacker can be lurking in a system undetected for around 205 days. Once in, hackers run scripts and automate hacker attacks in order to do things at scale. For example, SQL injection can be easily automated. No company would be able to conjure up enough manpower to stop the scale and speed of automated attacks from multiple actors, which is why using an automated scanner could be one way to continuously scan your code and locate vulnerabilities before they’re exploited by a malicious hacker.
Tomi Engdahl says:
Toward an Information Operations Kill Chain
https://www.lawfareblog.com/toward-information-operations-kill-chain
Cyberattacks don’t magically happen; they involve a series of steps. And far from being helpless, defenders can disrupt the attack at any of those steps. This framing has led to something called the “cybersecurity kill chain”: a way of thinking about cyber defense in terms of disrupting the attacker’s process.
On a similar note, it’s time to conceptualize the “information operations kill chain.” Information attacks against democracies, whether they’re attempts to polarize political processes or to increase mistrust in social institutions, also involve a series of steps.
Tomi Engdahl says:
How healthy is the internet?
https://internethealthreport.org/2019/
Tomi Engdahl says:
Formula Injection
https://pentestmag.com/formula-injection/
Write-up for Gemini Inc: 1
https://pentestmag.com/write-up-for-gemini-inc-1/
This is a write-up on the Gemini Inc: 1, a VulnHub machine designed to be vulnerable. This write-up aims to guide readers through the steps to identifying vulnerable services running on the server and ways of exploiting them to gain unauthorised privileged access to the server
Tomi Engdahl says:
Google will begin to block sign-ins from embedded browser frameworks in June
https://venturebeat.com/2019/04/18/google-will-begin-to-block-sign-ins-from-embedded-browser-frameworks-in-june/
Tomi Engdahl says:
https://pentestmag.com/shell-lunch-box/
https://pentestmag.com/pentest-blog-viktor-minin-on-process-migration/
Tomi Engdahl says:
The Holy Book of x86
https://pentestmag.com/holy-book-x86/
This book/guide/tutorial/wiki is about assembly and x86 architecture. It’s written by a low level security dude for low level security dudes. If you want to learn Assembly and its structure, reversing basics, Segmentation, Paging etc. keep on reading.
Tomi Engdahl says:
Playing battleships over BGP
https://blog.benjojo.co.uk/post/bgp-battleships
BGP is the glue of the internet. For a protocol that was produced on two napkins in 1989 it is both amazing and horrifying that it runs almost all of the ISP to ISP interactions and is now a very fundemental part of the internet.
Tomi Engdahl says:
A GUY GOT A QR CODE TATTOO AND THEN SOMEONE BROKE THE LINK
https://futurism.com/the-byte/qr-code-tattoo-broken-link
Tomi Engdahl says:
1 big thing: How Heartbleed turned vulnerabilities into brands
https://www.axios.com/newsletters/axios-codebook-0d66e3c0-42f7-42aa-9387-81bb70feb235.html?chunk=0&utm_term=fbsocialshare#story0
Tomi Engdahl says:
Spy on your smart home with this open source research tool
https://techcrunch.com/2019/04/13/spy-on-your-smart-home-with-this-open-source-research-tool/?tpcc=ECFB2019&fbclid=IwAR13jgsABsnUvOpFOC-WOAZFxsBqT04lm0vyzPRu5oovRXkRGPTp2FXFFQg
Tomi Engdahl says:
Securing SD-WAN
https://www.networkworld.com/securing-sd-wan/playlist/sd-wan?utm_source=Facebook&utm_campaign=Fortinet18026&utm_medium=social&utm_content=SmartAd_FirstParty
Tomi Engdahl says:
Effects of Biometrics Co-Used with Password
https://pentestmag.com/effects-biometrics-co-used-password/
Tomi Engdahl says:
For Your Eyes Only: Tackling Cyber Security Burnout
A perfect storm is causing overload and stress for cyber security professionals.
https://medium.com/threat-intel/cyber-security-burnout-stress-73653258422c
Most people who enter the world of cyber security can’t help but feel a thrill of excitement, probably stemming from a deep-seated nugget of a memory from their favorite thriller. Given that life isn’t an Ian Fleming novel, however, few expect to end up jumping out of planes, being in car chases or ducking gunfire, but there is still a reason they didn’t apply for a job at the local tax office.
This new research is extensive, encompassing the views of more than 3,000 cyber security professionals across France, Germany and the UK. They know that cyber security isn’t an easy option; indeed, they see it as a stimulating challenge. The research reports that almost all (92 percent) cyber professionals feel fully immersed in their work, even when it’s stressful. In fact, 90 percent of them say they thrive under pressure.
However, the vast majority (82 percent) of cyber security professionals also report feeling burnt out. And, worryingly, two-thirds are thinking of resigning from their current role, and about the same number are considering leaving the industry completely. It is a fairly simple correlation to note that about two-thirds think they are ‘set up for failure.’
Tomi Engdahl says:
Naming and shaming nations that launch cyberattacks does work, say intel chiefs
Cybersecurity agencies explain when and why they attribute cyberattacks to other nations.
https://www.zdnet.com/article/naming-and-shaming-nations-that-launch-cyberattacks-does-work-say-intel-chiefs/
Western countries are increasingly calling out malicious cyber activity by other nation states, and this naming and shaming can deter attacks and spur potential victims into improving their security planning, according to intelligence chiefs.
Tomi Engdahl says:
Network DoS Attack on PLCs Can Disrupt Physical Processes
https://www.securityweek.com/network-dos-attack-plcs-can-disrupt-physical-processes
A team of researchers has demonstrated an interesting type of denial-of-service (DoS) attack on programmable logic controllers (PLCs), where network flooding can lead to the disruption of the physical process controlled by the device.
A paper titled “You Snooze, You Lose: Measuring PLC Cycle Times Under Attacks” was published last year by a group of researchers from the German universities Hochschule Augsburg and Freie Universität Berlin. The ICS-CERT agency in the United States this week published an advisory showing what each impacted vendor said or did in response to the flaw.
You Snooze, You Lose: Measuring PLC Cycle Times under Attacks
https://www.usenix.org/system/files/conference/woot18/woot18-paper-niedermaier.pdf
Tomi Engdahl says:
How to create a security culture in your company in 2019
https://www.alienvault.com/blogs/security-essentials/security-culture?utm_medium=Social&utm_source=THN&utm_content=blog
Cybersecurity isn’t just about the computer hardware, software, and networking technicalities that it pertains to. It is also about how human beings behave with computer technology–and what sort of cyber risks that behavior can create. Culture influences behavior, and the security culture of your company can have an immense effect on your cybersecurity. I’ll explain why.
Every single person in your organization has an effect on your security, from the CEO to the janitor. The security policies and attitudes of each employee towards those policies is your company’s security culture.
Having good security policies is very important.
5 best practices for creating a strong security culture.
Lead by example
Make good practices habit and routine
Enforce the principle of least privilege
Keep software and systems up-to-date
Make security training engaging and bite-sized
A security culture framework is:
a system for creating security culture goals,
implementing activities and procedures toward those goals,
and measuring how successful those actions are in obtaining those goals.