David Caddick

The source is the source https://lnkd.in/gqcuS64P

5

If you use Palo Alto firewalls, here's a new 9.8 severity flaw for which you should patch immediately: https://lnkd.in/gNRYs5Tz It certainly continues to be a trying time for all the firewall vendors at the moment!

1

How key it has been with this incident 1. Have MFA for access to system for standard and privileged user 2. RBAC for access to database 3. Manage remote connections through personal mobile devices what access to be allowed

2

If you have IPv6 enabled on Windows 10, Windows 11, and Windows Server, keep reading below. An unauthenticated attacker could exploit this vulnerability by sending specially crafted IPv6 packets to a Windows machine, potentially enabling remote code execution. Microsoft has suggested a mitigation strategy: "Systems are not affected if IPv6 is disabled on the target machine. 😂

6

Several NSW Government, Queensland Government departments and Commonwealth agencies are starting to leverage Microsoft Azure Sentinel for their SIEM & SOAR requirements. This whitepaper outlines the Strategies for success in data ingestion and incident response. Here is the TL;DR version 1. 𝗗𝗮𝘁𝗮 𝗜𝗻𝗴𝗲𝘀𝘁𝗶𝗼𝗻 𝗮𝗻𝗱 𝗦𝗼𝘂𝗿𝗰𝗲 𝗖𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝘃𝗶𝘁𝘆: Ensure that all relevant data sources, including both Microsoft and non-Microsoft products, are connected to Azure Sentinel. This includes leveraging built-in connectors, Syslog, Common Event Format (CEF), and APIs for seamless integration across diverse environments​.     2. 𝗖𝗼𝘀𝘁 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗮𝗻𝗱 𝗟𝗼𝗴 𝗜𝗻𝗴𝗲𝘀𝘁𝗶𝗼𝗻 𝗣𝗹𝗮𝗻𝗻𝗶𝗻𝗴: Carefully plan which logs and alerts to ingest to control costs, as certain logs (e.g., Azure Active Directory) may incur additional charges. Utilize free logs, such as Azure Activity and Office 365 Audit Logs, where possible​.     3. 𝗜𝗻𝗰𝗶𝗱𝗲𝗻𝘁 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗲 𝗮𝗻𝗱 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗼𝗻: Set up advanced alert rules and automated incident creation within Azure Sentinel to streamline response times and ensure that incidents are automatically created from high-priority alerts.     4. 𝗧𝗵𝗿𝗲𝗮𝘁 𝗛𝘂𝗻𝘁𝗶𝗻𝗴 𝗖𝗮𝗽𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀: Leverage Azure Sentinel’s built-in hunting queries, real-time investigation tools like Livestream (in public preview), and Jupyter notebooks for advanced threat hunting. This enhances proactive security monitoring.     5. 𝗦𝗰𝗮𝗹𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗮𝗻𝗱 𝗩𝗶𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝘆 𝗔𝗰𝗿𝗼𝘀𝘀 𝗪𝗼𝗿𝗸𝘀𝗽𝗮𝗰𝗲𝘀: Utilize Azure Sentinel’s capacity to scale automatically across multiple environments and workspaces, making it ideal for organizations with complex or segmented security setups​.

15

How many out there know that there is an Australian government approved cyber security framework and certification? No, it's not Essential 8. Although Essential 8 is the "go to" framework from the ACSC, that's not what I'm referring to. SMB1001 has been brought to market by Cyber Security Certification Australia (CSCAU) and is available now for any organisation to certify themselves against. 5 tiers, to cater from small business to larger organisations well into the mid-market space. MyCISO and CyberCert have partnered up to bring the SMB1001 framework into our Assess platform to provide a really great way for those organisations who don't want to go down the ISO 27001 or full NIST CSF path to baseline their maturity, and be able to prove to their customers that they have taken reasonable steps to secure thier cyber posture. This same framework can be used as an excellent baseline to assess your supply chain as well. Fewer control requirements, but focused on the things you really need to know when assessing risk in your 3rd parties. Reach out to us here at MyCISO, or get in touch with Cyber Security Certification Australia (CSCAU) if you want to learn more. Stay safe out there! #cybersecurity #smb1001 Dane Meah Nick Anderson Ryan Ko Peter Maynard

68

6 Comments

HOW WILL THE Cybersecurity Maturity Model Certification v2 EFFECT AUSTRALIA? No, I'm actually asking. Will this major shift in compliance requirements by government contractors be mirrored here in Australia perhaps as an over haul of #DISP? If you know can you comment below... Cheers #HVCK

3

Curious as to why the AssetCacheLoacator service on my MacOS is trying to connect to Australia to perform an Apple Update per Little Snitch. I have a whole thread going on X right now. Still waiting for followers to pick up on BlueSky. I tried different Laptops and networks and have come to the conclusion that so far either my firewall has been compromised or is simply malfunctioning or something is wrong with Comcast. DNS is doing some really strange things. Someone is trying to point my laptops to a DNS record instead of an IP, and as you know if you are into this sort of thing, DNS rebinding can change IPs, and DNS caches can be compromised. When I set the allow rule for the DNS record, I still block any invalid DNS servers based on IPs. DNS is not working on that network and I haven’t changed anything on the network side. The only thing in my firewall logs getting blocked is traffic to 1.1.1.1 which the family DNS record should not resolve to. I’m not getting any DNS responses at all. When I move my laptop to another network, the DNS records were somehow altered. When I fixed that DNS worked. But Little Snitch reports that the MacOS asset service mentioned above is apparently still trying to reach Australia and softwareupdated is trying to reach an address in Rio de Janeiro. Hmm. Do you block invalid DNS servers on your network? If you don’t, things might be resolving to unexpected or unauthorized IP addresses.

2

The Australian Signals Directorate’s (#ASD) Australian Cyber Security Centre (#ACSC), has just released an advisory report on #APT40 activity, including #IOC and #TTP and mitigation strategies. APT40 is a Chinese threat group responsible for many #cyberespionage campaigns in the region and globally. This is an important read if you work in #cybersecurity and #DFIR. #infosec #CISO #malware #threatintelligence https://lnkd.in/gvCFpM5R

61

This is a great step to everyone getting the logs they should have within M365. IMO the most important is MailItemsAccessed, which are critical during BEC investigations. Note this is in Preview and won't be available for general access for the next several months, but highly recommend everyone reads this for any todos (especially around AuditEnabled). https://lnkd.in/gTMSVHqi

32

Shocking, what is such an amount (580TB) of data doing being on shared drives to begin with? Personal info should be held only in those applications that need them, not on network drives... Sounds like someone got a level of admin access and were able to explore nearly all the drives... #databreach #privacy #pii #shareddrives

2

Want to change the inadequacy of you cybersecurity efforts? Have you considered Prevent & Protect technology! If you don’t know what Prevent & Protect can do for your organisation - you’re welcome to reach out.

5

2 Comments

I have enjoyed learning about Wazah and walking through the process of inspecting and hardening my cloud servers. I want to gain some experience with other SIEM's such as Graylog, but the setup is a lot more involved. Is there an easier way to get it up and running on a cloud server? #wazuh #graylog

9

7 Comments

Don’t Skip That “Install Updates” Button! Here’s Why It Matters 🚨 Let’s be honest—who hasn’t ignored a software update to save time or data? I remember a time when internet access was scarce, and mobile data was painfully expensive. My instinct back then? Hit “ignore” every time an update notification popped up. I dreaded those “security updates” draining my limited data… but I didn’t realize the risks I was taking. Today, things are different. We have better connectivity and more affordable data, yet many people still avoid updates because they’re “inconvenient.” Here’s what’s truly inconvenient: losing access to your accounts, having your credentials stolen, and risking your privacy. 😳 So, here’s a quick reminder: next time you see that update notification, don’t ignore it. Take a moment to install it. With each update, you’re closing doors on vulnerabilities that attackers could exploit. Stay proactive, stay secure, and keep those digital spaces safe! 🔒✨

11

1 Comment

If you need a deep dive on Active Directory - how it works, and how to defend it - then look no further than this guide from CISA and their Aussie friends. #ad #activedirectory

2

Researchers from Elastic have analysed an interesting campaign where the threat actors have abused the #Microsoft Management Console (#MMC) for initial access and defence evasion, dubbed #GrimResource. #infosec #cybersecurity #DFIR #cybercrime #CISO #malware #IOC #threathunting #threatintelligence #YARA https://lnkd.in/g_npTqEM

25

PROBLEM: crooks 🦹‍♂️ use hooks 🪝to get your passwords 🤦🏻 SOLUTION: use passkeys 🔑not passwords BACKGROUND myGov is one of the most impersonated 😡Australian Govt websites 🔹 Phishing-fake websites typically steal 🦹‍♂️ your password and username by mimicking the login page of a legitimate website. 🔹When you enter your email and password on the fake website, they are captured by the attacker 🪝 🟣 Good news / news flash 📣 1️⃣ myGov is NOW among the first govt digital services in the world 🌎 to start using passkeys - which are resistant to phishing ✅ 2️⃣ turning off - your myGov password as a sign-in option - and using your passkey 🔑 instead - makes it harder for scammers to access your accounts using stolen usernames and passwords ✅ 3️⃣ On average, more than 860,000 people sign in to myGov each day 🤯 4️⃣ In Australia ♥️ last year scams cost $2.74 billion, with $250 million coming from someone stealing/phishing 🪝 your log in details. For more information on how to set up your myGov passkey ➡️ https://lnkd.in/ggWP5XaH See comments for set up instructions … Bravi to Minister Bill Shorten and Services Australia for being an early govt adopter of passkeys 🏆 📸 Serena Hardwick 📍Wagga Wagga TackleWorld

543

43 Comments

New Cyber Security Act: Key Outcomes for Australian Businesses and Industry** Bill Link: https://lnkd.in/gCSWRCzY The Cyber Security Act is set to significantly enhance Australia’s cyber resilience, with important outcomes that businesses, manufacturers, and suppliers need to know: Mandatory Security Standard: Internet-connected products acquired in Australia must comply with strict security standards to protect against cyber threats. Ransomware Payment Transparency: Reporting obligations are now in place for businesses making ransomware payments, promoting transparency and discouraging such actions. Government Coordination: The National Cyber Security Coordinator will lead across government departments to ensure a unified response to major cyber incidents. Information Protection: Information shared with the government about cyber incidents is protected and won't be used in legal proceedings against reporting entities. Compliance and Enforcement: Strong regulatory powers are in place to ensure businesses adhere to cyber security standards, with penalties for non-compliance. Global Impact: The Act applies both within and outside Australia, meaning international suppliers must comply if their products reach the Australian market. This legislation is a major step towards strengthening Australia's defense against cyber threats and protecting critical infrastructure. #CyberSecurity #TechLaw #Australia #DigitalSafety #Ransomware #Compliance #CyberResilience #Business

13