David Dowling, CISSP

New Cyber security Bill 2024 for Australia that you should review... New Cybersecurity Legislation for Australia that you should review. Windstil has been following the progress of the proposed Australia Governments Cyber Security Bill 2024 that aims to introduced new legislation focused on enhancing cybersecurity across the broader economy. It’s touted as Australia’s first standalone cybersecurity act. This Bill has now been introduced to parliament. We recommend our customers review the new bill as key elements include mandatory reporting for certain businesses on ransomware payments and a range of other measures business will need to adapt to. You can find a complete breakdown of the Cyber Security Bill 2024 here https://lnkd.in/gvsBRjuB For small and medium business there is going to be increased compliance overhead to adopt a sound cyber security posture across their operations. We understands cyber security can be a daunting topic for many businesses, but we’re here to help. Our Cyber Security Team have developed a cost effective and proven program to implement the Australian Cyber Security Centres (ACSC) Essential Eight framework. We provide an initial analysis of your IT environment, develop a plan and implement the recommended Essential Eight security controls and even develop IT security policies, incident response plans and IT disaster recovery plans for our cyber security customers. Importantly our program is highly cost effective and accessible for small business. It enables our customers to confidently demonstrate to their stakeholders that they are cybersecurity aware, and safe to do business with. For more information please visit our website https://lnkd.in/gnv_ibjz or just give us call on 1300 01 99 88.

9

1 Comment

The #FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) have released a “Secure by Design” guide to establishing a safe software deployment program. Developers should ensure code and configuration changes pass through a series of well-defined phases, supported by robust testing. This #CybersecurityAwarenessMonth, learn how software manufacturers can ensure reliability for customers: https://lnkd.in/eTZe_HVE

233

6 Comments

Netlas and RST Cloud Forge Alliance to Enhance Cyber Threat Intelligence and Threat Hunting Capabilities Netlas.io, a leading platform for internet-wide scanning and external attack surface management, and RST Cloud, a premier Australian provider of cyber threat intelligence (CTI) solutions, are pleased to announce a strategic collaboration aimed at bringing additional value to customers of both organisations. With the release of the new Netlas version, users will now benefit from the inclusion of RST Cloud’s contextualised IoC (Indicators of Compromise) data from their extensive database, aggregated through multiple CTI sources across the globe within the Netlas platform. This includes data about related threat type and threat attribution, reputational score and False Positive flag. This integration empowers cybersecurity professionals with advanced tools for identifying potential threats during their investigations. “Indicators of compromise very logically complement the data provided by Netlas. With the vulnerability labels and other data provided, this will allow users to even better understand the degree of danger of the objects in their scope,” said Arthur Kotylevskiy, CEO at Netlas. “From RST Cloud’s perspective, this collaboration allows us to utilise Netlas’ extensive internet-wide scanning capabilities to identify new IoCs and enhance our threat intelligence services.” said Founder of RST Cloud, Yury Sergeev. The collaboration offers several key benefits: For Netlas users: – Access to RST Cloud’s threat intelligence data, enhancing the identification of malicious IP addresses and domains. – Comprehensive threat context to improve incident analysis and remediation efforts. – Enhanced decision-making through the availability of reliable and up-to-date threat data. For RST Cloud users: – Leveraging Netlas’ scanning capabilities to identify new IoCs and enrich threat intelligence and extending RST Cloud capabilities to access the most relevant IoCs (including malicious IP, C&C servers). – Gaining wider visibility into devices and services exposed to the internet using Netlas’ threat hunting engine to identify infrastructure owned by malicious actors. Together, Netlas.io and RST Cloud are dedicated to delivering unparalleled cybersecurity services, equipping professionals with the necessary tools to stay ahead of evolving cyber threats. This strategic collaboration marks a significant step forward in enhancing threat intelligence and external attack surface management for customers worldwide.

10

🚨 Today, the NCSC and partners from seven other countries have issued a joint advisory about evolving threat activity by APT40 and other China state-sponsored cyber actors: https://lnkd.in/e4qnD7Pj APT40 has embraced the trend in using compromised small-office and home-office devices to launch attacks and have been seen targeting Australian networks. These techniques pose a threat to networks globally. Defenders are encouraged to follow the latest advice to help detect and mitigate this malicious activity.

301

2 Comments

APT40 Attack - Download our Threat Intel Report Discover the tactics of PRC state-sponsored cyber group APT40, known for targeting organisations globally, including in Australia and the US. Our Threat Intelligence Report highlights crucial case studies and techniques used by APT40. Understand how to identify, prevent, and remediate these threats. Download our comprehensive APT40 Report now: https://lnkd.in/evGbzsbi #CyberSecurity #APT40 #ThreatIntelligence #RelianceCyber #CyberThreats #NetworkSecurity

3

In this year’s Asia Pacific Digital Forensics & Incident Response Summit 2024, Nicholas will be sharing his experience with firewalls. This presentation will explore what happens when firewalls turn against us; when vulnerabilities such as CVE-2024-3400 expose the precious endpoints behind said firewalls, threatening an organisations crown jewels. Make sure you use the “Add to Calendar” feature so you don’t miss out on the talk! Register Now! https://lnkd.in/e64Xws2Q #APACDFIRSummit

3

In this year’s Asia Pacific Digital Forensics & Incident Response Summit 2024, Nicholas will be sharing his experience with firewalls. This presentation will explore what happens when firewalls turn against us; when vulnerabilities such as CVE-2024-3400 expose the precious endpoints behind said firewalls, threatening an organisations crown jewels. Make sure you use the “Add to Calendar” feature so you don’t miss out on the talk! Register Now! https://lnkd.in/e64Xws2Q #APACDFIRSummit

9

Data is key to military asset security. Beyond physical protection, a multi-layered approach is essential, including information security, intelligence, and human intervention. We can protect our military assets and ensure national security by addressing the issues mentioned below. https://lnkd.in/gBuF5esh #militarysecurity #cybersecurity #datasecurity #surveillance #technology

12

#BreachInsights 🔎 New Zealand Stock Exchange - Distributed Denial of Service (DDoS) attacks. In March and April 2020, the New Zealand Stock Exchange (NZX) was hit by several DDoS attacks. The severity of these attacks was unlike anything seen before, forcing the exchange to shut down. ❔ What is a DDoS, and what happened in the New Zealand Stock Exchange attacks? A Distributed Denial of Service (DDoS) attack occurs when an attacker floods a website, server, or network with excessive traffic, overwhelming the system and thus blocking legitimate users from accessing the service. In NZX’s case, the website had been overwhelmed by malicious offshore digital traffic, slowing it down so much that the exchange could not make any market announcements required by financial regulators. This forced NZX to stop any trading. The attack review revealed that an attack of this scale was predictable and should have been prepared for. NZX lacked tools and practices for handling increasing trading volumes and was aware of limitations in its core processing systems. Furthermore, the attacks highlighted the shortcomings in NZX's crisis management procedures, i.e. relying on a single, unprotected method for market announcements with minimal contingency planning in place. Lessons Learned: ⚫ Businesses need to ensure they have adequate technology capabilities and trained staff. Regular assessments of systems and processes are essential to identify and address weaknesses before they lead to significant issues. ⚫ Businesses should adopt essential tools and best practices to handle growth effectively. This includes investing in scalable systems that can accommodate increasing demand and proactively addressing known infrastructure limitations. ⚫ Businesses should create contingency plans for critical operations. Additionally, prioritising security practices is crucial for safeguarding against potential threats and ensuring effective crisis management. Read the full article in the comments section 👇 #ITPartners #Cybersecurity #TechNews #SecurityFlaws #CyberAwareness #CyberDefense

7

1 Comment

🚨 APT40 Tradecraft in Action: Alert AA24-190A 🚨 Released on July 8, 2024, by top cybersecurity agencies, the latest advisory on APT40—a PRC state-sponsored cyber group linked to the Ministry of State Security—highlights their persistent threat to networks globally, especially targeting Australia and the United States. 🔍 Key Highlights: Techniques: APT40 exploits new vulnerabilities rapidly, favoring public-facing infrastructure over phishing. Persistence: Utilises web shells and compromised SOHO devices for continuous access. Tools: Shared malicious files identified, aiding the cybersecurity community. 📚 Case Studies: July-September 2022: Targeted an organisation, using web shells and compromised credentials to exfiltrate sensitive data. April 2022: Compromised a remote access login portal, exfiltrating hundreds of username-password pairs and MFA codes. 🔗 Read the full advisory: https://lnkd.in/gkUVueDj Ensure your organisation is prepared—regularly update and patch systems, monitor network traffic, educate employees on cybersecurity best practices, and some threat intelligence wouldn't go astray! #CyberSecurity #ThreatIntelligence #APT40 #CyberThreats #NationStateActors #ArachneDigital #CyberSafety

1

Threat hunters at Huntress uncovered a 4-year-long intrusion targeting a Vietnamese human rights defender, likely linked to APT32/OceanLotus. Using Huntress’ Managed EDR, our team tracked anomalies and persistence mechanisms overlooked by traditional defenses, highlighting the persistence of espionage-motivated attackers. Hear more from Jai Minton and Craig S. on finding this threat: https://lnkd.in/e4ynezVF

47

Episode 11: Managing Insider Threats in the Australian Defence Industry – DISP and the Role of Managed Security Services. Join us for an in-depth discussion on insider threat management. https://lnkd.in/geKZMnVc

1

1 Comment