Jeremy Kirk

ICYMI ~ The Australian Department of Home Affairs' Protective Security Policy Framework (PSPF) Release 2024 introduces updated security policies, including third-party risk, foreign interference, and the security of operational and emerging technologies. The annual release cycle aims to "keep pace with new and emerging security threats." Key changes in PSPF Release 2024 include: • Expansion of the protective security domains to include separate domains for risk and technology • Incorporating requirements to address contemporary protective security threats including supply chain security, third-party risk management, foreign interference and security of operational or emerging technology • Improving the accessibility and structure of the PSPF • Providing clear guidance on areas with low maturity or ambiguity within the PSPF • Shifting from a maturity to compliance reporting model to provide more accurate reporting data and enable more valuable analysis of security vulnerabilities. The Australian Department of Home Affairs is also establishing a PSPF assurance function to assist government entities to accurately report their security posture, identify vulnerabilities and implement a process of continuous improvement to uplift the security maturity of the Australian Government. https://lnkd.in/gfhdVKje

38

1 Comment

Unveiling the Power of OSINT: Harnessing Online Investigation for Modern Challenges Online Investigator👇 https://lnkd.in/g_HmeAUS https://lnkd.in/gHBP2VYR In an era dominated by digital footprints and interconnected data networks, the art of investigation has evolved significantly. Open Source Intelligence (OSINT) has emerged as a pivotal tool in the arsenal of investigators, journalists, and analysts alike. Leveraging publicly available information from various online sources, OSINT enables a deeper understanding of individuals, organizations, and events. Let's explore how OSINT transforms online investigation and its applications across diverse domains. #Understanding_OSINT OSINT encompasses the collection, analysis, and exploitation of publicly available information from sources such as social media, websites, news articles, public records, and more. Unlike traditional investigative methods, which may rely on closed sources or direct inquiries, OSINT capitalizes on the vast expanse of data freely accessible on the internet. #Tools_and_Techniques Effective OSINT requires proficiency in using specialized tools and techniques tailored for different purposes: 1. Social Media Analysis: Platforms like Twitter, Facebook, LinkedIn, and Instagram yield valuable insights through user-generated content, location tags, and network connections. 2. Metadata Examination: Photos and documents often contain hidden metadata, providing details such as timestamps, device information, and geolocation data. 3. Web Scraping: Automated tools can extract data from websites, forums, and databases, enabling comprehensive analysis of trends or information dissemination. 4. Public Records and Databases: Government archives, court records, property listings, and business registries offer structured data critical for verifying identities or tracing financial activities. 5. Advanced Search Techniques: Boolean operators, search engine filters, and domain-specific queries enhance precision in retrieving relevant information. #Applications_in_Investigations OSINT finds extensive application across diverse fields: Law Enforcement: Investigating crimes, identifying suspects, and monitoring threats through social media analysis and digital forensics. Corporate Intelligence: Assessing competitors, evaluating market trends, and mitigating risks associated with business transactions. Journalism: Verifying sources, uncovering stories, and contextualizing events by analyzing publicly available data. Cyber Security: Monitoring digital footprints, identifying vulnerabilities, and preemptively countering cyber threats. #Ethical_Considerations_and_Challenges Despite its utility, OSINT raises ethical considerations: Privacy Concerns: Balancing the right to privacy with the need for transparency and accountability. Data Reliability: Assessing the accuracy and authenticity of information obtained from unverified sources.

1

The Australian Signals Directorate has released a detailed advisory regarding APT40 (aka Leviathan, Kryptonite Panda, TEMP.Periscope, Bronze Mohawk) who has been the focus of several previous advisories and investigations. The title of the report, "APT40 Advisory: PRC MSS tradecraft in action," leaves no doubt that the Chinese Communist Party is being called out as the attacker. (MITRE refers to this team as Leviathan or G0065, see: https://lnkd.in/eVsbuA6h ) Australian Cyber Security Centre advisory: https://lnkd.in/eT2375Dh They are joined in the advisory by the US (CISA, NSA, FBI), the UK (National Cyber Security Centre/GCHQ), the Canadians (Candian Centre for Cyber Security), the Germans (Bundesnachrichtendienst / Bundesamt fur Verfassungsschutz), the Koreans (National Intelligence Servie and the National Cyber Security Center) and the Japanese (National Police Agency.) CISA did a deep-dive on APT40 when four of their members were indicted by the FBI back in 2021: ZHU Yunmin 朱允敏 (STC Codes: 2612/0336/2404) Alias: Zhu Rong WU Shurong 吴淑荣 (STC Codes: 0702/3219/2837) Aliases: goodperson, ha0r3n, Shi Lei DING Xiaoyang 丁晓阳 (STC Codes: 0002/2556/7122) Aliases: Ding Hao, Manager Chen CHENG Qingmin 程庆民 (STC Codes: 4453/1987/3046) Alias: Manager Cheng CISA's 2021 report, "Tactics, Techniques and Procedures of Indicted APT40 Actors Associated with China's MSS Hainan State Security Department," is here: https://lnkd.in/ezRtCWSy The Indictment against the four, with great details about their front company, Hainan Xiandun Technology Development, goes into great details about the types of intellectual property and confidential business information the team had targeted up until that point. They attacked businesses in the USA, Austria, Cambodia, Canada, Germany, Indonesia, Malaysia, Norway, Saudi Arabia, South Africa, Switzerland, and the UK. A copy of the indictment can be found here: https://lnkd.in/ec-773ZT (Although we reported it at the time and since, both to GitHub, Microsoft Security, and the FBI Cyber Division, Wu Shurong's Github repository is still online, showing that he was a fan of Metasploit: https://lnkd.in/e8Np4hnF ) CISA, the Cybersecurity & Infrastructure Security Agency, has a great resource of China-as-cyber-aggressor resources in their index of "China State-Sponsored Cyber Threat: Advisories" (22 advisories since 2017) which can be found here: https://lnkd.in/enm3yrZ9 (A similar resource exists for Russian state-sponsored cyber attack advisories: https://lnkd.in/enm3yrZ9 ) #China #APT40 #HainanXiandun

12

Vintage OSINT tool : How it started - How its going https://lnkd.in/eFEdSdtU

19

12 Comments

People generally do not understand the difference between #SecurityExpectations and #SecurityCapabilities The product you buy, the project you deploy and team you have is only part of a security expectation. If you are not testing, you can’t call this Capabilities. When you realise this you understand that spending $$$ on tools, services and people without the appropriate tactical and operational strategy will not make you capable to protect yourself, will only make you look dumb. Focus on OKR management rather then KPIs. Performance Output without the right Objective Outcome is just waist of resources.

16

2 Comments

This post has nothing to do with breakdancing...and everything to do with clickbait. 🥁 Announcing New Blog: Investigating Spam and Clickbait Networks on Social Media! 🥁 In preparation for the Australian OSINT Symposium Training Day on September 10th. 📅, Jemma Ward, one OSINT Combine's senior training team, has just published a must-read blog! In her blog, Jemma delves into the murky world of spam networks on Facebook, revealing how these seemingly innocuous pages are being used to generate revenue, manipulate audiences, and spread harmful narratives. She also uncovers how AI-generated content is playing a crucial role in expanding the reach of these disinformation campaigns. Whether you're an OSINT professional or just curious about how disinformation spreads online, this blog is packed with valuable insights and practical tradecraft tips. 🔍 Read the full blog here: https://lnkd.in/e6dJxQpB 🎟 If you'd like to learn more from Jemma and OSINT Combine's other trainers at the Virtual Training Day, purchase your ticket here: https://lnkd.in/eAz-sn3K Photo Credit: X/Twitter #OSINT #Disinformation #AI #breakdancingbreaksinternet #Clickbait #SpamNetworks #AOS2024 #learn #opensourceintelligence #OSINTcommunity #RayGun

30

4 Comments

📢 New Cybersecurity Audit for Commonwealth Agencies In response to rising concerns about foreign interference, Home Affairs Secretary Stephanie Foster has issued a series of formal directions mandating a comprehensive audit of all internet-facing technology used by Commonwealth agencies. This initiative aims to identify and mitigate potential risks across nearly 200 federal government entities and companies. Key directives include: 🔒Mandatory sharing of cyber threat information with the Australian Signals Directorate. 🛡️Identification and management of Foreign Ownership, Control, or Influence (FOCI) risks in technology procurement and maintenance. 📊A stocktake of all internet-facing systems and services. 📝Development of a technology security risk management plan for these assets. These measures mark only the second use of binding powers under the Protective Service Policy Framework, the first being last year's TikTok ban from Commonwealth devices. On the same day, Home Affairs Minister Clare O'Neil unveiled additional measures to counter foreign interference in the broader Australian community. Sarah Sloan from Palo Alto Networks highlights the importance of this step towards Australia's goal of becoming the world's most secure nation by 2030. Given the rapid digital expansion, she emphasizes the critical need for robust Attack Surface Management (ASM). The funding details for these activities remain undisclosed, but the directives have been positively received by leading cybersecurity figures. This comprehensive approach, a testament to the federal government's unwavering commitment, underscores our collective goal of safeguarding national security and vital data. https://lnkd.in/gRvtTWTU #CyberSecurity #NationalSecurity #Australia #TechnologyAudit #ForeignInterference

5

U.S. agencies have issued a joint advisory highlighting attempts by the Democratic People’s Republic of Korea (DPRK, a.k.a. North Korea) Kimsuky cyber actors to exploit improperly configured #DNS Domain-based Message Authentication, Reporting and Conformance (DMARC) record policies to conceal #socialengineering attempts. Without properly configured #DMARC policies, #malicious #cyber actors can send spoofed emails as if they came from a legitimate domain’s email exchange. “The North Korean cyber actors have conducted spearphishing campaigns posing as legitimate journalists, academics, or other experts in East Asian affairs with credible links to North Korean policy circles,” the Federal Bureau of Investigation (FBI), the U.S. Department of State and the National Security Agency (NSA) detailed in a Thursday advisory. “North Korea leverages these #spearphishing campaigns to collect intelligence on #geopolitical events, adversary foreign policy strategies, and any information affecting North Korean interests by gaining illicit access to targets’ private documents, research, and #communications.” https://lnkd.in/gNwKbWBu

16

Recorded Future’s Insikt Group identified #cyberespionage activity predominantly targeting government, education, technology, and diplomatic organizations in Taiwan, conducted by a likely Chinese state-sponsored threat activity group tracked #RedJuliett. The data also identified that between November 2023 and April 2024, these hackers exploited known vulnerabilities in network edge devices such as firewalls, virtual private networks (VPNs), and load balancers for #initialaccess. “RedJuliett’s focus on targeting Taiwanese entities aligns with the group’s past activity,” Recorded Future identified. “Insikt Group also observed RedJuliett expand its operations to compromise organizations in Hong Kong, Malaysia, Laos, South Korea, the United States, Djibouti, Kenya, and Rwanda.” It added that RedJuliett compromised 24 organizations, including government organizations in Taiwan, Laos, Kenya, and Rwanda. The group also conducted network reconnaissance or attempted exploitation against over 70 academic, government, think tank, and technology organizations in Taiwan, as well as multiple de facto embassies operating on the island. #Cybersecurity #Cyber #Security https://lnkd.in/gU-bPC_6

4

I frequently receive questions like, "Where can I find more books about insider threats?" To help, I’ve started compiling a list of relevant books, and you can find them on the Australian Institute of Insider Threats - https://lnkd.in/gM-3hsPz If you think that I have missed a book that should be on the list, please let me know. #insiderthreats #riskmanagement #governance #compliance #espionage #counterintelligence #fraud #humanbehaviour

1

Looking to find topical books on insider threats? I have created a list of around 28 books for your perusal published on the Australian Institute of Insider Threats. Let me know if I missed any? #toxicworkplace #employeeengagement #securitybooks #insiderrisk

1

New Post: #CISA and @FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory #Traversal Vulnerabilities - https://lnkd.in/dAir6seU CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities 05/02/2024 02:00 PM EDT Today, CISA and the Federal Bureau of Investigation (FBI) released a joint Secure by Design Alert, Eliminating Directory Traversal Vulnerabilities in Software. This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708, CVE-2024-20345) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector. Additionally, this Alert highlights the prevalence, and continued threat actor exploitation of, directory traversal defects. Currently, CISA has listed 55 directory traversal vulnerabilities in our Known Exploited Vulnerabilities (KEV) catalog. Approaches to avoid directory traversal vulnerabilities are known, yet threat actors continue to exploit these vulnerabilities which have impacted the operation of critical services, including hospital and school operations. CISA and the FBI urge software manufacturer executives to require their organizations to conduct formal testing to determine their products’ susceptibility to directory traversal vulnerabilities. For more information on recommended principles and best practices to achieve this goal, visit CISA’s Secure by Design page. To catch up on the publications in this series, visit Secure by Design Alerts. Robert Williams#News247WorldPress

1

The SOCI Act mandates critical infrastructure operators to invest in cybersecurity. The Act incentivizes organizations to enhance their cyber defenses by imposing specific obligations and penalties for non-compliance. Its alignment with the NIST CSF’s focus on proactive risk management can drive continuous improvement in cybersecurity practices for Australian enterprises. The SOCI Act also emphasizes the importance of collaboration between government and industry in protecting critical infrastructure. The Act fosters a culture of shared responsibility by requiring information sharing and cooperation with government authorities. This aligns with the NIST CSF's partnership and information-sharing principles, which are essential for effective cybersecurity. The NIST Cybersecurity Framework and Australia’s Security of Critical Infrastructure Act offer complementary approaches to safeguarding critical infrastructure. By working in tandem, these frameworks can help organizations build a robust cybersecurity posture, reduce the risk of cyberattacks, and protect the nation’s critical assets. DVMS Institute

4

Cyber security, governance, identity and data classification are working together. Often used to reach compliance, proper governance is a key asset to bring visiblity in an organization network. "Australian Defence Force Private and Husband Charged with Espionage for Russia" Visibility brings audit capability. Know what you have, so as incident impact can actually be properly analyzed. Aside of the automated data classification, the inventory capability is key. #cybersecurity #governance #audit https://lnkd.in/gs_uKk23

4

1 Comment