Sajeeb Lohani

Cyber Security Threats to the Australian Education Sector: Insights from Penetration Testing (2022-2024) The document highlights the significant cybersecurity vulnerabilities faced by the Australian education sector due to rapid digital transformation and reliance on cloud services. ​ Key findings from penetration tests conducted between 2022 and 2024 reveal critical weaknesses in internal networks, external applications, and cloud infrastructures, exposing institutions to data breaches, operational disruptions, financial losses, and reputational damage. Key Findings: * Internal Vulnerabilities: - Outdated protocols and weak security practices. - Use of end-of-life operating systems like Windows Server 2012. - Lack of LDAP signing, making systems vulnerable to man-in-the-middle attacks. * External Vulnerabilities: - Weak password management on external portals. - Use of outdated web components and libraries. - Directory indexing enabled, exposing sensitive information. - Weak SSL/TLS protocols and missing security headers. * Cloud Vulnerabilities: - Weak password management and lack of Multi-Factor Authentication (MFA). - Missing conditional access policies. - Unmanaged accounts and devices. - Excessive user permissions. Source: https://lnkd.in/g7b-Xqmi Company: Spartans Sec - https://lnkd.in/gqatya9t #SpartansSec #CyberSecurity #EducationSector #DataProtection #MFA #CloudSecurity #PenetrationTesting

14

1 Comment

📢 Exciting Announcement! 🔒 Seminar on Information Security Standards and Operations 🏫 Venue: Whitecliffe Wellington Campus - (Level-3 Ranchhode Tower, Lambton Quay Wellington, New Zealand) 📅 Date: 11-05-2024 (Saturday) 🕥 Time: 10:30 AM Join me for a comprehensive seminar delving into the realms of Information Security Standards and Operations. We'll explore the various phases of planning, designing, and implementing cyber defense policies tailored specifically for financial organizations. In this era of #AI & #cyberSecurity understanding both internal and external threats is paramount. Let's navigate through strategies to safeguard our organizations effectively. Looking forward to engaging discussions and valuable insights! #Standards #Policies #Assurance #Compliance #Governance #RiskAssessment #RiskManagement #Defense #CyberFrameWork #Ransom

40

8 Comments

✅ Monash University authorised as a CVE Numbering Authority (CNA) 🔐 MON-CSIRT (Monash University Computer Security Incident Response Team) has been announced as a Partner in the CVE Program by MITRE. 🔐 MON-CSIRT is only the third organisation in Australia to be authorised in the Researcher category and the first university globally. 🔐 The scope of the MON-CSIRT partnership allows previously undiscovered vulnerabilities to be triaged and assign CVE IDs and corresponding CVE Records published. We view this as a crucial step in continuing to strengthen both the Monash ecosystem and the wider global digital landscape. This partnership enables us to assist vendors in triaging, categorising, and communicating vulnerabilities, ensuring that customers and affected parties are promptly informed of their exposure and can respond more quickly. 🤷 Curious what the CVE Program is? 👉 The Common Vulnerabilities and Exposures (CVE) Program a global initiative to identify, define and catalogue cyber security vulnerabilities. The CVE Program is managed by the not-for-profit MITRE Corporation in collaboration with international cyber security communities. 👉 Authorised partners publish CVE Records to communicate consistent descriptions of vulnerabilities. Each vulnerability is assigned a unique ID (e.g. CVE-2024-12345) that provides a standard way to refer to it. 👉 Information technology and cyber security professionals use CVE Records to ensure they are discussing the same issue, and to coordinate their efforts to prioritise and address the vulnerabilities. More info here: https://lnkd.in/gQgMHxWn 👏 A big thankyou to Nathira Rajagopal and K S. for their passion and hard work to get this initiative off the ground. #CVE #CNA #vulnerabilitymanagement #cyber #ciso #mitre

192

10 Comments

👉 GHD analysis states, about a quarter of global water systems will likely have experienced a cybersecurity breach by 2025 👉 Water systems face the highest cyber risk from insiders, rival governments, and organised crime groups 👉 100% increase in malicious techniques used by cyber- attackers to take control of a program or operating system in 2022 compared to 2021 👉 38% of water utilities in the US only allocate 1% of their budget to cybersecurity. 👉 Under America’s Water Infrastructure Act of 2018 (AWIA), EPA has enacted legislation that requires water system operators to address cybersecurity as part of their emergency response plans. Great article by GHD exploring the challenges of cybersecurity in water and highlights the steps that can be taken to enhance security and resilience. credits - Sunil Sharma Mike Tocher Aijaz Hussain Shaik Anne-Marie Kirkman

6

The Australian Signals Directorate has released a detailed advisory regarding APT40 (aka Leviathan, Kryptonite Panda, TEMP.Periscope, Bronze Mohawk) who has been the focus of several previous advisories and investigations. The title of the report, "APT40 Advisory: PRC MSS tradecraft in action," leaves no doubt that the Chinese Communist Party is being called out as the attacker. (MITRE refers to this team as Leviathan or G0065, see: https://lnkd.in/eVsbuA6h ) Australian Cyber Security Centre advisory: https://lnkd.in/eT2375Dh They are joined in the advisory by the US (CISA, NSA, FBI), the UK (National Cyber Security Centre/GCHQ), the Canadians (Candian Centre for Cyber Security), the Germans (Bundesnachrichtendienst / Bundesamt fur Verfassungsschutz), the Koreans (National Intelligence Servie and the National Cyber Security Center) and the Japanese (National Police Agency.) CISA did a deep-dive on APT40 when four of their members were indicted by the FBI back in 2021: ZHU Yunmin 朱允敏 (STC Codes: 2612/0336/2404) Alias: Zhu Rong WU Shurong 吴淑荣 (STC Codes: 0702/3219/2837) Aliases: goodperson, ha0r3n, Shi Lei DING Xiaoyang 丁晓阳 (STC Codes: 0002/2556/7122) Aliases: Ding Hao, Manager Chen CHENG Qingmin 程庆民 (STC Codes: 4453/1987/3046) Alias: Manager Cheng CISA's 2021 report, "Tactics, Techniques and Procedures of Indicted APT40 Actors Associated with China's MSS Hainan State Security Department," is here: https://lnkd.in/ezRtCWSy The Indictment against the four, with great details about their front company, Hainan Xiandun Technology Development, goes into great details about the types of intellectual property and confidential business information the team had targeted up until that point. They attacked businesses in the USA, Austria, Cambodia, Canada, Germany, Indonesia, Malaysia, Norway, Saudi Arabia, South Africa, Switzerland, and the UK. A copy of the indictment can be found here: https://lnkd.in/ec-773ZT (Although we reported it at the time and since, both to GitHub, Microsoft Security, and the FBI Cyber Division, Wu Shurong's Github repository is still online, showing that he was a fan of Metasploit: https://lnkd.in/e8Np4hnF ) CISA, the Cybersecurity & Infrastructure Security Agency, has a great resource of China-as-cyber-aggressor resources in their index of "China State-Sponsored Cyber Threat: Advisories" (22 advisories since 2017) which can be found here: https://lnkd.in/enm3yrZ9 (A similar resource exists for Russian state-sponsored cyber attack advisories: https://lnkd.in/enm3yrZ9 ) #China #APT40 #HainanXiandun

12

Penetration Tester to Application Security Engineer Remote (Must be in Australia) $150k package Not many jobs come around where you can get employed for your current skills and get training on the job to transition to your next role. Are you ready to turn from a breaker to a builder? Our customer believes software should be the status quo. Their aim is to fundamentally change the approach to secure software, ensuring it influences every aspect of software engineering and customer experience. If this resonates with you, this could be the transition you’ve been looking for. Maybe you’re frustrated with finding bugs but not solving the real issues. And you like the idea of getting closer to the root cause. This is a mid-level role, meaning you’ll be dedicated to a customer for a period of time, predominantly focused on testing web apps. You’ll need to have experience working as a pentester. It wouldn’t be suitable for someone who believes engineers are the problem; instead, they are looking for someone that wants to support, educate, and influence. You need experience in coding/scripting. You should be able to write and understand code in any language. You can be taught manual code review and help build your skills in the application security industry. You’ll work on solving problems and improving secure software, influencing software engineering functions and customer experience. As part of the interview process, you will take part in a coding challenge. It’s not about syntax but about thinking like a programmer. Tasks could include reversing a linked list or building an algorithm to count a grid of emotions. The goal is to demonstrate your ability to think and write software. The other day I posted about this role and highlighted that it was in Australia and did not offer sponsorship. 99% of people who reached out to me were from overseas, unfortunately, people that the customer can’t hire. For clarification, you can’t be considered for this role if you aren’t in Australia and don’t have working rights; you won’t be eligible. I had several people say something like, “Don’t worry about the visa, I can sort it, just get me an offer.” Sorry, but visas in Australia don’t work like that. If you like the idea of switching from breaker to builder, reach out to Yas Bourne for more info.

76

3 Comments

BrisSec Workshop I look forward to running the hands-on CSIO-CFO Partnership workshop with Jay Hira this Friday at the Australian Information Security Association (AISA) BrisSec. We will run through two cyber risk management scenarios: 1. Migration to segmented network architecture to limit the blast radius from lateral attacks during a cyber incident 2. Enforcing MFA Through a role-play simulation with the delegates, we highlight how to apply the Reasonable Security paradigm to get buy-in from the CFO. The business challenge is to build a case to justify the inevitable business disruption from this transition. These days, the infrastructure, internal firewall and MFA are already in place. However, migrating current business processes to take advantage of these security capabilities could take some convincing. The question is not whether these security controls are useful. The need for these controls is understood. The question is whether the process fiction and operational risk arising from this migration are Reasonable. To take advantage of segment network architecture, some servers, data sources and users have to be relocated to a different network segment, requiring changing their IP address. The impact is much more than the reconfiguration effort to update the IP address. The concern is not knowing which applications or firewall rules have hardcoded these legacy IP addresses and addresses until user complaints of application flow disruption. Similarly, enforcing MFA across application silos can also cause unexpected disruption. Many legacy applications leverage terminals (SSH, telnet) for data access instead of APIs and might not be able to cope with the MFA challenge. To add insult to injury, many of these are quarterly and annual reporting applications that do not run for at least a few months. The migration would have been very entrenched by then, which made a rollback to be a very costly option, necessitating some manual workaround. Please join us in the workshop.

25

2 Comments

DID YOU GET BSOD TOO? #CROWDSTRIKE It's not just you! Laptop blue screen errors.. Due to a recent end point protection update by Crowdstrike, a number of laptops are suffering a bluescreen of death error and are unable to successfully reboot. This issue has impacted a significant number of organisations within Australia. Crowdstrike is currently investigating the issue as a top priority. Workaround Steps: 1. Boot Windows into Safe Mode or the Windows Recovery Environment 2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory 3. Locate the file matching “C-00000291*.sys”, and delete it. 4. Boot the host normally.

9

💥 Did you know the Australian Government has proposed a comprehensive Scams Prevention Framework (𝐒𝐏𝐅) imposing broad obligations on businesses to protect consumers from being scammed, with tough consequences for non-compliance. 💥 𝐒𝐮𝐦𝐦𝐚𝐫𝐲 𝐨𝐟 𝐰𝐡𝐚𝐭'𝐬 𝐡𝐚𝐩𝐩𝐞𝐧𝐢𝐧𝐠 The Government has initially proposed to designate telco providers, banks and digital platform providers, and will consider other sectors as the regime develops. So if you are a business providing services in any of these regulated sectors, you will need to: ➡️ Proactively take reasonable steps to detect, prevent and disrupt scams ➡️ Comply with additional steps that may be required under sector specific codes to be developed later ➡️ Report to the ACCC about actionable scam intelligence that you have and scam disruption actions you have taken ➡️ Implement detailed governance policies in relation to scams and comply with related reporting requirements. This includes filing an annual compliance certificate in relation to policies and procedures signed by a senior officer   ➡️ Establish internal dispute resolution processes and join an external dispute resolution (EDR) scheme to resolve customer complaints for scams. The Government has proposed that the Australian Financial Complaints Authority (AFCA) to oversee this. 𝐅𝐨𝐫 𝐭𝐞𝐥𝐜𝐨𝐬 𝐚𝐧𝐝 𝐝𝐢𝐠𝐢𝐭𝐚𝐥 𝐩𝐥𝐚𝐭𝐟𝐨𝐫𝐦 𝐩𝐫𝐨𝐯𝐢𝐝𝐞𝐫𝐬 𝐭𝐡𝐢𝐬 𝐢𝐬 𝐚 𝐬𝐢𝐠𝐧𝐢𝐟𝐢𝐜𝐚𝐧𝐭 𝐧𝐞𝐰 𝐫𝐞𝐪𝐮𝐢𝐫𝐞𝐦𝐞𝐧𝐭.   𝐖𝐡𝐚𝐭 𝐢𝐟 𝐲𝐨𝐮 𝐝𝐨𝐧'𝐭 𝐜𝐨𝐦𝐩𝐥𝐲? You may face significant civil penalties! Similar to the Data Privacy reforms, civil penalties are proposed to apply on a two-tier basis.  💥 The maximum penalty for more serious contraventions starts at $50 million. 💥 The maximum penalty for lesser breaches starts at $10 million. 𝐌𝐲 𝐓𝐡𝐨𝐮𝐠𝐡𝐭𝐬 It's a shame that this proposal of civil penalties does not include Political Parties! I don't know about you but I'm annoyed whenever I receive an SMS message near voting time from a political party. Did I opt in to receive these, NO. Can I do anything about it, other than block them on my phone apparently not! They can allegedly generate and cycle through random mobile phone numbers to forward their political message to who ever they feel like! 👹 #Cybersecurity #InformationSecurity #Australia

4

Privacy and how organisations handle private information affects all of us at work and in our daily lives. Good privacy management goes beyond compliance and risk; it is the social license organisations operate under and underpins the trust held with customers and community. The leaders in privacy should be celebrated. Limited tickets for the Annual Privacy by Design Awards event are available at the link below. Get in touch to speak with our Privacy team about privacy best practice. David Batch CyberCX #privacy

14

Lookout! The NCSC has issued a warning about a multi-stage phishing campaign affecting New Zealand organizations since at least 05 June 2024. Compromised user accounts are being used to send phishing emails via Microsoft OneDrive/SharePoint sharing invitations, potentially from trusted contacts, redirecting users to malicious websites to harvest credentials. Organizations are advised to stay vigilant, monitor for suspicious activity, and educate staff on being cautious with sharing links, particularly from external domains. It's recommended to implement additional security measures to counter this threat. https://lnkd.in/g8MH_fRr #CyberSecurity #Phishing #NCSC #SecurityAwareness

21

1 Comment

Supporting Career Villages at Conferences in 2024! I am organising multiple career villages at conferences in Australia, BSides Canberra, BSides Melbourne, and Australian Information Security Association (AISA) CyberCon (Melbourne) this year. I am looking for industry professionals who want to share their knowledge, experience, and advice with others. Ideas for talks: 👉 Breaking down what you do in your job. 👉 Share your unusual journey into the industry. (help inspire others) 👉 Hiring managers advising on what you look out for when hiring. 👉 CISO sharing advice for aspiring CISOs. I am looking for people to join in on some panel sessions: 👉 Certifications 👉 Neurodiversity in cybersecurity 👉 Student to cybersecurity professional We will also seek volunteers to do resume reviews/ mock interviews. There are formal CFPs for BSides Canberra and BSides Melbourne, which you will need to complete, but if you're interested in helping out and don't know where to start/ want to register your interest, fill out the Google Form in the comments, and I can work with you on your submission. We haven't seen much in the way of gender diversity in submissions so far. It sounds corny, but be the change you want to see.

82

13 Comments

Read all about our VP of SA Jordan Camba talk about his experience as a Detection Engineer and Threat Hunter. "As a Detection Engineer and Threat Hunter, my passion for MITRE ATT&CK is boundless. It's an essential framework for assessing, measuring, and communicating the breadth and depth of our detection capabilities. However, the utility of MITRE ATT&CK is often compromised by inaccuracies and a lack of precision in how some organizations apply mappings. This can lead to a distorted understanding of our security posture, ultimately misallocating resources and weakening our defenses." Read more in his latest blog here: https://lnkd.in/e7CzWazn Why Precision and Accuracy Matter in MITRE ATT&CK Mappings - - Accuracy ensures that the tactics, techniques, and sub-techniques correctly represent the detected activities, providing a clear and reliable view of our security landscape. Inaccurate mappings can lead to confusion and misplaced focus, undermining the integrity of threat detection efforts. - - Precision, on the other hand, involves the granularity of these mappings. It's about capturing the specific details that make detections actionable. A lack of precision can leave us with a general, but not necessarily useful, understanding of potential threats. Here are some common mistakes: ❌ Mapping without sub-techniques ❌ Overlapping techniques ❌ Incorrect technique assignments How to fix these mistakes? Follow a few simple rules: 1. Keep it simple - Focus on what is immediately observable and mapto Sub-Techniques where possible. 2. Don't be greedy - Not all techniques can be detected with logs and telemetry and not every detection needs a Technique/Sub-Technique. 3. Become a better threat researcher - Improve your ability to find, interpret, and understand research on malware, tools, techniques, and vulnerabilities and instantiate a lab environment. At SnapAttack, we are committed to refining the quality of these mappings. Our platform offers: ✅ Pre-Written Tested Detections: A growing library of Sigma rules tested in our Sandbox sessions, with accurate ATT&CK mappings. ✅ MITRE ATT&CK Prioritization & Coverage Reporting: Using top-tier Threat Intelligence, we prioritize techniques and sub-techniques according to industry and regional relevance. ✅ Research Sandbox: A tool for hands-on-keyboard research to enhance threat detection capabilities. #CyberSecurity #ThreatDetection #MITREATTACK #SnapAttack #DetectionEngineering #ThreatHunting #CyberDefense #SecurityPosture #AccuracyAndPrecision

16

BSides Canberra Career Village - Lynore Close presenting "From Fields to Firewalls" Ever wondered how someone from a completely different background makes it into cybersecurity? Let me share my story. As a First Nations woman who worked various jobs like fruit picking and delivery driving, and didn’t finish high school, my path to a cybersecurity career might surprise you. I found my way into this field without a technology degree or the typical background. In this presentation, I propose to take the audience through my journey—how a love for air conditioning, taking chances on new opportunities, embracing a growth mindset, and building resilience helped me grow in this field to cultivate my own version of success. I will also highlight alternative pathways to get into tech and why diversity is crucial for innovation and security. Whether attendees are just starting out or looking to pivot into cybersecurity, this session aims to provide the humorous insights, practical advice and hopefully a wee bit of inspiration needed to carve their own paths. 14:30 26th September

29

4 Comments

The Australian Signals Directorate’s (#ASD) Australian Cyber Security Centre (#ACSC), has just released an advisory report on #APT40 activity, including #IOC and #TTP and mitigation strategies. APT40 is a Chinese threat group responsible for many #cyberespionage campaigns in the region and globally. This is an important read if you work in #cybersecurity and #DFIR. #infosec #CISO #malware #threatintelligence https://lnkd.in/gvCFpM5R

61

I look forward to discussing how to design and run a TTX in Canberra for SANS Community Night! Control 1 of the SANS ICS Five Critical Controls is to have a dedicated ICS Incident Response Plan. I'll discuss how to exercise that plan to ensure it's fit for purpose and share experiences from many TTXs I have facilitated. If you're coming from an IT background, the presentation also applies to you. I look forward to seeing you there! #sans #sansics #icscybersecurity #otcybersecurity

32

4 Comments

The latest NDBR (Jan - June 2024) report from the Office of the Australian Information Commissioner is now out! "After 6 years of the NDB scheme, we expect entities to comply with their obligations. It is no longer acceptable for privacy to be an afterthought; entities need to be taking a privacy-centric approach in everything they do." - Carly Kind 𝐒𝐮𝐦𝐦𝐚𝐫𝐲 𝐒𝐭𝐚𝐭𝐬 ✅ January to June 2024 - 527 Notifications. This is the highest number of notifications received since July to December 2020 and an increase of 9% compared to the previous 6 months. ✅ One incident reported affected over 10 million Australians. ✅ 38% of all data breaches resulted from cyber security incidents. Phishing and Ransomware make up the top two sources of cyber incidents ✅ The Australian Government continued to be in the top 5 sectors by notifications. ✅ Of all sectors, the Australian Government reported the most data breaches involving social engineering or impersonation (42% of all breaches of this kind). ✅ Of the top 5 sectors, the Australian Government continued to have the largest proportion (87%) of notifications where the agency identified the incident over 30 days after it occurred. ✅ The Australian Government also continued to have the largest proportion (78%) of notifications made to the OAIC more than 30 days after the agency become aware of the incident. ✅ After malicious criminal attacks, human error accounted for 30% of all data breaches between Jan - Jul 2024. #Cybersecurity #Databreach #Australia https://lnkd.in/eDaqxFJd

4

🇦🇺 𝐈𝐦𝐩𝐫𝐨𝐯𝐢𝐧𝐠 𝐀𝐮𝐬𝐭𝐫𝐚𝐥𝐢𝐚’𝐬 𝐜𝐲𝐛𝐞𝐫 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐜𝐨𝐧𝐬𝐢𝐬𝐭𝐞𝐧𝐭 𝐰𝐢𝐭𝐡 𝐢𝐭𝐬 2023-2030 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐒𝐭𝐫𝐚𝐭𝐞𝐠𝐲 The Government has released a legislative package known as the 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐁𝐢𝐥𝐥 2024 that implements a range of initiatives aimed at improving cyber security. These initiatives include: ➡️ Mandatory standards for improving the security of Internet of Things (𝐈𝐨𝐓) devices ➡️ Australian businesses will have to report ransomware payments within 72 hours of being made ➡️ Establishing a cyber review board to investigate serious cyber security incidents ➡️ Making changes to security of critical infrastructure legislation relating to data storage systems ➡️ Establishing a National Cyber Security Coordinator 💥 These initiatives are still undergoing review but if passed before the end of the year will require organisations to act and start focussing a lot more on cyber! 💥 #Cybersecurity #Informationsecurity #Australia

6

I am hearing on the vine that this campaign is having significant success in a number of sectors. Make sure your staff are aware. Update your response plans. Do you have a playbook for stolen session cookies? Update your systems with known IOCs. Comment below if you have additional suggestions or tips.

36

3 Comments