Robson Minjoro

Recommended Mitigations 1) Boot Windows into Safe Mode 2) Navigate to the directory C:\Windows\System32\drivers\CrowdStrike 3) Locate the file matching C-00000291*.sys and delete it 4) Boot the host normally Note: You can also boot in Windows Recovery Environment (WinRE) #crowdstrikefriday

5

Sharing Canada's OT Cybersecurity Resources Protecting our critical infrastructure is paramount in today's digital age. Canada has taken great strides in providing resources to organizations to effectively respond to cyber incidents, particularly those targeting Operational Technology (OT) systems. In this post, I'd like to share a valuable document from Public Safety Canada: "Developing an Operational Technology and Information Technology Incident Response Plan" ([Public Safety Canada - Developing an Operational Technology and Information Technology Incident Response Plan]). This comprehensive guide offers a roadmap for organizations of all sizes to create a robust OT cybersecurity incident response plan (CIRP). It outlines key steps such as: 1. Understanding IT-OT Convergence: The document acknowledges the growing connection between IT and OT systems and emphasizes the need for a joint response plan. 2. Risk Assessment: It highlights the importance of identifying critical assets and potential vulnerabilities in both IT and OT environments. 3. Cybersecurity Incident Response Team (CSIRT) Formation: The guide provides insights on establishing a dedicated CSIRT to manage and coordinate incident response activities. 4. Incident Handling Process: A structured approach to incident detection, containment, eradication, recovery, and post-incident review is outlined. By following these guidelines and leveraging the resources in this document, organizations can significantly enhance their preparedness to counter cyber threats targeting their OT systems. Beyond Public Safety Canada's Guide Public Safety Canada's document is an excellent starting point. Here are some additional resources to explore: The Communications Security Establishment (CSE) offers a wealth of cybersecurity information and tools on their website: Communications Security Establishment (CSE) website: https://lnkd.in/gm9FcAFS Cybersecure Canada, a Government of Canada initiative, provides resources and certification programs to help organizations improve their cybersecurity posture: Cybersecure Canada website: https://lnkd.in/gTgvYhxi https://lnkd.in/gr2N8UEC #OTCIRP #OTCYBERSECURITY

11

With all of the corporate domain usernames and passwords from large Canadian companies that I have seen in #darkweb #infostealer logs recently, it is clear that browser governance is still lacking in many organizations. You've put protection in place for when they are connected through your firewall, but what about when they are at home or travelling and accessing websites out in the wild? Advanced Browser Security allows you to protect your users, their browser and your intellectual property. If you are still struggling with protecting your users at the edge, I encourage you to watch this demo. #socialengineering #phishing #malware #ransomware

9

1 Comment

The Government of Canada released an Enterprise Cyber Security Strategy last month. Unfortunately, most media outlets overlooked or did not understand what enterprise cyber security means or is about. So, I decided to write an introduction to the first Canadian Enterprise Cyber Security Strategy. https://lnkd.in/gQ4nP7dc #Canada #defence #defenceindustrialbase #enterprise #cybersecurity #cyberdefence Canadian Cyber in Context #innovation #cyber #treasuryboard

24

8 Comments

Does ZTA reduce attack surface or not?   Numerous sources say a Zero Trust Architecture (ZTA) reduces attack surface because it has more rigorous controls than legacy architectures do. E.g.: “Least privilege means that users and devices are only granted the permissions they need to perform their tasks. This helps reduce the attack surface and makes it more difficult for attackers to gain access to sensitive data.” https://lnkd.in/eRqQnUja   OK, I agree that stronger implementation of least privilege makes penetration harder but the surface that ZTA protects is still there. In fact, since ZTA has its own elements [policy engine, administrator, and enforcement point(s)] it has MORE surface to attack.   To my way of thinking, ZTA did not reduce the attack surface at all.   What are people’s thoughts?

5

1 Comment

So another ransomware advisory, with a hint to check your administrator groups for a new user called "itadm" https://lnkd.in/gvFFPpsA - question for all - do you actively monitor and immediately notify when a new user is added to any global administrator groups? Examples (in a Microsoft tenant) would include: 'Account Operators'; 'Administrators'; 'Domain Admins'; 'Backup Operators'; 'Domain Controllers'; 'Enterprise Admins'; 'Enterprise Read-only Domain Controllers'; 'Group Policy Creator Owners'; 'Incoming Forest Trust Builders'; 'Microsoft Exchange Servers'; 'Network Configuration Operators'; 'Print Operators'; 'Read-only Domain Controllers'; 'Replicator'; 'Schema Admins';'Server Operators' This article might help: https://lnkd.in/gDaD7x3X

14

1 Comment

🚨 How to prepare for Canadian Bill C-26: Strengthening Cybersecurity in Critical Sectors 🚨 Have you ever heard about Bill C-26? If not, keep reading to understand how it will affect your organization. The official name is Bill C-26: An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts. But what does that mean, and to whom? Why Bill C-26 is important? 🤔 The bill was introduced in 2022 and completed its first reading in the Senate last June 19. It will introduce the Critical Cyber Systems Protection Act (CCSPA), which mandates the implementation of comprehensive cybersecurity programs and immediate incident reporting. The bill applies to several critical sectors: Telecommunications 📡 Transportation 🚐 Finance 💰 Energy ⚡️ It requires enhanced supply chain security and 3rd party risk assessments. Which will be scrutinized by the regulators: Minister of Industry Minister of Transport Canada Energy Regulator Canadian Nuclear Safety Commission Office of the Superintendent of Financial Institutions (OSFI) The effects of C-26 are considerable and can even result in law enforcement with potential financial penalties, so keep an eye on it. -- Hi, I am Eder. Want to keep updated on this and other cyber regulations? Click my name + follow + 🔔 Found useful? Leave a comment ✍️ Think your network should read it? Repost ♻️

9

Time for a reality check. How strong is your network security? If you don’t know or if you’re honestly confessing “It is pretty weak,” you need an assessment. You need to know where you are vulnerable and then prioritize where you want to strengthen your network security. People rely on you to protect their secrets, provide the services they rely on and pay them every two weeks. You cannot half-ass your network security. Bring in Cyber Safety Net for an assessment. 

1

1 Comment

Time for a reality check. How strong is your network security? If you don’t know or if you’re honestly confessing “It is pretty weak,” you need an assessment. You need to know where you are vulnerable and then prioritize where you want to strengthen your network security. People rely on you to protect their secrets, provide the services they rely on and pay them every two weeks. You cannot half-ass your network security. Bring in Cyber Safety Net for an assessment. 

Time for a reality check. How strong is your network security? If you don’t know or if you’re honestly confessing “It is pretty weak,” you need an assessment. You need to know where you are vulnerable and then prioritize where you want to strengthen your network security. People rely on you to protect their secrets, provide the services they rely on and pay them every two weeks. You cannot half-ass your network security. Bring in Cyber Safety Net for an assessment. 

Time for a reality check. How strong is your network security? If you don’t know or if you’re honestly confessing “It is pretty weak,” you need an assessment. You need to know where you are vulnerable and then prioritize where you want to strengthen your network security. People rely on you to protect their secrets, provide the services they rely on and pay them every two weeks. You cannot half-ass your network security. Bring in Cyber Safety Net for an assessment. 

3

1 Comment

Time for a reality check. How strong is your network security? If you don’t know or if you’re honestly confessing “It is pretty weak,” you need an assessment. You need to know where you are vulnerable and then prioritize where you want to strengthen your network security. People rely on you to protect their secrets, provide the services they rely on and pay them every two weeks. You cannot half-ass your network security. Bring in Cyber Safety Net for an assessment. 

3

1 Comment

Check out Government of British Columbia's "Security Day: Guardians of the Cloud" live today! Sign up closes shortly: https://lnkd.in/gbJjs_b4 on Eventbrite You can catch Louise Turner and I from Quantum Algorithms Institute at 10amPST/1pmEST introducing #Canadian #cybersecurity to #quantum technologies and how they will influence #informationsecurity and #encryption in the coming years.