‍Nicolas Goupil

🚨 Skopenow just released a new blog addressing alert fatigue in intelligence and investigative tools. Alert fatigue surged between 2018-2020 with the introduction of persistent monitoring features across the industry, it remains as prevalent of an issue today. Organizations are turning to OSINT solutions with advanced AI-powered search, filtering, and reporting to boost analyst productivity and combat burnout. Check out the blog here: https://bit.ly/4cILDZG #OSINT

12

A little bit of nostalgia and great to see references to the AP3086 (the precursor to the JSP440, Defence Manual of Security). Also notice the reference to ISO7799 (the precursor to ISO/IEC 27001). I first became interested in (and applied for) my Counter Intelligence specialisation when AP3086 was the security manual. By the time I went on this 10 week residential training course, in Aug 2002, it had been replaced by the JSP440. #informationsecurity #systemsecurity #informationsrcuritymanagement

4

Dragnet "Between 27 and 29 May 2024 Operation Endgame, coordinated from Europol’s headquarters, targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot. The actions focused on disrupting criminal services through arresting High Value Targets, taking down the criminal infrastructures and freezing illegal proceeds. This approach had a global impact on the dropper ecosystem. The malware, whose infrastructure was taken down during the action days, facilitated attacks with ransomware and other malicious software. Following the action days, eight fugitives linked to these criminal activities, wanted by Germany, will be added to Europe’s Most Wanted list on 30 May 2024. The individuals are wanted for their involvement in serious cybercrime activities. This is the largest ever operation against botnets, which play a major role in the deployment of ransomware. The operation, initiated and led by France, Germany and the Netherlands was also supported by Eurojust and involved Denmark, the United Kingdom and the United States. In addition, Armenia, Bulgaria, Lithuania, Portugal, Romania, Switzerland and Ukraine also supported the operation with different actions, such as arrests, interviewing suspects, searches, and seizures or takedowns of servers and domains. The operation was also supported by a number of private partners at national and international level including Bitdefender, Cryptolaemus, Sekoia, Shadowserver, Team Cymru, Prodaft, Proofpoint, NFIR, Computest, Northwave, Fox-IT, HaveIBeenPwned, Spamhaus and DIVD."

1

Categorizing IPs with Logstash – Private, Public, and GeoIP Enrichment https://lnkd.in/gHag_eXY #Logstash #SIEM #SOAR #Enrichment #IP #IPAddress #GeoIP #Elasticsearch #SOC

4

The Frontier Safety Framework is our rst version of a set of protocols that aims to address severe risks that may arise from poweul capabilities of future foundation models. In focusing on these risks at the model level, it is intended to complement Google’s existing suite of AI responsibility and safety practices, and enable AI innovation and deployment consistent with our AI Principles. #frontier #AI #framework

1

CISA Announced Vulnrichment : Project to Enrich CVE Records: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced a new initiative called “Vulnrichment” aimed at enriching Common Vulnerabilities and Exposures (CVE) records with additional metadata to help organizations better prioritize vulnerability remediation efforts. The Vulnrichment project, hosted in a public GitHub repository, will focus on adding key data points to CVE records, including: […] The post CISA Announced Vulnrichment : Project to Enrich CVE Records appeared first on Cyber Security News. #CyberSecurity #InfoSec

2

The final 32 CFR #CMMC rule defines Not Applicable as such: Sec 170.24 "(3) Not Applicable (N/A). A security requirement and/or objective does not apply at the time of the CMMC assessment. For example, Public-Access System Separation (SC.L2-3.13.5) might be N/A if there are no publicly accessible systems within the CMMC Assessment Scope."* I get the point the authors were attempting to make, but they should have deleted "within the CMMC Assessment Scope." Publicly accessible system components have no business existing within the CMMC Assessment Scope, and as such should be Out Of Scope assets, incapable of P/S/T #CUI. Determining whether there are publicly accessible system components WITHIN the CMMC Assessment Scope is the whole point of 3.13.5 - therefore, as worded, SC.L2-3.13.5 is absolutely APPLICABLE. The focus of 3.13.5 should have been on the existence of connections to or communications through publicly accessible system components. It appears NIST agrees. In #NIST SP 800-171 rev3, 03.13.05 has been withdrawn and incorporated into 03.13.01 Boundary Protection. So, this 32 CFR 170 definition will need to be re-written anyway. DoD lost it's example within. That's ok. They have plenty of time. What do you think? *This is also in the CMMC 2.13 Level 2 Assessment Guide, p. 10

3

Ready for the # Mnemonic C2 Summit 2024. It will be days of security . With lots of good information, and I have been asked to talk about Advanced Persistant Manipulators tomorrow ( #APM) . with Robby James Peralta and others

67

3 Kommentare

83% of companies have not fully implemented defense-in-depth strategies, leaving them vulnerable to increasingly sophisticated attacks. In Dark Reading’s latest report, discover why an end-to-end defense strategy is essential and how OPSWAT and F5 combined solutions enable organizations to enhance their overall #cybersecurity posture. Download now. https://lnkd.in/gHdRc45Y

1

#PartIS tip #1 What is the difference between #ISMS as defined by ISO/IEC 27001, NIST CSF, et al.? Everything is almost the same, except for one “little detail” - the #objective of ISMS as defined by PART-IS is aviation #SAFETY.

6

After attending a fascinating presentation on #cybersecurity hosted by the German Society for Security Policy, I was reminded of the field's growing importance, especially for #healthcare professionals. In the 21st century, electronic attacks have shifted from physical battlefields to the digital realm of cyberspace. This new landscape presents threats through overloading systems, disrupting functionalities, and disseminating misinformation. These attacks extend beyond military targets, impacting critical infrastructure, institutions, and even societal discourse, as exemplified by the role of Cambridge Analytica during political campaigns. Safeguarding this vital digital space is crucial. Image credit: DALL-E 3

6

👉 GHD analysis states, about a quarter of global water systems will likely have experienced a cybersecurity breach by 2025 👉 Water systems face the highest cyber risk from insiders, rival governments, and organised crime groups 👉 100% increase in malicious techniques used by cyber- attackers to take control of a program or operating system in 2022 compared to 2021 👉 38% of water utilities in the US only allocate 1% of their budget to cybersecurity. 👉 Under America’s Water Infrastructure Act of 2018 (AWIA), EPA has enacted legislation that requires water system operators to address cybersecurity as part of their emergency response plans. Great article by GHD exploring the challenges of cybersecurity in water and highlights the steps that can be taken to enhance security and resilience. credits - Sunil Sharma Mike Tocher Aijaz Hussain Shaik Anne-Marie Kirkman

6

A Threat Informed Defense needs to have 3 interlocked dimensions:- 1: Threat intelligence 2: Testing and diagnostic evaluation 3: Defensive measures What we’ve learned over the last year or so is lots of investment goes into the Defensive measures dimension i.e MDR, IR, Protective controls etc, which is good because without it there’s no defense, of course. However the other 2 dimensions are the least invested in, especially testing and diagnostics. Pen testing is what everyone knows and is vital but it’s often a one time snapshot over 2-4 weeks a year. It’s exploiting known vulnerabilities in technology. Pen tests alone don’t move the dial on improved digital resilience. ⚠️To optimise Defensive measures, frequently testing & evaluating is a pre requisite. Without continuously testing how do you know you are secure? You don’t, you assume. Continuous testing of technology vulnerabilities - security controls effectiveness and Attack simulations is all possible and we can join all that up for you. Essentially, what we have at Alchemmy Security & Resilience is a complete suite of security testing outcomes from a one stop shop. 🆕 to this quarter we are running some discounted exclusive deals to wet the appetite! The Threat Intelligence dimension is also problematic. What is actionable against what is often consumed is an issue we all share the pain of. To be Threat informed requires some understanding in the business of how Threat Actors manifest their tradecraft. It’s surprising how little attention this is given in an industry that is solely focused on protecting against threats. Indicators Of Compromise are useful for tool feeds but not for understanding how to implement effective security defensive strategies against the hard to detect tactics and techniques used by more sophisticated attackers coming after you. You don’t have to spend a fortune on Threat Intelligence, not anymore. We need to do better and the likes of MITRE Tidal Cyber NCSC and CISA are doing the game changing work A Threat Informed maturity assessment can help you understand how these 3 dimensions can interlock to take your business from compliance only focus (ISO, NIST etc) to Threat Informed focus. ⚠️ Compliance frameworks are the foundational ‘why’ and ‘what’ is required to build out a business security program. Evolving towards being Threat Informed provides the ‘how’ to make that compliance framework effective! ✅ Reach out to me directly for a consultation conversation or follow our Alchemmy Security & Resilience page for further announcements this coming month #beThreatInformed #cyber #ciso #BAS #pentesting

17

3 Kommentare