Waseem Ajrab

Recommended Mitigations 1) Boot Windows into Safe Mode 2) Navigate to the directory C:\Windows\System32\drivers\CrowdStrike 3) Locate the file matching C-00000291*.sys and delete it 4) Boot the host normally Note: You can also boot in Windows Recovery Environment (WinRE) #crowdstrikefriday

5

The Digital Transformation Office (DTO) of the Turkish Presidency provides critical guidance on IT security through its Information and Communication Security Guide, covering various systems, including firewalls. This guide helps evaluate existing firewall controls to identify any weaknesses, vulnerabilities, or security gaps that may affect network integrity. By following these insights, organizations can effectively pinpoint and address potential risks. The guide offers actionable steps to strengthen firewall defenses and align with industry best practices. 📌 Ensuring a Secure Network Topology In today’s interconnected world, securing network topologies is vital. Network maps must be securely stored and regularly updated to prevent unauthorized access. By carefully managing topologies, we gain greater control over network pathways, safeguarding sensitive information. Firewalls play a critical role by providing a perimeter defense, segmenting traffic, and allowing only approved connections. #DTO #CBDDO #Cybersecurity #NetworkSecurity #Firewall

11

Glad to see new update from National Institute of Standards and Technology (NIST) National Vulnerability Database (#NVD). https://lnkd.in/dmaBdzbH The update is focused about two main themes: — #CVSSv4 support — it will appear on vulnerability details pages, in search form and search results. Moreover, there is new CVSS v4 calculator https://lnkd.in/dF4RiiaD As of now, I wasn't able to find any #CVE scored with CVSS v4 by NVD. — #CISA Authorized Data Publisher (#ADP) Support — NVD CVE record will include data from CISA’s #Vulnrichment CVSS and #CWE information (see one example here https://lnkd.in/dj_7kUYf). Unfortunately, it looks like Vulnrichment affected configurations (with some of them also including #CPE) are not available via the NVD at the moment. #informationsecurity #vulnerabilityassessment #vulnerabilitymanagement

21

2 Kommentare

Removing Indicator of Compromise: Clearing Windows Logs with Wevtutil Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. With administrator privileges, the event logs can be cleared with the following utility commands: wevtutil cl system wevtutil cl application wevtutil cl security To erase evidence of their activities after breaching a system, cybercriminals frequently target Windows Event logs for deletion. They commonly utilize “wevtutil,” a legitimate Microsoft tool, to carry out this task. Such actions disrupt the collection and notification of events, increasing the risk of security incidents going unnoticed, which could ultimately result in additional vulnerabilities within the network. Here is the Splunk SPL to detect erasure of logs; index=* sourcetype= __your__windows__sysmon__sourcetype EventCode=1 Image=*wevtutil* CommandLine=*cl* (CommandLine=*System* OR CommandLine=*Security* OR CommandLine=*Setup* OR CommandLine=*Application*)

20

In today's data-driven era, data protection is paramount. Organizations must be ready to address potential failures by implementing robust disaster recovery strategies. For those hosting critical data, having a disaster recovery (DR) site is essential. Oracle Data Guard provides a comprehensive solution for database disaster recovery, ensuring data protection and availability. Simple solution for standby ASM : Data guard (DG) : ORA-01111 - Datafile not created on standby database. Hope this article will be useful to address this missing datafile issue in standby database. #dba #oracledba #standby #dataguard #oracleace https://lnkd.in/gzVAGi9V

16

1 Kommentar

The Cybersecurity and Infrastructure Security Agency's new Secure by Demand guide provides questions that customers should ask of #software manufacturers to understand the security mindset of the software design & development. The guide is a counterpart to the Secure by Design guide. Read more: https://lnkd.in/gEFYEpsS

15

Most critical infrastructure organisations have a nicely formated policy that says they apply MFA (multi-factor authentication) - to mitigate the risk of compromised credentials being used for password-spraying attacks, which are currently being linked to a hostile campaign. Job done? Unfortunately, in Deloitte's experience, one of the more common findings in our post incident reviews is that the attackers got initial access via an interface where the MFA is absent (or configured in a way that can be bypassed). Given how complex organisations can be it has never been more important to get certainty around this control, especially on Internet-facing interfaces.

21

1 Kommentar

🔍 𝐄𝐱𝐩𝐥𝐨𝐫𝐢𝐧𝐠 𝐒𝐈𝐄𝐌 𝐚𝐧𝐝 𝐂𝐨𝐫𝐫𝐞𝐥𝐚𝐭𝐢𝐨𝐧 𝐂𝐡𝐚𝐥𝐥𝐞𝐧𝐠𝐞𝐬 𝐎𝐯𝐞𝐫 𝐭𝐡𝐞 𝐘𝐞𝐚𝐫𝐬 🔍 Back in 2016, I addressed a critical issue in the realm of SIEM: the challenge of correlating events based on periodic queries. My insights were published in Turkish as "Log Yönetimi, Korelasyon ve SIEM" (Log Management, Correlation, and SIEM). You can read the full article here: https://lnkd.in/ghd7naG Interestingly, just a day later, a related article titled "SIEM tricks: dealing with delayed events in Splunk" was published, highlighting similar concerns. Check it out here: https://lnkd.in/gz4KyPkV Fast forward to 2021, I revisited this topic on PeerSpot, delving deeper into the persistent issues surrounding event correlation in SIEM systems. For those interested, you can read more about it here: https://lnkd.in/gcEVjKCS Happy reading and feel free to share your thoughts! #CyberSecurity #SIEM #Correlation #LogManagement #ThreatDetection #Splunk #PeerSpot #InfoSec

4

Meeting the PCI DSS Compliance Guidelines I by Adesanya Ahmed https://lnkd.in/d6iJ8UCc #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding #opensource

1

The Personal Data Protection Authority (#KVKK) fined social media platform X (formerly #Twitter) 1 million 470 thousand liras for data security breaches. According to Anadolu Agency, KVKK initiated an ex officio investigation following X's statement that ‘contact information collected for security purposes was mistakenly used for #advertising purposes’ and related news. Considering the high number of users in Turkey and the risk of third parties obtaining the information, KVKK has determined that the use of personal data requested for security in advertising activities is contrary to the principles of ‘compliance with the law and good faith’ and ‘being connected, limited and proportionate to the purpose for which they are processed’ in the law, which is contrary to the Personal Data Protection Law No. 6698. #DataSecurity #PersonalData #AdvertisingSecurity #X You can reach the details from the link below: https://lnkd.in/dQNe2ZGR

13

The telecommunications sector is being hacked by aggressive nation states (this time China's Salt Typhoon group). The National Security Agency, Cybersecurity and Infrastructure Security Agency, and Federal Bureau of Investigation (FBI) have jointly published an alert outlining good basic security principles for the communications sector. I emphasize basic, because telcos and all other critical infrastructure heavyweights should already be doing the basics! If the NSA, CISA, and FBI need to reiterate this information to telcos, it highlights a problem that many aren't consistently adhering to fundamental #cybersecurity practices which should have been in place for more than a decade!

24

1 Kommentar

Reframing Managed File Transfer's Role in the Modern Enterprise 👉 Read the blog: https://gag.gl/D8x8zr #cybersecurity #MFT #FileTransfer #ManagedFileTransfer #FileSharing

6

Protect your organization’s network with the DevRay Firewall, your ultimate defense against cyber threats. Discover its advanced features and ensure robust security: > Real-time Monitoring: Stay updated with real-time insights into your network's health. > Threat Detection: Detect and neutralize potential threats before they cause harm. > Seamless Integration: Easily integrates with your existing infrastructure. Ensure your data and assets are safeguarded with cutting-edge technology. Secure your network and protect your future. Learn more at www.devray.in https://lnkd.in/dP8PNTRK Contact: +91-8178803636 #CyberSecurity #NetworkSecurity #DevRayFirewall #DataProtection #RealTimeMonitoring #ThreatDetection #SeamlessIntegration #TechInnovation #BusinessSecurity #CyberDefense #SecureNetwork #ITSecurity #AdvancedSecurity #ProtectYourFuture #DevRay #NetworkProtection #DigitalSecurity #SecureYourData #CyberProtection #SecuritySolutions

36