Elmehdi AABAD المهدي عباد

Introduction to #Vulnerability_Disclosure_Program What Is a Vulnerability Disclosure Program? A VDP is a structured method to have Anyone report vulnerabilities easily. Vulnerability Disclosure Program Pillars : Every successful VDP consists of at least five core components. 1- Promise Statement : The promise statement lets everyone know why an organization has a #VDP. An organization's promise statement demonstrates to the public that they are proactive regarding vulnerabilities and take threats seriously. 2- Scope : Scope defines the indicated systems and products for security research. The scope’s guidelines list domains and products suitable for testing while also restricting specific hacker testing areas. social engineering attempts are a few of the commonly restricted tests. 3- Safe Harbor : Safe harbor fosters a secure and productive VDP by protecting those who disclose vulnerabilities from legal action. This section is essential to safeguard and encourage hackers to disclose bugs through an organization's official channel. Hackers who find a bug often avoid disclosing it because the risk of legal action is too significant or not understood. Without a detailed safe harbor section, hackers may avoid disclosing for fear of retribution. Trustline includes safe-harbor language by default for all new VDP launches. 4- Process Description : The process description details the report submission and remediation process. Reports should include the vulnerability’s severity, how attackers can exploit it, and how developers can reproduce the bug. This information helps security teams prioritize threats and quickly validate new disclosures. 5- Preferences : The preferences section sets expectations for how your organization will evaluate reports. Process workflow should include expected response times, whether the organization will publicly disclose bugs, and if the hacker will receive a confirmation upon repair. Communication is essential in building a solid relationship between hackers and organizations. Hackers want to know that organizations pay attention to their submissions and take them seriously. The communication process also helps internal teams prioritize and patch bugs while setting time-based goals for response and remediation. Regardless of how long a bug takes to fix, transparent communication between organizations and hackers builds trust and confidence within the VDP. How Can #Trustline Help : In the past, designing a VDP required a significant investment of both time and money. Organizations typically developed policies from scratch, built new communication channels, and marketed their platforms. Trustline provides all the tools needed to launch a successful VDP from a single platform. Our out-of-the-box setup makes it easy to establish a compliant and policy-driven vulnerability disclosure workflow for continuous security.

10

A couple of months ago, in February 2024, we delivered a comprehensive webinar at the OWASP Algiers Chapter where we discussed "Exploring CyberSecurity Careers and Certifications." During this session, we showcased the different cybersecurity specialties and highlighted important certifications in the field. If you missed it, you can still watch the recorded session here: https://lnkd.in/ekmPnPWQ Since then, we have launched our Free Training Initiative focused on the ISC2 Certified in Cybersecurity (CC) certification. You might have heard about this initiative through various university clubs, or on TV programs and radio sessions via our partners. If you're interested in starting a career in cybersecurity or looking to advance your current knowledge, this is an excellent opportunity to receive free, tailored training along with a chance to earn an industry certification by ISC2 (FREE EXAM VOUCHER!!!). Don't miss out on this chance to jumpstart your cybersecurity journey. Make sure you sign up today: https://lnkd.in/eWXkbgFZ #CyberSecurity #ISC2 #FreeTraining #CareerDevelopment #OWASPAlgiers #CyberSecurityCertifications #TechCareers #InformationSecurity #CC #InfoSec #CyberSec

22

2 commentaires

What is a Security Operations Center (SOC)? 📍 A Security Operations Center (SOC) is a central function within an organization dedicated to monitoring, detecting, analyzing, responding to, and reporting security incidents and threats. 📚 Explore our cyber glossary & learn more about how #IRONSCALES can revolutionize SOC operations here: https://gag.gl/XjONVD #SecurityOperationsCenter #SOC

5

At WALLIX, we understand the critical importance of securing remote access in industrial environments. The rapid deployment of remote access tools has increased the attack surface of industrial networks, but with the right strategies, we can mitigate these risks. Implementing robust remote access solutions, like PAM4OT, centralizes access management and reduces vulnerabilities. This approach enhances monitoring capabilities, providing comprehensive audit trails that help identify and trace potential security incidents. By simplifying access management, we can ensure the integrity and availability of our critical infrastructure. Let’s work together to adopt these advanced security measures and build a more resilient industrial control system. At WALLIX, we’re committed to supporting you with the tools and strategies needed to enhance your cybersecurity posture. #CyberSecurity #RemoteAccess #IndustrialSecurity

35

Day 5 of 31 Cybersecurity Awareness Month During business trips : 🔒 Use a VPN on public Wi-Fi Public Wi-Fi networks are inherently insecure. Always use a Virtual Private Network (VPN) to protect your data when browsing in public spaces. 💻 Use a Privacy Screen Filter When traveling by plane or train, use a privacy screen filter on your device to prevent prying eyes from seeing your sensitive information. Be mindful of your surroundings and choose a seat that offers the most discretion. 🔒 Lock Your PC Whenever you step away from your laptop, remember to lock your screen using Windows + L keys to prevent unauthorized access. #CyberSecurityMonth  #StaySafeOnline  #privacy  #VPN  #WiFiSecurity #cybersecurity Cyber Secured India Nikhil Mahadeshwar

17

Another fantastic article from our very own Mohamed Talaat! If you are interested in #malware and are an #incidentresponder, you definitely want to check this one out! #cybersecurity #infosec The Cybersleuth Chronicles #blueteam #cyberdefender #PhantomLoader

3

2 commentaires

Urgent Alert: Check Point VPNs Under Siege by CVE-2024-24919 Exploit!🚨 1- Issue: Critical information disclosure vulnerability in Check Point VPNs. 2-Exploitation: Actively exploited by threat actors. 3-Risk: High-severity, allowing remote access to sensitive data. 4-Affected Systems: Check Point Gateways with IPSec VPN, Remote Access VPN, or Mobile Access enabled. 5-Detection: Test vulnerability using provided HTTP request. 6-Automation: Use pip tool for automated vulnerability checks. 7-Action: Check Point released hot fixes; affected users advised to contact Check Point Representative. 8-Stay Updated: Follow Cappricio-Securities on GitHub for more tools and updates. Stay secure 👌🏻 https://lnkd.in/dFB9ddBw

4

"These claims and their freshness are among the observable elements allowing to estimate the impact of Cronos and the Alphv exit-scam on the cybercriminal ecosystem of  ransomware. Added to this are the cross-claims. These claims – or  crossclaims  in English –  essentially reflect  a  cyberattack  conducted by the same actor using two banners to conduct its activities: ransomware franchises are increasingly used as simple brands, smokescreens  behind which the affiliates hide. Recently, Anastasia Sentsova, an analyst at Analyst1 looked into the subject as part of an  investigation into RansomHouse." A great analysis by Valery Rieß-Marchive on the aftermath of #OperationCronos and the role of crossclaims in ransomware. Read here 👇 https://lnkd.in/eWF67gmt

17

**National Vulnerability Debacle : 12,300 CVEs not analyzed !** Recent disruptions in the National Vulnerability Database (#NVD) since February 2024 have left over 12,300 vulnerabilities unanalyzed, with nearly 6,000 lacking critical CVSS and CPE data. This backlog underscores the risk of relying on a single, overloaded source for vulnerability information. In light of these challenges, turning to independent and reliable sources for vulnerability intelligence is crucial. Flexera ’s #SoftwareVulnerabilityResearch (#SVR) offers a compelling solution by providing comprehensive and verified vulnerability data. Here’s why SVR and Flexera’s #SVM are the right tools for the job: ✅ **Independence from NVD**: #SecuniaResearch, which underpins Flexera's SVR, utilizes a diverse array of data sources, ensuring comprehensive coverage and reducing dependency on any single source. ✅ **Quality and Accuracy**: Secunia Research maintains high standards for quality and accuracy, providing organizations with trustworthy intelligence for informed decision-making. ✅ **Advanced Analytics and Insights**: Combining advisory-based research with advanced data analytics, Flexera’s SVR offers actionable insights that help prioritize remediation efforts effectively. ✅ **Automation and Efficiency**: Flexera’s SVM leverages automation for rapid identification and remediation of vulnerabilities, reducing risk through prioritized actions and ensuring scalability to handle large data volumes efficiently. ✅ **Largest Patch Catalog**: Flexera’s SVM has the largest #PatchCatalog in the world, helping customers act quicker and save time by offering an integrated approach to effectively locate, prioritize threats and remediate them quickly to lower the risk to your organization. ✅ **Proven Track Record**: Trusted by some of the largest enterprises worldwide, Flexera’s SVR covers over 10 million endpoints, demonstrating its reliability and effectiveness in real-world scenarios. The recent NVD challenges highlight the need for robust, independent sources of vulnerability intelligence. Flexera’s SVR and SVM, with its comprehensive approach and commitment to quality, provides a dependable alternative that enhances vulnerability management processes. By leveraging automation and advanced analytics, Flexera helps organizations reduce risk and increase remediation speed, ensuring a secure cyber environment. For any organization committed to maintaining robust security protocols, Flexera's Secunia Research is an invaluable partner. #CyberSecurity #VulnerabilityManagement #Flexera #SecuniaResearch #SVM #SVR #Automation #DataAnalytics #CyberResilience #RiskManagement www.flexera.com/SVM

31

So, as a CISO, how to ensure that my team efficiently secures AIs ? Our usage of AIs but also the AIs that we are incorporating into our own systems ? We need some guidance to ensure that we don't forget anything. Fortunately, the NIST has a Trustworthy & Responsible AI resource center, and this center contains a golden nugget, the Risk Management Framework. It's a step by step guide that gives you the guidance to Secure AIs. This is a great resource to protect yourself along your AI journey. The link to the (very valuable) NIST AI RMF Framework: https://lnkd.in/emThu3yw A nice video that explains the Framework: https://lnkd.in/eSx5Nu2N The link to the AI resource center: https://airc.nist.gov/home #AI #CyberSecurity #NIST

2

🚔 Last week, international law enforcement agencies conducted #OperationEndgame to takedown key malware infrastructures. The Sekoia #TDR team supported the French law enforcement agencies by providing valuable cyber threat intelligence, particularly on #PikaBot. ⚡ #PikaBot is a malware loader widely distributed since February 2023. Initial Access Brokers (IABs) use it to establish an initial foothold within a victim’s networks and distribute additional payloads such as #CobaltStrike and #Meterpreter. Our new #TDR report provides an in-depth analysis of #PikaBot's functionalities, distribution methods, internal structure, and countermeasures used to avoid detection. Additionally, it shares technical details on PikaBot C2 #infrastructure. ➡ https://lnkd.in/eN3MKPqS Thanks to Pierre & Quentin for the technical analysis!

65

♦️Secure Talk : Elevating Security with the Fortinet OT Security As cyber threats increase, merging IT and OT security is crucial. Fortinet’s OT Security Platform helps organizations do this, reducing risks and paving the way for a secure future. ❗️Understanding the Fortinet OT Security Platform: Fortinet’s OT Security Platform is a part of broader security solution. It is designed for industrial networks. It offers features like secure connectivity, zero-trust protection, and advanced threat detection. This platform helps businesses stay safe in the digital world. ❗️Core Features of Fortinet OT Security Secure Networking Pillar OT Security Platform provides strong network protection. It uses FortiGate NGFW & FortiSwitch to divide networks & reducing lateral movements risks. This helps stop attacks from spreading. FortiGate & FortiSwitch provide robust security for all aspects of your industrial network, even in the most demanding environments. ❗️Zero Trust Access Pillar Traditional security isn’t enough. Zero Trust Access solution provides secure remote access (SRA) with features like session recording, secure file transfer, MFA, granular NACs for OT devices. Zero Trust helps protect your industrial networks making it easier to manage your team. SRA enables seamless remote access to your OT environments. ❗️OT Security Operations Pillar OT Security Operations pillar provides a complete solution for protecting your industrial systems. It includes tools like SIEM, SOAR, EDR, and NDR to help you detect and stop threats in your OT environment.. These tools work together to give you a clear picture of what’s happening on your network. It helps you collect, analyze, and stop threats in your industrial systems. ❗️Advantages of the Fortinet OT Security Platform: Click to read more …. https://lnkd.in/gSThF3iC

15

Great news! This alliance with Maltiverse further enhances our ability to anticipate threats and deliver advanced services to our clients. In a context where #cybersecurity is constantly evolving, having global intelligence and local expertise allows us to stay one step ahead. 🔐 We continue to strengthen the digital security ecosystem in #Chile and #Latam, promoting innovation and effective protection. The future of cybersecurity is collaborative! 🚀 #Cybersecurity #StrategicAlliance #ThreatIntelligence #Innovation #Latam #iSecurity"

7

Created the 𝗘𝗺𝗮𝗶𝗹𝗔𝘂𝘁𝗵𝗜𝗻𝘀𝗽𝗲𝗰𝘁𝗼𝗿! 𝗘𝗺𝗮𝗶𝗹𝗔𝘂𝘁𝗵𝗜𝗻𝘀𝗽𝗲𝗰𝘁𝗼𝗿is a bash script designed to help you quickly check the DMARC, SPF, and DKIM records for a list of domains and subdomains. Ensuring these records are correctly configured is essential for preventing phishing and spoofing attacks, and for maintaining a secure email infrastructure. 𝗙𝗲𝗮𝘁𝘂𝗿𝗲𝘀: - DMARC Checks: Verify DMARC records for root domains and subdomains. - SPF Checks: Ensure SPF records are correctly configured to authorize email senders. - DKIM Checks: Validate DKIM records to confirm email integrity and authenticity. - Comprehensive Reports: Output results to the console and save them to a CSV file for easy 𝗨𝘀𝗲 𝗰𝗮𝘀𝗲𝘀: 𝗘𝗺𝗮𝗶𝗹 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗔𝘂𝗱𝗶𝘁𝘀: Quickly scan multiple domains to verify DMARC, SPF, and DKIM records. 𝗠𝗮𝗻𝗮𝗴𝗲𝗱 𝗦𝗲𝗿𝘃𝗶𝗰𝗲 𝗣𝗿𝗼𝘃𝗶𝗱𝗲𝗿𝘀 (𝗠𝗦𝗣𝘀): Perform bulk email authentication checks for multiple client domains. 𝗗𝗼𝗺𝗮𝗶𝗻 𝗣𝗼𝗿𝘁𝗳𝗼𝗹𝗶𝗼 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁: Ensure secure email configurations across a large portfolio of domains. 𝗣𝗿𝗲-𝗔𝗰𝗾𝘂𝗶𝘀𝗶𝘁𝗶𝗼𝗻 𝗗𝘂𝗲 𝗗𝗶𝗹𝗶𝗴𝗲𝗻𝗰𝗲: Assess email security posture during mergers and acquisitions. 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴 𝗔𝘁𝘁𝗮𝗰𝗸 𝗣𝗿𝗲𝘃𝗲𝗻𝘁𝗶𝗼𝗻: Prevent domain spoofing by validating email authentication records. 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗮𝗻𝗱 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗥𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀: Verify email authentication for regulatory compliance. 𝗖𝗼𝗻𝘁𝗶𝗻𝘂𝗼𝘂𝘀 𝗠𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴: Automate periodic checks of DMARC, SPF, and DKIM records. 𝗜𝗻𝗰𝗶𝗱𝗲𝗻𝘁 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗲: Swiftly audit domains after phishing incidents to identify and fix gaps. 𝗚𝗶𝘁𝗛𝘂𝗯 𝗥𝗲𝗽𝗼𝘀𝗶𝘁𝗼𝗿𝘆 - https://lnkd.in/eRj6UmtJ #EmailSecurity #CyberSecurity #DMARC #SPF #DKIM #PhishingPrevention #OpenSource #ITSecurity #TechTools #EmailAuthentication #EmailProtection #SecurityAudits #IncidentResponse #Compliance #MSP #DomainManagement #SecurityTools

82

2 commentaires

While the NIS2 Directive introduces new compliance requirements, it’s also an opportunity to lead by example in cybersecurity. The penalties for non-compliance can be severe, but they also emphasize the importance of proactive measures and accountability. At WALLIX, we see this as a chance to foster a culture of accountability and vigilance. By actively engaging in the management of cyber risks, we can not only avoid fines and penalties but also enhance our overall security posture. This approach ensures that we stay ahead of potential challenges and protect our organizations effectively. Compliance with NIS2 is not just about meeting regulatory requirements—it’s about taking proactive steps to safeguard our businesses and build a more secure future. Let’s embrace this opportunity positively and work together to create a culture of cybersecurity excellence. #NIS2 #Compliance #Leadership

25

🚨 CVE-2024-10924 : critical authentication bypass in "Really Simple Security" plugin A critical vulnerability, CVE-2024-10924, has been identified in the WordPress plugin "Really Simple Security", affecting versions 9.0.0 to 9.1.1.1. This flaw allows attackers to bypass authentication and gain access to any user account, including administrators. It has been assigned a CVSS score of 9.8 (Critical) and poses a significant risk to WordPress sites using the plugin, especially when Two-Factor Authentication is enabled. How it works ❓ This vulnerability exists in the plugin's REST API handling for two-factor authentication requests. When a request is sent with a user ID and login nonce, the system is supposed to verify the validity of the nonce. If the nonce validation fails, the plugin improperly continues processing the request, using only the user ID for authentication. This allows an unauthenticated attacker to log in as any user on the site by crafting a specific API request with a known user ID. This flaw directly enables attackers to bypass the verification process entirely, granting them full access to accounts, including administrator privileges. Once in control of an admin account, attackers can manipulate the site, exfiltrate sensitive data, or inject malicious code. The exploit does not require prior authentication or user interaction, making it simple for attackers to automate and deploy on a large scale. Any WordPress site running a vulnerable version of the plugin with Two-Factor Authentication enabled is at risk. Sites without this feature enabled are not directly affected. Security patch and timeline: --> November 6, 2024: the vulnerability was reported by the Wordfence Threat Intelligence team. --> November 12, 2024: a patched version for the Pro plugins was released. --> November 14, 2024: the Free plugin was patched, and forced updates began. The patched version, 9.1.2, addresses the issue by ensuring proper validation of all parameters in the REST API requests and blocking unauthorized attempts. Actions to secure your site: --> ensure your "Really Simple Security" plugin is updated to version 9.1.2. Any version from 9.0.0 to 9.1.1.1 is vulnerable; --> review your site’s logs for suspicious login activity or unauthorized API requests; --> restrict access to REST API endpoints with authentication controls or IP restrictions. --> disable the Two-Factor Authentication feature temporarily if updates cannot be applied immediately. You need to act now to secure your WordPress site. Verify plugin updates and configuration settings. Avoid delays, as this vulnerability can lead to full site compromise. If someone you know is using these plugins on their website, share this advisory with them to help protect their site from this high-risk vulnerability Stay vigilant! Source: https://lnkd.in/d5zUUw5Q

8