Elmehdi AABAD المهدي عباد

I am pleased to share the translation of my article to discover the EAP-TEAP network authentication protocol. Hopefully this will provide you with some answers. https://lnkd.in/e-BJh_7W #cybersecurity #eap #teap #authentication #network #networking #nac

30

**Elevating Cybersecurity with Mandiant** In today's dynamic threat landscape, a reactive approach to cybersecurity is no longer sufficient. Organizations must proactively assess and strengthen their defenses to stay ahead of sophisticated attackers. Below are Security Validation features outlining these strategies : **Automated Environmental Drift Detection and Alerting** - Continuously test your environment for both historical and emerging threats. - Receive timely alerts for any defensive regressions, ensuring your security controls remain effective. **Real-World Attack Emulation** - Go beyond traditional breach and attack simulation (BAS) with Protected Theater. - Safely simulate destructive endpoint attacks and conduct email-based tests. Assess your entire attack surface, including human vulnerabilities, to identify and remediate weaknesses. **MITRE ATT&CK Framework Mapping** - Gain valuable insights by mapping your security tools and processes to the MITRE ATT&CK framework. - Leverage Mandiant's frontline intelligence to understand the latest adversary TTPs. - Identify and address potential vulnerabilities before they are exploited. By adopting these proactive strategies, organizations can enhance their resilience against cyberattacks and safeguard their critical assets. #cybersecurity #MITREATT&CK #threatintelligence #google #cloudsecurity Sreejith Nair Sijesh Sreedhar Nitin Nyati Premal Ghelashah Mandar Bhosale Rahul Badlani Vishal Soni Google Cloud Security Mandiant (part of Google Cloud)

24

France has recently raised questions about how the new European Union (EU) cybersecurity certification for cloud services, known as EUCS, might affect national security measures like its SecNumCloud. Here’s an overview of the situation: - EU’s Cybersecurity Efforts: The EU plans to introduce EUCS to unify and enhance security standards for cloud services across member states. This certification, led by the EU’s cybersecurity agency, ENISA, is part of efforts to bolster cybersecurity throughout the bloc. - France’s Concerns: With its national cloud security standard, SecNumCloud, developed to safeguard against rising cyber threats, France has sought a legal opinion from the Council’s legal service. The focus is on understanding how EUCS might influence SecNumCloud and similar national programs. - Status of the EUCS: Originally set for approval by April 15, the certification now faces a delay due to France’s intervention, with further discussions expected in May or June. Recent revisions by ENISA have removed earlier requirements for non-EU companies to collaborate with EU-based companies for data handling within the EU, which aimed at securing the highest security label under EUCS. - Debate on Sovereignty Requirements: Initially included to potentially restrict non-EU firms from meeting top security standards, these requirements were seen by some as protective. France supported these terms to limit eligibility of non-EU cloud service providers. - Market Implications: Removing sovereignty terms from the proposal affects how companies like Amazon and Alphabet compete in the EU, particularly for sensitive cloud service contracts. This certification shapes the EU’s cloud service market’s competitive environment. - Advice for Cloud Service Providers (CSPs): Although this certification is voluntary, EU-based CSPs should assess its relevance to their operations and understand the security requirements for each certification level to determine qualification paths. #cybersecurity #EU #regulation

3

1 commentaire

"These claims and their freshness are among the observable elements allowing to estimate the impact of Cronos and the Alphv exit-scam on the cybercriminal ecosystem of  ransomware. Added to this are the cross-claims. These claims – or  crossclaims  in English –  essentially reflect  a  cyberattack  conducted by the same actor using two banners to conduct its activities: ransomware franchises are increasingly used as simple brands, smokescreens  behind which the affiliates hide. Recently, Anastasia Sentsova, an analyst at Analyst1 looked into the subject as part of an  investigation into RansomHouse." A great analysis by Valery Rieß-Marchive on the aftermath of #OperationCronos and the role of crossclaims in ransomware. Read here 👇 https://lnkd.in/eWF67gmt

17

Technical Cyber Champions vs. Non-Technical Cyber Champions 🛠️ 🗣️ When building a security program, both technical and non-technical champions play key roles: Technical Champions 🛠️: Deeply rooted in IT, they handle the complex, technical issues like coding vulnerabilities, patching, and system defenses. Their expertise is crucial for resolving the technical challenges of cybersecurity. Non-Technical Champions 🗣️: Focus on the human side, simplifying concepts and driving awareness across all levels of the organization. They excel at communicating and fostering a security culture that resonates with everyone. Bottom Line: Both champions are essential! 🛡️ Tech champions fix the technical problems, while non-tech champions engage the people, ensuring security is a shared priority. Together, they form a powerful defence. 💪

4

1 commentaire

🌞 Happy Monday ! 📢 If you work in cybersecurity and manage #TLS certs and #PKI, you know the pains of managing TLS certificates. The pain is going to be amplified when 90-day certificates become the new standard. So what should you do to get ready? 📢 Meet with our experts and get a custom report that will answer that question, all based on your company's certificate landscape and certificate lifecycle management processes. Feel free to PM me if you would like to learn more.... #venafi Google #webpki

17

Last 6 months I joined global practitioners to build a new and complementary maturity model for Cyber Threat Intelligence based on C2M2. Details 👇 ! We call it Cyber Threat Intelligence Capability Maturity Model (CTI-CMM). Have a look below or download the version (PDF) here: www.cti-cmm.org Rationale: I've helped numerous teams mature its CTI practice. Its not easy nor every situation is the same. There is no one framework that works for everything. This is why we came up with the idea of bringing together practitioners to find a way to solve this issue and see if we can bring this concept out of academia; reflecting practice. Join the community & let us know what you think! Your feedback will be the first thing we will work on, you can share that here: https://lnkd.in/eNNtNuf9 Big shout out to the amazing team behind it, creating this initial version and continue to lead the improvements we have planned for the next months (years?) to come: Michael DeBolt Colin Connor Nicole Beckwith John Doyle John Holland Brian Mohr John Fokker Clayton H. Kevin Holvoet Michel M. Alexander P. Lauren P. Kobe S. Scott Small John Suver Our advisors, keeping us in check along the way! Freddy Dezeure Joseph Opacki Michael H.. Rick Holland Andreas Sfakianakis Finally, a big thanks to our launching sponsor Intel 471 l. In the future we will explore different models for financing any activities (yes, there’s always small costs associated with these things) to make sure this remains a community driven and non profit exercise. That said, we had some amazing support from Michael DeBolt‘s team helping us expedite various launch activities and I really appreciate that.

199

19 commentaires

🚨𝐀𝐝𝐯𝐞𝐫𝐬𝐚𝐫𝐲-𝐢𝐧-𝐭𝐡𝐞-𝐌𝐢𝐝𝐝𝐥𝐞 𝐩𝐡𝐢𝐬𝐡𝐢𝐧𝐠 𝐚𝐭𝐭𝐚𝐜𝐤𝐬 𝐚𝐫𝐞 𝐨𝐧 𝐭𝐡𝐞 𝐫𝐢𝐬𝐞. 𝐇𝐞𝐫𝐞’𝐬 𝐡𝐨𝐰 𝐭𝐨 𝐫𝐞𝐝𝐮𝐜𝐞 𝐲𝐨𝐮𝐫 𝐫𝐢𝐬𝐤.🚨 The rise of 𝐀𝐝𝐯𝐞𝐫𝐬𝐚𝐫𝐲-𝐢𝐧-𝐭𝐡𝐞-𝐌𝐢𝐝𝐝𝐥𝐞 (𝐀𝐢𝐓𝐌) phishing attacks is challenging traditional defenses, even for those using Multi-Factor Authentication (MFA). As adversaries evolve, so must our security strategies. In our latest blog, we dive into the mechanics of AiTM phishing and offer actionable steps to safeguard your users and data. Here’s a quick summary of recommendations:  🛡 1. 𝐆𝐨 𝐏𝐚𝐬𝐬𝐰𝐨𝐫𝐝𝐥𝐞𝐬𝐬 𝐰𝐢𝐭𝐡 𝐏𝐡𝐢𝐬𝐡𝐢𝐧𝐠-𝐑𝐞𝐬𝐢𝐬𝐭𝐚𝐧𝐭 𝐂𝐫𝐞𝐝𝐞𝐧𝐭𝐢𝐚𝐥𝐬:    - Implement 𝐩𝐚𝐬𝐬𝐤𝐞𝐲𝐬 and solutions like Windows Hello for Business for unparalleled security.    - Use public-private key cryptography to make authentication nearly impossible to phish. 2. 𝐄𝐧𝐡𝐚𝐧𝐜𝐞 𝐌𝐅𝐀 𝐰𝐢𝐭𝐡 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐀𝐮𝐭𝐡𝐞𝐧𝐭𝐢𝐜𝐚𝐭𝐨𝐫:   - Enable features like 𝐧𝐮𝐦𝐛𝐞𝐫 𝐦𝐚𝐭𝐜𝐡𝐢𝐧𝐠, 𝐠𝐞𝐨𝐥𝐨𝐜𝐚𝐭𝐢𝐨𝐧, and app context to help users spot fraudulent requests. 3. 𝐒𝐞𝐭 𝐒𝐭𝐫𝐨𝐧𝐠 𝐀𝐜𝐜𝐞𝐬𝐬 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬:   - Require 𝐦𝐚𝐧𝐚𝐠𝐞𝐝 𝐚𝐧𝐝 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐭 𝐝𝐞𝐯𝐢𝐜𝐞𝐬 for access.    - Enforce 𝐧𝐞𝐭𝐰𝐨𝐫𝐤 𝐛𝐨𝐮𝐧𝐝𝐚𝐫𝐲 𝐫𝐞𝐬𝐭𝐫𝐢𝐜𝐭𝐢𝐨𝐧𝐬 using Conditional Access. 4. 𝐏𝐫𝐨𝐚𝐜𝐭𝐢𝐯𝐞𝐥𝐲 𝐁𝐥𝐨𝐜𝐤 𝐑𝐢𝐬𝐤𝐲 𝐔𝐑𝐋𝐬:   - Use tools like 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫 𝐒𝐦𝐚𝐫𝐭𝐒𝐜𝐫𝐞𝐞𝐧 and **Defender for Endpoint** to block access to malicious sites. 5. 𝐋𝐞𝐯𝐞𝐫𝐚𝐠𝐞 𝐑𝐢𝐬𝐤-𝐁𝐚𝐬𝐞𝐝 𝐂𝐨𝐧𝐝𝐢𝐭𝐢𝐨𝐧𝐚𝐥 𝐀𝐜𝐜𝐞𝐬𝐬 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬:   - Automatically trigger MFA reauthentication or session revocation in response to elevated risks. 6. 𝐌𝐨𝐧𝐢𝐭𝐨𝐫 𝐚𝐧𝐝 𝐌𝐢𝐭𝐢𝐠𝐚𝐭𝐞 𝐰𝐢𝐭𝐡 𝐀𝐝𝐯𝐚𝐧𝐜𝐞𝐝 𝐓𝐨𝐨𝐥𝐬:   - Use 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫 𝐗𝐃𝐑 to disable compromised accounts and revoke session tokens.    - Investigate incidents with 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐒𝐞𝐧𝐭𝐢𝐧𝐞𝐥 for complete visibility and response. https://lnkd.in/dN3fPqFX #CyberSecurity #IdentityProtection #MFA #Passkeys #Microsoft #aitm #entraid #xdr #defenderxdr #sentinel #microsoftsentinel #passwordless #passkey #phishing #security #cybersecurity #soc #cloud #cloudsecurity #conditionalaccess

16

In case you missed it I'm excited to share this interview on #SOC , "The Pillars of Impactful #Security #Operations: Process, Affiliates, People, Business, Visibility, and Technology," featuring Mahmoud Elkashef —a seasoned security leader with over 14 years of industry experience. About Mahmoud Elkashef : Mahmoud has been a driving force in security transformation across various sectors, including healthcare, financial services, education, and oil & gas. His customer-focused approach and expertise in #SOC, #cloud, and on-premises environments have been instrumental in enabling organizations to maximize their technology investments while ensuring robust security postures. At #Palo_Alto Networks, he’s expanded the Services Account Manager (SAM) team and grew the SAM business, making him a trusted advisor in cybersecurity. Why You Should Read This Interview: If you’re a #SOC professional or #security leader, this is a must-read for insights into impactful operations and how the right combination of people, processes, and technology can drive lasting results. Dive into the interview now and discover actionable insights from one of the industry’s top professionals! Full interview here: https://lnkd.in/es9G8Suf #CyberSecurity #SOC #Operations #Technology #Leadership #Cybercory #Interview

78

1 commentaire

Interesting move from Qnap, are we slowly moving toward security (and privacy ? ) by design and by default ? "QNAP adds NAS ransomware protection to latest QTS version" Is it perfect ? We'll see, but it's a good move. #cybersecurity #qnap https://lnkd.in/gCNaBg5e

19

3 commentaires

** Thank you all for your insights on our latest research. We're currently revising the blog post and adding further clarification and any missing information based on feedback from the community and our latest review*** 🚨 Dear Security Engineers / AppSec people Uri Aronovici discovered a new attack where threat actors can exploit widely-used external Terraform providers to gain full control of a cloud production environment. Why you should care about it ? 📍 Most SAST / SDLC processes are not catching it 📍 There are many ways to exploit it 📍 There are few ways to detect it while it happens #terraform #cloudsecurity #appsec #riskmanagement

86

22 commentaires

An interesting take after decades of failure and constant cloud leaks ! "What is the Shared Fate Model?" Public cloud consequences : ➡ New threats, an overburdened workforce, and regulatory pressures mean cloud service providers need a more resilient model than the shared responsibility framework. That's where "shared fate" comes in. ➡ Now, this mentions security by design and by default, which is a great take, but ZERO privacy mentioned. Therefore, public cloud, even with the "Shared Fate Model" is not going to be better for confidentiality. It remains none, zero, nada, no confidentiality. 💡 Unless you encrypt (using quantum proof ciphers, as far as can do) BEFORE the data reach the dangerous public cloud, well, too bad, it's no longer yours. cloud=leak #cybersecurity failure by design #clowd https://lnkd.in/eHke4scc

3

Whoa! Wish I had this like 5 years ago🥰🥳🔥 Use #Uncoder AI to auto-parse threat reports and #IOC files straight into customized search queries ready to run in your SIEM or EDR environment for streamlined threat investigation. #soc #ciso #admins #students #teachers

4

Are you securing your software supply chain right ? "Millions of Docker repos found pushing malware, phishing sites" 💡 Do you have tools adding extra control over your SBOM ? (Software bill of material) ? 💡 An interesting analysis from Jfrog (artifactory and all) here, about how docker repos are poisoned with malware and end in your CICD ? connected=hacked cloud=leak #cybersecurity #docker #cicd https://lnkd.in/e2v9arNE

27

3 commentaires

Patrick Garrity 👾🛹💙 just dropped some 🔥! He's categorized known exploited vulnerabilities identified by VulnCheck, where evidence of exploitation was discovered for the first time in the first half of 2024 (390 vulnerabilities) This categorization provides valuable insights for security defenders to focus on strengthening their vulnerability and patch management, implementing mitigating controls, and enhancing detection capabilities. You can read the full details on my observations on the 1H-2024 state of exploitation here: https://lnkd.in/gA8mac2b

12

2 commentaires

⚠ In cybersecurity, what you don't know can hurt you. ⚠ Read more to understand how and who can be a victim in the described scenario.

3