Ugur Akyazi

Last week, the Dutch police and Public Prosecutor published the cybercrime monitor for 2024 (https://lnkd.in/ebJKZWCh). Often, the advanced and James Bond-like hacks get the spotlight. APTs taking down critical infrastructure or that new fancy zero-day in widespread software. The reality is that it’s not only governments and big organizations that are targeted by cybercrime, but regular citizens can also be victims. 𝐕𝐢𝐜𝐭𝐢𝐦 𝐬𝐮𝐩𝐩𝐨𝐫𝐭 𝐚𝐧𝐝 𝐦𝐞𝐧𝐭𝐚𝐥 𝐰𝐞𝐥𝐧𝐞𝐬𝐬 This report shines a light on regular cybercrime, which can be quite impactful for the victims. In 2023, 16% of the Dutch population was impacted by a form of online crime. As only 10% of the victims report such a crime and there is some taboo on being tricked, this percentage is assumed to be a lower bound. As cybersecurity professionals, we often tend to focus on resolving the problem (let's handle the incident, let's get things up and running again, etc.). The report highlights the emotional impact an attack has as well (mental health impact on employees), which is a no-brainer, but not strongly positioned in current standards. Support groups for cybercrime victims aren’t widespread yet, and although initial pilots are being conducted (https://lnkd.in/e79-wR8g), society would benefit from having accessible go-to places for support. 𝐂𝐫𝐢𝐦𝐢𝐧𝐚𝐥 𝐏𝐢𝐯𝐨𝐭 Cybercrime is borderless, and one doesn’t necessarily need to have deep technical skills to conduct cybercrime. As technical criminals offer their services globally, the execution of attacks is now accessible to the common criminal as well. Criminals are often young (50% below the age of 25), and criminal tactics are pivoting from encrypting data to demand a ransom, to stealing the data and threatening victims to publish it. 𝐂𝐲𝐛𝐞𝐫𝐜𝐫𝐢𝐦𝐞 𝐄𝐜𝐨𝐧𝐨𝐦𝐢𝐜𝐬 The report also shares some insights on cybercrime economics. Although the likelihood discussion remains a tricky one, leveraging economic insights on the costs of an attack and the market price of certain data types can be used as one of the proxies for discussing likelihood. According to the report, the average price of initial access ranges between EUR 1.000,- and EUR 3.000,- a botnet subscription starts at EUR 25,-, and phishing panels start at EUR 150,-. The services come with training and, in some cases, online support. By browsing the darkweb, i'm sure much more information is available and it would help risk managers if this becomes more widely available.

7

This is how we're different at SCYTHE, we can emulate the actual threat behaviors so you really know where you stand. 🦄 We emulated the threat actor's novel method of local and domain user enumeration via “Security Log” querying for valid user logins to determine what accounts are active and what users can be found on the hosts where they have access.

21

Good read on cyberespionage/persistent access... 'In early 2024, while conducting an incident response investigation, the Dutch Military and General Intelligence Services noticed something unusual on state servers. What they uncovered was a Remote Access Trojan (RAT) malware developed for FortiGate devices. The interesting thing is that this ‘under the radar’ piece of malware was not aimed at gaining access to systems but at maintaining access by remaining active and persistent on devices even after reboots and updates... ...This means once they’re in, they’re in for the long haul. In the cyber espionage cases he’s investigated, Zeeman and his team would often find that these actors had been embedded in systems for months or even years, allowing them to trade secrets like IP information, intellectual property, etc... ...Right now the main focus for cyber espionage actors has been on edge devices (as in the COATHANGER campaign) and remote work tools, particularly SSL VPN solutions. But because these actors do have unlimited resources, they will keep coming, exposing new vulnerabilities when others are discovered. But guarding against cyber espionage is costly. “The only way to know you’ve been breached is to periodically check for it,” Zeeman says. This means compromise assessments should be undertaken every one to five years depending on the sensitivity of a company or organisation’s data.' https://lnkd.in/gVdYvG9a

16

I’m thrilled to be back on stage! This time, I’ll be discussing the Risks of AI in the ever-evolving landscape of cybersecurity, exploring both the blue and red oceans. Expect an engaging presentation filled with live demos and interactive discussions. A big thank you to ISACA NL Chapter for the invitation and to Northwave Cyber Security for investing in AI to enhance our services and deliver even greater value to our clients. QUESTION: What risks would you like me to talk about?

17

1 commentaar

A Warning ⏰ from the Dutch National Coordinator for Security and Counterterrorism (NCTV): Cyber Attacks from Russia and China are intensifying, increasing in impact and complexity. I had the pleasure to speak to NPO Nieuws en Co about the subject. 📺 What's been reported so far in 2024, how are different European Nations targeted and what can the Netherlands expect? The dialogue is in Dutch - take a look here

33

🚀 The Future of Security Operations Centers (SOC) is Here! 🚀 Excited to share insights from the latest TNO report on the evolution of SOCs, detailing how they are set to transform by 2030. 🔍 Key Highlights: ➡️ Current State: SOCs are the frontline defense against cyber threats, yet many struggle with outdated technologies and siloed operations. ➡️ 2024-2030 Developments: Expect advancements in AI, machine learning, and automation, driving more proactive threat detection and response capabilities. ➡️ Vision for 2030: A fully integrated, adaptive, and intelligent SOC leveraging real-time data and advanced analytics to foresee and neutralize threats before they escalate. ➡️ Recommendations: Embrace continuous learning, foster collaboration across industries, and prioritize agility to stay ahead of evolving cyber threats. 🌐 SOCs of the future will not only safeguard digital infrastructure but also ensure resilient and adaptive security postures. Are you ready for the future? #CyberSecurity #SOC #FutureOfTech #Innovation #AI #MachineLearning #TNOReport

22

2 commentaren

Great article by my Deloitte colleagues Casper Stap and Itan Barmes on the differences in the way that post quantum cryptography (PQC) is being considered geographically at this time. All the more reason to be grateful for Deloitte leadership support for our global PQC efforts over the last few years! #deloitte #cyberriskmanagement #quantumcyberrisk Emily Mossburg Mark Nace Adnan Amjad Isaac K. Deborah Golden Ben Shapiro Rita Gatt Julie Gleeson Amir Belkhelladi Dejan Slokar Anthony Viel

49

2 commentaren

🔧 Release: LAPS-Extractor - Tool for Retrieving LAPS Passwords 🔧 Together with my colleague Idan Lerman I am pleased to introduce LAPS Extractor, a new PowerShell script designed for securely retrieving LAPS (Local Administrator Password Solution) passwords in Active Directory environments. This script automates the process of querying organizational units (OUs) for computers with LAPS passwords and checking user permissions for reading these passwords.   https://lnkd.in/d5vgBJDa #ActiveDirectory #LAPS #PowerShell #CyberSecurity

32

2 commentaren

I am pleased to share my translated article to demystify HTTP Security Headers. Hopefully this will allow you to read it now and enlighten things! https://lnkd.in/efGEDMdF #cybersecurity #web #http #https #headers

35

2 commentaren

Last week, the Dutch Cybersecurity Insights Report 2024 from the NCTV was published (#CSBN2024). The report summarizes some well-known developments: the main threat actors in the Netherlands are nation states and criminals. The NCTV indicates that cyber-attacks are increasing in complexity and intensity. Cyber risks are calling for a broader approach as they increasingly touch upon broader organizational risks. Finally, the NCTV points out that the cybersecurity of digital processes is critical for our society but at the same time competing with other stakeholders. So far, nothing new. Some statistics: in 2023, at least 178 ransomware attacks were reported to the authorities, and over 97 zero-day exploits were used during attacks. Additionally, the following risks were highlighted: ·      Quantum computing is positioned as a current risk for national security; ·      Monocultures and large reliance on very few cloud providers form a risk; ·      The large-scale trade of personal data is considered a current risk for national security; ·      Dutch civil infrastructure #OT: bridges, highways, tunnels and sluices, are increasingly vulnerable for cyberattacks. Recent incidents already resulted in annoying traffic jams. Furthermore, the list of cyber incidents included in the report is long. Many incidents are related to ransomware, DDOS, and theft of personal data, but there were also some special cases: ·      The signal of babyTV was hijacked and used to broadcast Russian propaganda, which apparently was collateral damage, to broader signal attacks aimed at Ukraine. More radio signal abuse was performed in Poland, where an untrusted signal halted several railroad vehicles and was able to play the Russian national anthem; ·      The Belgium 112 was rerouted on March, due to a cyber-attack on the emergency systems. The root cause remains unclear; ·      The (by the USA attributed) Chinese hacker group: Volt Typhoon is targeting vital infrastructure, with the objective of preparing to sabotage it in case of a conflict; ·      Drinking water companies are on the hook this year. Both USA based companies in various states, as well as facilities in Ireland were impacted by a cyber incident. Although the objective of the attacker was different per country. Source: https://lnkd.in/eTQrak3i

9

Mission accomplished, Offensive X has ended. Now it’s time for me, Marek and Konrad to relax. But first, a quick recap of what I've learned from the conference. 1️⃣ A solid approach to Red Teaming exercises with a sprinkle of TIBER framework presented by Pieter Ceelen from (Outflank). 2️⃣ Apparently CREST created OWASP Verification Standard which is an accreditation for companies providing security assessments. This came straight from Tom Brennan during his keynote. 3️⃣ Bug hunting & exploit development was, is and will be hard(er). This is my conclusion from talk by Patroklos Argyroudis, Zisis Sialveras and Chariton Karamitas. (BTW. Good luck on your BH talk Zisis!) 4️⃣ Challenges with vulnerability disclosure within automotive industry are actually pretty similar to what we already know. So even though there is experience that could be gathered same mistakes are made. Thanks to Yashin Mehaboobe for this talk. And last, but not least we've had a chance to interact with Sofia by Hanson Robotics Limited which is a robot whose brain is powered by #AI. (Of course we immediately asked problematic questions and quickly got banned, hehe.) Thanks again to Athena and the entire team for this great event. See you next year! ☺️

69

1 commentaar

Cyentia Institute has started the planning process for the 2024 Information Risk Insights Study (IRIS). It will once again be sponsored by CISA. One of my main goals for the IRIS 2024 is to incorporate (anonymized, aggregated) insurance claims data into our analysis of publicly-reported cyber loss events. If you are a cyber insurer or reinsurer and would be interested in exploring participating in the study, please reach out. The latest IRIS has about 20k downloads and gets referenced/used widely by cyber risk teams. So, this is a good opportunity to drive visibility AND help the community. #cyberrisk #cyberinsurance #cybersecurity See previous IRIS studies:

46

Join me and Vincent van Dijk MSc on 8th of May for an open discussion about NIS2 implementation and its minimal measures 👇 (Link in description) What are the minimal requirements of upcoming NIS2 directive? How do you interpret them? What can you do stay compliant and secure at the same time? ***** 😎 Hi! I’m Andrei ⚔️ Cybersecurity consultant and pentester 🛡️ Security tips, strategies & best practices 💥 Finding vulnerabilities in your applications 👿 One step ahead hackers Like what I post? 🔔 Share, Follow & turn on notifications #cybersecurity #webinar #nis2 #risk

18

1 commentaar

We have made our best as a #committee to bring you a variety of topics and speakers for September, I sincerely believe that you would be losing a lot if you miss on knowing the #DSA or if you are looking for Career Advice, to attend With Arash Rahmani his #Webinar, or miss out on understanding the Importance of #diversity in #cybersecurity, but also How to be #Compliant in a future that's full of #Agile/#DevOps and the era of #Shiftleft

6

Wewwww 😊 Come and hear me bang on about #ThreatInformedDefence, #CyberThreatIntelligence, #SupplyChainRiskManagement + using compliance as a catalyst for operational and competitive strength - and doing so in a way that enables social impacts as well. STRATEGY. We love it. Sustainabil.IT #SustainabilIT #SustainabilityTech

7

🚨 Dutch Police Data Breach: 63,000 Officers' Information Stolen in State-Sponsored Cyberattack 🚨 A recent massive cyberattack targeted the Dutch police, compromising the names, email addresses, and job titles of over 63,000 officers. The hack, suspected to be carried out by a state-backed actor, has sparked serious concerns over the safety of law enforcement personnel, particularly those working undercover. ⚠️ Details of the attack: - The breach involved the theft of work-related contact details, although personal and investigative data were reportedly not compromised. - The Dutch government and security agencies have ramped up efforts to protect affected officers and prevent further data exposure. - Intelligence agencies suspect that foreign actors are increasingly targeting critical infrastructure, including law enforcement agencies, as part of larger geopolitical strategies. 🔒 What’s next? Authorities are investigating the full scope of the attack while enhancing security measures like two-factor authentication to mitigate future risks. This breach highlights the growing threat of state-sponsored cyberattackson national infrastructure, emphasizing the need for robust cybersecurity defenses. #Cybersecurity #DataBreach #StateActor #LawEnforcement #InfoSec #DutchPolice #CriticalInfrastructure #ThreatIntelligence #CyberAttack

9

🌐 Cybersecurity Alert: Belgian Official Targeted by Cyber Spies 🌐 Els Van Hoof, Chair of the Belgian Parliament's Foreign Affairs Committee, has reported a significant breach, with her laptop allegedly hacked by Chinese operatives in 2021. This disclosure highlights ongoing cybersecurity threats within global politics. Key Takeaways: 🔒👩‍💻 Security Breach: Van Hoof's ordeal came to light through an FBI report last month, three years after the incident. It's part of a broader pattern targeting 400 members of the Inter-Parliamentary Alliance on China, signaling persistent cyber espionage activities against global legislators critical of Beijing. 🚨 Geopolitical Tensions: The cyberattack allegedly aims to intimidate and silence political voices critical of China's policies, showcasing the extension of geopolitical disputes into cyberspace. The breach raises significant concerns about the safety of digital communications for international diplomats and lawmakers. #Cybersecurity #teamsc #informationsecurity #cyberthreatintelligence #cyber #GeopoliticalTensions #CyberEspionage #DigitalSafety

5