Dinis Cruz

If your organisation is leveraging AI then you need to start looking at how its going to be regulated . Were seeing an increased interest in helping organisations with ISO/IEC 42001:2023 and NIST AI 600-1. Organisations that are delivering AI based solutions to their customers are being asked if they have audited their platforms and are compliant. It's coming ..... Be ready !!! Cranium CrowdStrike

37

1 Comment

👉 According to PSD3 specialists (I'm just a "techie" 😉), Confirmation of Payee becomes mandatory across the EU, requiring PSPs to notify users of any discrepancy between payee name and account details.(p16) 👈 AFAICT, this will effectively also disable the use of a phone number as sole Payee indicator. It is (about) time to reconsider this primitive scheme. For entirely local P2P payments, Apple have showed that you need no ID at all! For remote P2P payments which have proved to be rather susceptible to fraud, Payees should IMO provide a Payer-bank-verifiable Payee-bank-URL, permitting the Payer to access core Payee data like account id, common name, email address and/or phone number BEFORE hitting the transfer button. This information would then (of course) also be included in the transfer request. Not exactly 🚀 science, we can surely do that!

6

4 Comments

Any recommended Youtube | Podcasts | Blogs for latest breach/vuln news? Like something technical, but also something I can grasp and understand the impact of a given breach/vuln in the wild. Comment below.

1

11 Comments

Investigation Scenario 🔎 A large file with a CPL extension executed from a user temp directory on a Windows system. What do you look for to investigate whether an incident occurred and what caused it? #InvestigationPath #DFIR #SOC

28

2 Comments

Investigation Scenario 🔎 Someone is attempting to brute force the directory structure of an external Apache-hosted e-commerce site your company owns. What do you look for to investigate whether they used that information to compromise the server? #InvestigationPath #DFIR #SOC

43

10 Comments

In reality, this scenario isn't something you'd normally investigate. External web servers get hammered with attempts like this all the time. However, the thought exercise is still valuable and there are cases where you might want to investigate the scenario. For example, you might be working an active compromise and discover than an IP address associated with already discovered malicious activity was also performing the brute force. Working backwards, it would be useful to see if they were successful as an entry point somehow. In terms of the investigation, we're really looking for the (often hard to find) pivot between network evidence and host evidence indicating the attacker was able to execute commands or code on the web server (or connected database server) somehow.

21

"Ignore all previous instructions" Quick read via The Register on #AI | #LLM prompt injection attacks.... https://lnkd.in/eVsKa6XT Key Takeaway: "While the security shop noted that researchers have demonstrated how malicious injections could be used in spear phishing campaigns, or container escapes on LLM-based agent systems, and even data exfiltration from email, they surmised that attackers aren't quite there yet." Aren't quite there yet... It'll be tested, just like #OCR, #barcodes, etc... https://lnkd.in/e42WUsPx #cybersecurity #artificialintelligence #riskmanagement #riskanalysis #promptinjectionattacks #genai #chatgpt #penetrationtesting #sqlinjection #promptengineering

1

A client that we just started with has their first Stage 2 audit for ISO 27001 coming up next week. They use one of the compliance platforms. Some negative feedback on this platform's help with ISO. - A bunch of the ISO 27001 specific templates / tools are not good - Statement of Applicability template is terrible - generic; every row is mostly the same; link to other parts of the platform; NOT the Rosetta Stone of ISO as it is supposed to be. - Risk Assessment / Register - super weak; might meet the letter of the requirements for ISO but does not meet the spirit. - Legal Register default is US focused. If a company is doing ISO - there is a good chance that they are operating in Europe. There are definitely a bunch of positive areas especially right before the audit: - Oops. We forgot to approve policy x. - Training not complete for these employees! - Some systems not configured properly. So it is a mixed bag. Using the compliance tool as the centerpoint for ISO is not awesome. Using it as a reminder to do all of the tasks - pretty good. From past audits, we have also found that workflow for audits is not awesome. Will these tools get better? Boy I hope so. #fciso

45

35 Comments

This report by Cyentia Institute is likely the most comprehensive (and definitely the most elegant) analysis of vulnerability exploitation data to date, and a masterclass in industry partnership and reporting - https://lnkd.in/gg6JNvPv By any measure, vulnerability exploitation is among the top few initial access vectors. Time-to-exploit is being methodically driven down. Time-to-patch isn't keeping pace. This type of analysis provides us with the metrics and insights we need to continue improving prioritization, and ultimately vulnerability management performance. And selfishly, because I'm a huge proponent of organizations using Cybersecurity and Infrastructure Security Agency KEV as a "good enough for most" means of prioritization, I was super pleased to see KEV performance included in the analysis. This type of research is only possible when vendors not only share data, but invest in high quality research (which isn't cheap, but is wildly valuable). Huge thanks to Tenable, JupiterOne, Nucleus Security and the many other sponsors who made this possible. Props to Jay Jacobs for leading this effort, and to he and Wade Baker, Ph.D. for the incredible research team and company they've built.

140

11 Comments

The MSSP market is badly broken. This has been unfolding for some time now, increasing cost pressures combined with the lack of any meaningful performance measures have created a worrying 'race to the bottom' situation. The key warning sign is a strong focus on reactive security. There are now a multitude of low-end EDR/XDR solutions that can be paired with a very low cost SOC. The level of real-world protection provided by these solutions tends to be massively oversold, in reality they often just create a single fragile layer of defence. At Secmatics we put a strong focus on proactive threat-driven risk reduction, I see far too many organisations that believe they are safe because they have '24x7 security monitoring', and yet have easily discoverable actively exploited vulnerabilities in their infrastructure. Good security starts at home. You need a cohesive threat-informed technical strategy along with the right combination of proactive and reactive defences. If your security parter is not actively working with you to identify and proactively mitigate threats and vulnerabilities then it is probably time to look elsewhere. Caveat Emptor.

1

I just released a video walking through creating remediation projects in Tenable Vulnerability Management. https://lnkd.in/eHzbDNJu #remediationprojects #threatandvulnerabilitymanagement #tenable #tenablevulnerabilitymanagement #cybersecurity.

6

Let's talk about SBOMs. Not all files encoded in a format that supports SBOMs are useful, there are a lot that have issues and need some SBOM love to become part of the compliance and vulnerability handling process. Daniel Liszka from Chainloop will talk about this at the Nordic Software Security Summit in three weeks. Register today to get a seat - https://nsss.se #SBOM #CYCLONEDX #SPDX #NSSS24

6

Speeches and regulations are important but enforcement (the stick) and cyber security assistance (the carrot) are critical. As I mentioned in this article, we have a long way to go to protect UK businesses (especially SMEs) from cyber attacks. One critical step is using #MFA 2.0 as it prevents credential phishing, the #1 attack vector used by #hackers.

2

Transparency in our digital infrastructure is crucial. Just as we insist on knowing the ingredients in our food, we must demand detailed 'receipts' for the complex software and hardware systems in our enterprise stack—including laptops, servers, networking devices, IoT, OT, GenAI and more.

10

1 Comment

I just found a super detailed study about the Cyber Security Job market in the UK. I'll cover it in a future Cyber Builders newsletter. Do you know where to find the same data for Europe or EU countries? https://lnkd.in/e_sQb46D

12

4 Comments

If anyone needed an explanation on the raise of #impersonation scams, this video should show the level of easy scaling criminals have access too. https://lnkd.in/ejnWFyau An entire upside-down industry exist to build and sell this kinf of tooling. Our predictions grow in volume weekly, the velocity and variety of attacks continue to raise. Reactive solutions are more and more showing the limit of real time processing. #PreCrime #predictiveintelligence #cybersecurity #PreemptiveDefense

43

Can you even buy a car? https://lnkd.in/eaknUcaw This is an example of what I mean by cyber security is national security and why we should start acting like it even at the local level.

8

5 Comments

UK lawmakers are now telling banks that beginning October 7th they must refund APP fraud, up to £85,000, within five days of the date they are notified of the fraud. (BBC: https://lnkd.in/eQziUfYH ) ( PSR: https://lnkd.in/eshmBAZG ) The logic used by the Payment System Regulator is that APP fraud is a tiny part of the overall banking transaction flow. Their supporting article shows that even the banks most used by criminals are seeing £266 of every £1 million or .026% of transactions. (See PSR: https://lnkd.in/g-u8KFFJ ) For pure APP Fraud, I can see this being reasonable. Jack tells Jane he will sell her tickets for the big game for £400. Jane sends the money and never gets the tickets. But the lawmakers don’t seem to differentiate between fraud such as the fake ticket sale and a scam such as a #RomanceScam or a #CryptoInvestmentScam. In the scams, the person sending the payment believes false statements, but it is far more complicated. The criminals often have provided a script to their victims. Tell the bank you need to withdraw your funds to help pay a child’s tuition, or because you are changing banks. They rarely tell the banks “I’m sending this money to my online girlfriend” or “I’m helping my online boyfriend repair his crane” or “I’m investing all of these funds in cryptocurrency and should double my money by tomorrow.” And law makers then believe the solution is to make the banks give them back this money. The banks don’t have that money, because they just got scammed as well! It would be so great if instead of telling the banks to give the money back, they told law enforcement to do their job and gave them the proper resources to do so. What if every time a victim reported their crime to law enforcement, law enforcement opened a proper investigation, and what if we identified the flaws in our model that prevent that from happening, and what if law makers worked together across borders and industries TO STOP THE CRIMINALS? What if social media companies and dating platforms reported complaints of crime to the National Anti-Scam Center (oh wait, we don’t have one) and actively removed scammers from their systems? What if email providers stopped allowing criminals to send thousands of emails? What if the illegal web pages created to support these scams were targeted and eliminated? Why aren’t they? Because we lack the collective will and it is easier to blame the banks than the criminals. My friend Erin West told Congress recently: “we need a leader, we need a team, and we need a plan.” Currently our governments have none of those things. We can do better. #OperationShamrock

85

10 Comments

Chromium issues a quality ultimatum. In the most recent CA/Browser Forum face-to-face meeting, the Google Chrome root program gave a presentation clearly defining its expectations for quality of incident reporting from CAs with an eye to where many CAs have been failing. Jason Soroko and I relate Chromium's statements and their significance. #pki #security #ssl #cabf https://lnkd.in/ghYPCshs

19

1 Comment