Adrian Tiron

👉 According to PSD3 specialists (I'm just a "techie" 😉), Confirmation of Payee becomes mandatory across the EU, requiring PSPs to notify users of any discrepancy between payee name and account details.(p16) 👈 AFAICT, this will effectively also disable the use of a phone number as sole Payee indicator. It is (about) time to reconsider this primitive scheme. For entirely local P2P payments, Apple have showed that you need no ID at all! For remote P2P payments which have proved to be rather susceptible to fraud, Payees should IMO provide a Payer-bank-verifiable Payee-bank-URL, permitting the Payer to access core Payee data like account id, common name, email address and/or phone number BEFORE hitting the transfer button. This information would then (of course) also be included in the transfer request. Not exactly 🚀 science, we can surely do that!

6

4 Comments

Investigation Scenario 🔎 A large file with a CPL extension executed from a user temp directory on a Windows system. What do you look for to investigate whether an incident occurred and what caused it? #InvestigationPath #DFIR #SOC

28

2 Comments

Can you even buy a car? https://lnkd.in/eaknUcaw This is an example of what I mean by cyber security is national security and why we should start acting like it even at the local level.

8

5 Comments

Weekly Vulnerability Roundup (Week Commencing: 7th October 2024) We’re back again with the Weekly Vulnerability Roundup. This report covers any vulnerabilities which have had an EPSS score change of at least 10% and any new additions to the CISA Known Exploited Vulnerabilities catalogue. A new addition to this week’s report is that we’ve added the original EPSS score to add more context to the deltas. Want to receive this report and future reports right to your inbox every Friday? Enter your email address here to sign up: https://lnkd.in/gyU9QYgx See the summary of affected technologies below and read the FULL report on our blog here: https://lnkd.in/gfa5qm3y Total CVEs:  31 References: EPSS by FIRST: https://www.first.org/ CISA KEV: https://lnkd.in/gRGpREQS Penetration Testing and SOC: https://lnkd.in/gMQXZrTs

12

Sorry but this feels insane to me! If you're a provider of SOC 2 reports, and you allow your auditee to put periodic in their control testing for their SOC 2 Type 2 report. What exactly are you testing as part of that control that it operates in an ad-hoc manner? Am I missing something? I understand firms want to 'de-risk' their reports, but it also removes the value and validity of the control testing. How do you reviewing access quarterly or within 24 hours of a user terminating when your report states you do it periodically? #SOC2 #VendorManagement #AICPA

11

1 Comment

I will be implementing an Open Source firewall on our public network - the primary goal is to restrict access to some certain inappropriate websites especially for kids. What Open Source Firewall do you suggest and why ? I'm thinking of Pfsense please let me know in the comment

3

2 Comments

Bug bounty hunters, penetration testers, and security researchers be wary! We put a lot of trust into the tools we use. They can execute arbitrary code on our systems. Here's an example of the linpeas.sh site, which is not hosted or supported by the real LinPEAS maintainer (Carlos P.), changing the code to perform some, seemingly innocent, logging. How many would've been compromised if they injected other code here? What do you do to protect yourself, and your clients during engagements? Let me know in the comments. Personally, I only test on VMs and set up a new VM for every client, so that cross-contamination of data is never possible.

89

2 Comments

A severe vulnerability in OpenSSH’s server (sshd) has been uncovered by Qualys’ Threat Research Unit (TRU), potentially affecting over 14 million Linux systems worldwide. The flaw, designated as CVE-2024-6387, allows for remote unauthenticated code execution (RCE) with root privileges on glibc-based Linux systems. This vulnerability, stemming from a signal handler race condition, impacts sshd in its default configuration. Qualys researchers have identified approximately 700,000 vulnerable external internet-facing instances among their global customer base, representing 31% of all internet-facing OpenSSH instances.

2

Time for that smug smile yet? 😆 Making the switch to Silent Push is a game-changer for Cyber Threat Intelligence analysts. Here’s why: 🎯 Sharper Insights: Get ahead of the curve with indicators of future attacks, giving you the intel you need before threats are weaponised against you. 🚀 Streamlined Workflows: Spend less time sifting through data and more time focusing on what matters—protecting your brand. 🧘‍♂️ Peace of Mind: With proactive threat detection, you can rest easy knowing your organization is always one step ahead. buff.ly/474aK7Q find out how https://buff.ly/3ySoN3t #SilentPush #IOFA #CTI

10

1 Comment

New Report on UK Cyber Resilience Strategy reveals 5% of UK CISOs: I ignore NCSC’s Guidance     Full Report = https://lnkd.in/gq_WvCYn     Bravo all to Absolute Security including Nicko van Someren for their great work on #CyberSecurity

3

Investigation Scenario 🔎 You've discovered that a Windows file server on your network has RDP enabled. It should not have RDP enabled. What do you look for to determine if a compromise has occurred? #InvestigationPath #DFIR #SOC

74

25 Comments

Who actually delivers your security monitoring? I see a lot of other #msps starting to outwardly market the fact that they deliver '24/7 security monitoring' yet find that when assessing the scale of the business, it's not practically possible to deliver that capability in-house which means that they themselves outsource security to a third party. Now, there's nothing inherently wrong with outsourcing, heck, customers outsource their IT and Security to us so I'm in no place to disagree with outsourcing but what aggravates me is when the same MSPs lie in marketing about where their security is actually coming from. Some of the many reasons our SOC is built, run and delivered by us as opposed to outsourcing; 1. Customers get to actually talk to people who know about security, and can build relationships with the people actually responsible for looking after their environment. 2. We can be incredibly dynamic to market changes or customer asks. Want some content built? Done. Need a report from some weird-ass data source that isn't in a prebuilt dashboard? Easy. You want it? Our team can do it. Probably. 3. When the shit hits the fan, we have TOTAL control over the situation (within reason) and aren't relying on someone else doing something. 4. We have TOTAL control over the team and their training. If I need the team to train up on the latest and greatest - that's within our grasp to enable that. 5. Don't like how something works? Great! We love feedback and we can change things to improve those areas. Good luck getting that from your outsourced IT providers outsourced security company. That's just to name a few. Next time you're speaking to an IT provider about their security services/offerings. Please ask EXACTLY who is delivering it and how that impacts you. #mssp #msp #marketing #dontbullshitabullshitter

37

10 Comments

The Certified Penetration Testing Consultant, C)PTC , course is designed for IT Security Professionals who are interested in taking an in-depth look into specific penetration testing and techniques used against operating systems https://lnkd.in/epfh5GwJ #cybersecurity #networking

1

I just found a super detailed study about the Cyber Security Job market in the UK. I'll cover it in a future Cyber Builders newsletter. Do you know where to find the same data for Europe or EU countries? https://lnkd.in/e_sQb46D

12

4 Comments

Are you following these steps? Do you need to go back a few steps to ensure smooth implementation of ISO 27001? Read my blog and find out 👇 https://lnkd.in/earEfWeu #iso #27001 #isms #cybersecurity #infosec #informationsecurity #smb #yorkshirebusiness #businessuk #voragosecurity

3

Interesting post below. How do you decide how much to budget for certain security problems?

2