John Hammond

It’s great to see Cybersecurity and Infrastructure Security Agency’s efforts in stepping up to fill the CVE enrichment gap that the National Institute of Standards and Technology (NIST) NVD has neglected to address. #cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement

83

7 Comments

Hey LinkedIn Community, I just took the CNSP exam and passed with merit. I want to thank the The SecOps Group for this opportunity. The exam covered diverse topics and wasn't too hard, but having basic and intermediate knowledge of networking and protocols is essential. It also included questions about ports, their TCP and UDP versions, and how they react when behind or not behind a firewall. Additionally, Windows and Linux topics were well covered. There were two questions on topics I hadn't encountered before, which made me realize the importance of those subjects. It's a lesson that nothing is less important in security, and the most dangerous attacks can come from unexpected areas. There was also a question (number 32 for me), about hashing algorithms. I'm confident there was no correct answer, so I chose "blowfish" instead of "bcrypt." I believe it was a mistake in the question, as "bcrypt" seems more appropriate. Additionally, other options technically fit the question, but they don't have the same properties or criteria for identification. I hope The SecOps Group will take a look into this matter. Overall, the exam was well-made, and I'm grateful for the opportunity. Keep learning and growing in your careers! Best wishes for success and good health to everyone.

35

5 Comments

CrowdStrike has updated their Falcon platform with options to stagger "channel files," the type of update that caused recent outages. This gives companies the ability to control when potentially disruptive updates are rolled out to agents. There's no "lag behind" or deferred updates, but there is now a "beta" option to receive updates before they go into production. 🤝 This is what true change management looks like- the customer's right to introduce various types of system changes (not just software patches) to a limited subset of assets, and test for stability, before a broader rollout. 🔎 Organizations should review every mission-critical operating system, application, and security tool to identify how updates are received or implemented, determine which update methods lack staged rollout options, and advocate for vendor improvements before disruptions happen.

170

19 Comments

Most people do not enjoy dealing with PCI DSS. They live their whole lives trying to avoid Compliance. They don't answer its calls, When they see it in the distance, they stop walking. If it knocks at the door, they pretend not to be home. But PCI DSS is a friend, a very good friend. Anything great in security has some level of REAL risk. And that REAL risk requires REAL compliance. The difference between the secure and the vulnerable, Is the secure do not AVOID PCI DSS, they understand it. PCI DSS is a signal that you're doing something BIG in protecting data. PCI DSS is the warning to be on your A-game. PCI DSS is the sign that lets you know that you CAN NOT FAIL in security. PCI DSS is a friend, It's there to remind you. The friend that will show up before every single audit to ensure your systems are strong. PCI DSS is there before your greatest cybersecurity challenges. It comes with requirements to guide you through the defenses. You'll move more confidently when compliant. Ever noticed the calm after meeting standards? Your systems are stronger. Your defenses are sharper. Embrace its guidelines, acknowledge its requirements then move forward SUPER CHARGED. Do not avoid PCI DSS. PCI DSS is at the door of everything secure.

4

Huntress agent added to an endpoint on Saturday; WMI persistence reported, and then today, malicious activity via CVE-2023-48788 reported. Process: 1. Create investigative timeline from WEVTX, EDR telem/detected processes. 2. Run Events Ripper, creating pivot points (installed apps, Defender detections, WMI persistence, activation of xp_cmdshell, PowerShell code run, etc.), as well as installation path of FortiClientEMS. 3. Validate FortiClientEMS CVE-2023-48788 exploit via appropriate Fortigate logs. 4. Based on investigative timeline, there were 4 distinct exploits of CVE-2023-48788 since 2024-03-25, several that included the installation of Atera, with one also including the installation of Splashtop Streamer. Patch, folks. Please patch. And limit access to endpoints as operationally necessary.

97

4 Comments

Start your holiday weekend off right with a recipe for pentest reporting success! 🥘 We've compiled all the ingredients you need to choose the best tool for managing all your offensive security workflows. Download the free eBook for 🔥 The 10 must-have ingredients in a pentest reporting automation tool 🔥 A competitor comparison chart 🔥 PlexTrac customer testimonials Get the eBook 👉 https://hubs.li/Q02Fdzst0 #PentestReporting #OffSec

3

Excellent presentation! Read the words, read between the lines, read it AGAIN! What Chris is saying about cyber crisis and Incident Response is relevant to YOU!

18

2 Comments

To reduce the risk of cyber breaches, it is imperative that organizations view vulnerabilities in the context of threat investigations to fully understand root cause and impact. "This is where Secureworks M DR solution comes into play. Upon examining their offerings in detail, we discovered that they provide comprehensive end-to-end threat monitoring.” ~ Muhammad Junaid, Group Head of IT, UMG Secureworks delivers threat detection capabilities, powered by a threat graph boasting over 40 billion nodes! Learn how Secureworks can help strengthen your cyber defense:

1

Had a great time collaborating with Andrew Wilder on Defenders in Lab Coats! For more information when this podcast episode gets released, check the below post for further details. 👇 👇 👇 CyberSpeak Labs LLC #Collaboratetolearn #cyber #cybersecurity #infosec #podcast

10

This year’s edition of the CWE Top 25 sees XSS, SQLi, and buffer overflow weaknesses in the top three spots. See how to use this list as a guide to improving your application security posture. Read more on the Invicti blog: https://okt.to/p3PWM9 #CWE #CVE #AppSec

1

Check out my interview on the #AQ2F podcast!

8

1 Comment

Articles such as this are interesting, but how useful are they for hunting, and developing protections/detections, really? https://lnkd.in/g_iC9eQr These articles come with great graphics, and provide a high-level overview of what's happening, but is there anything immediately actionable here? Jai M.

14

8 Comments

For those reflecting on outages this weekend, which choice do you feel increases your chance of resiliency while introducing less technical debt and operational overhead for your IT and security teams: 1. Operating a second EDR on some of your hosts? 2. Using an alternative operating system on some of your hosts?

14

26 Comments