Tomer Weingarten

Great PoC linking real-life identities to consumers of CSAM based on Infostealer infections. We did something similar at Hudson Rock, linking real-life identities to cybercriminals and even received a shoutout in Recorded's research. Infostealers contain troves of data from millions of infected computers, which can be used for various types of investigations. Expect even more cool Infostealer-related use cases to surface.

8

1 Comment

Beware of the pitfalls with XDR vendors—here’s what you need to watch out for: - XDR is not SIEM: Don't mistake XDR for a log management system. The more logs you shove into it, the worse it performs. XDR is designed for precision, not data hoarding. Manage it wisely, or you'll lose control. - SIEM isn’t XDR: Merely slapping “Nextgen” in front of your SIEM doesn’t transform it into XDR. SIEM is inherently limited by variety and high data volume—understand its boundaries before you push them. - Ignore the hype: Claims that cloud-based XDR offers better correlation are just marketing fluff. Data isolation is crucial, regardless of where it's stored. If your data isn't loaded into the cloud, it should not impact the quality of threat detection. Vendors can upload everything necessary for detection to your on-prem instance. Remember, the main difference between on-prem and cloud is cost and ease of implementation/use. Stay sharp and don’t let vendor slick talk cloud your judgment. #XDR #SIEM

100

9 Comments

Unlocking PKI: Why It's Not Yet Mainstream in Identity and Access Management 🚀"The Identity Navigator" Podcast - New Episode Alert🚀   In this episode, we dive into the world of Public Key Infrastructure (PKI) and explore why it's not more widely adopted in the Identity and Access Management (IAM) space,  despite being considered the gold standard of credential assurance by many experts.    We'll unravel the complexities of PKI, discuss its advantages and challenges, and examine the reasons behind its limited mainstream presence. Whether you're a security professional or just curious about IAM technologies, this episode will provide valuable insights into the potential of PKI and what it could mean for the future of digital security. Join us as we decode the mysteries of PKI and its role in modern identity management.   https://lnkd.in/eZdPsFy4   Tune in now and let's check them out together 🎧🔍    #TheIdentityNavigator #IAM #Podcast #TechTalk #IdentityAndAccessMAnagement

43

5 Comments

✅ (3/38) CPG 1.C OT Cybersecurity Leadership. In this new series on the Cybersecurity and Infrastructure Security Agency Cybersecurity Performance Goals - lets look at OT Cybersecurity Leadership. The intent of this CPG is to establish overall documented accountability and responsibility for your cybersecurity program for Operational Technology. We need a person's name or a position title that is unambiguous. This is very similar to the CPG we covered yesterday, 1.B for Organizational Cybersecurity Leadership, but this is about OT. The CPGs captured this as a separate goal to make sure we have alignment here. It could be the same person, but ideally this would be somebody with authority over OT and understanding of the risks to the OT environment. It's noteworthy that this leader is likely much closer to operations than an organization level leader who may be more focused on overarching corporate strategy. In most cases this will go beyond cybersecurity to include Safety, Operational Resilience and other Operations focused risks. This person needs to be a senior leader in the organization with the authority and political clout to get things done, and engages in: ➡️ Planning ➡️ Resourcing ➡️ Executing This leader is accountable and responsible, but that does not mean they have to do it all themselves. These activities can be delegated, as long as the named leader ensures cybersecurity is managed effectively. I have seen a few programs that named a figurehead to this function, but did not give them the authority they needed to execute. Or did not support the resource requests needed. Resources comes in the way of staff, budget and also organizational support. The most common mistake I see is tasking somebody that does not understand OT with this responsibility. If you have decided that your CISO or similar will be responsible, it's important that we make sure to educate them and other senior leaders to align with OT risks. In our Notion CPG template at https://lnkd.in/eP-pfWfk we provide a high level overview of this goal, and suggest a potential tool, wikijs, to capture this and other details in your program. You could just as easily use SharePoint, a Word doc or commercial tools. The tool does not matter as much as clearly defining accountability and communicating this to the organization. #cybersecurity #cpg #opensource #itsecurity #otsecurity #icssecurity #criticalinfrastructure #cybersecurityleadership

11

1 Comment

Identity Deception in ITDR - Yes this is the old Honey Pots concepts There is another interesting concepts in ITDR called as Identity Deception, it is conceptually similar to honeypots used in networking. Both involve creating decoy elements designed to attract and engage potential attackers Honey Accounts: These are fake user accounts created within identity stores (like Active Directory) that are designed to attract attackers. When an unauthorized user attempts to access these accounts, it triggers alerts and allows security teams to respond quickly. Honeytokens: These are deceptive credential profiles placed in identity caches on endpoints. They serve as early warning signals when accessed by unauthorized users, helping to identify potential breaches before they escalate   These identities should be known to your ITDR systems though, this is not a way of checking which ITDR tool is more effective. https://lnkd.in/e7ckJxGQ #TheIdentityNavigator #iam #ITDR #IdentityAndAccessManagement

21

2 Comments

This Kiteworks article provides a comprehensive guide to navigating the complex landscape of sensitive content communication risk within the context of NIST CSF 2.0. It's crucial for organizations to understand and mitigate these risks effectively, especially considering the ever-evolving cybersecurity threats. Well worth a read for any organization serious about safeguarding sensitive information in today's digital age. NIST CSF 2.0: The Ultimate Guide to Managing Sensitive Content Communications Risk 👉 Learn more: https://gag.gl/BSKceP #cybersecurity #compliance #NIST #NISTCSF #CybersecurityFramework

11

1 Comment

The NIST Cybersecurity Framework (CSF) has become a cornerstone for organizations seeking to improve their cybersecurity risk management posture. To effectively implement and leverage the CSF, many professionals are turning to certification training to enhance their knowledge and skills. Several leading providers offer comprehensive training programs covering NIST CSF’s components and how to operationalize them to deliver the secure, resilient, and trusted outcomes stakeholders and industry regulators expect. When selecting a NIST CSF training provider, consider factors such as the provider’s reputation, accreditations, training outcomes, the instructors’ experience, and the personal or organizational return on investment. By choosing a reputable provider offering accredited, comprehensive, and relevant training, individuals and organizations can enhance their cybersecurity knowledge and skills and contribute to effectively implementing NIST CSF risk and resiliency management programs within their organizations. DVMS Institute #nistcybersecurityframework #cybersecuityriskmanagement #dvmsinstitute #isaca #comptia #sans #giac #eccouncil

29

2 Comments

3 Infostealers related blogs we published this month ⬇ 1. Single Citrix Compromised Credential Results in $22,000,000 Ransom to Change Healthcare (https://lnkd.in/dV_GTvuk) 2. Identity Behind Massive Discord Spying Tool Revealed due to Infostealer Infection (https://lnkd.in/dyFkgSwJ) 3. Initial Access Brokers, Infostealers, and Everything Between Them (https://lnkd.in/d7Hx2znF) Submit your email to get free alerts in case you ever get infected by an Infostealer!

26

5 Comments

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

59

It's surprising to see many startups confidently claim their security is guaranteed simply by being hosted on platforms like Google, Azure, or AWS. While these providers offer robust infrastructure, true security requires a more nuanced approach. Relying solely on hosting services for security can be a misguided strategy. Effective security involves a tailored, multi-layered approach that goes beyond just choosing a reputable provider.

7

Mastering Wazuh Active Response: Block Malicious IPs with CoPilot & Wazuh! Check out our latest video to see how easy blocking malicious IPs can be with CoPilot and Wazuh.

173

1 Comment

The NIST Cybersecurity Framework 2.0. States that- Cybersecurity Risk Management is Part of Organizational Culture. Is Your Culture in Alignment with Your Cybersecurity Risk Management Program? Sign up for our FREE Beta today at https://lnkd.in/degjngmy The DVMS Cultural Assessment Tool (DVMS-CAT™) survey and resulting report explore the essence of that force, using the Johnson and Scholes culture web¹ as a lens to examine the complex tapestry woven within an organization. Just as a spider diligently constructs its web, thread by thread, culture also quietly binds organizational values, behaviors, and beliefs together. This intricate network, often invisible to the naked eye, exerts a powerful influence on every facet of the organization, from collaboration and innovation to decision-making and engagement. Our objective in creating the cybersecurity culture assessment tool was to unearth the implicit perceptions that guide interactions, the shared assumptions that inform choices, and the narratives that bind. The resulting data presents a nuanced picture of the cultural landscape, revealing both areas of undeniable strength and opportunities for strategic improvement. The survey should be conducted across multiple departments and management levels to illuminate this hidden web. The survey attempts to reveal and, therefore, understand the implicit rules that guide interactions, the shared assumptions that underpin choices, and the stories that bind the organization together. The results paint a portrait of the current cultural landscape, revealing both strengths and areas for growth.

8

For those waiting for the FAR update regarding #ssdf attestations... The latest Open FAR Cases report shows on May 30th Case Number 2023-002, Supply Chain Software Security, that OMB identified draft proposed FAR rule issues. OFPP, FAR and DAR staff are now working to resolve those issues. It is my understanding that this work remains opaque, and that there was no public disclosure of precisely what issues OMB identified with the proposed FAR rules relating to supply chain software security. Regardless of the status of Case 2023-002, the GSA is now requiring #ssdf attestations for anything it buys that contains software as of this past Monday morning when the government opened for business. GSA quietly updated GSA Form 7700 last month to take advantage of the CISA standard form's disclosure that "Agency-specific instructions may be provided to the software producer outside of this common form." GSA Form 7700 form has two checkboxes on page 3: Option 1: Submit the attestation online at the Cybersecurity and Infrastructure Security Agency Repository for Software Attestations and Artifacts (RSAA) portal. Option 2: Only use GSA Form 7700 submit it to a GSA specific email account. What this means to me is that if Option 1 is checked then Form 7700 is effectively a trigger mechanism for GSA to go lookup an existing attestation in RSAA. However, if Option 2 is checked, it would be interesting to know if GSA is taking that PDF and entering it into RSAA on behalf of the vendor. Option 2 also implies that a vendor may not have to attest multiple times for the same software product/version, but seemingly will have to submit multiple disparate forms to each part of the government. As we continue to see discussion about harmonizing #cybersecurity regulations, this is a great example where the government could have simply mandated using CISA RSAA. Instead, vendors will find themselves having to report using GSA Form 7700 for something through a GSA contract vehicle, and speculatively, a different form through NASA SEWP, and a different form for Dept of State, and different form for.... https://lnkd.in/eEDA-S8F If you haven't started to get serious about #software provenance ahead of the all-of-government mandate coming in September, now is a great time to start evaluating your #devsecops policies and procedures!

30

1 Comment

I'm starting a series of articles about Open Bullet 2: fraudsters' favorite tool to conduct credential stuffing attacks. https://lnkd.in/guY_t-B2 In this first article, I give an overview of Open Bullet 2, and its main features, in particular the integration with CAPTCHA farms and the possibility of importing credential stuffing Loli script. The next articles will probably be a bit more technical, e.g. to investigate the fingerprints of Open Bullet with Selenium/Puppeteer, and if attackers can easily modify them from Open Bullet to bypass detection.

29

4 Comments

This Kiteworks article outlines eleven essential requirements for a secure managed file transfer (MFT) solution. Key points include the necessity for robust security features like encryption, integrated antivirus, and hardened virtual appliances. It also emphasizes governance capabilities such as flow authoring access controls and role-based user policies. Additionally, it highlights the importance of visibility through security visualizations and consolidated logs. These measures ensure compliance, data protection, and operational efficiency in modern enterprises. Eleven Requirements for Secure Managed File Transfer 👉 Learn more: https://gag.gl/QPSQ3B #cybersecurity #FileTransfer #SecureFileTransfer #MFT

6

Managing #thirdparty #cyberrisk is hard. But it gets even harder when trying to manage 4th...5th...Nth tier #supplychain relationships because visibility, familiarity, and control tend to decline with each degree of removal. This chart, from a joint Cyentia Institute and RiskRecon, A Mastercard Company report, captures this challenge. Your organization (the square in the center) may be able to track breaches of your direct third parties. But what about all those others? Are you even aware that you're indirectly connected to - and thereby potentially exposed to - breaches of those Nth parties? We explore this topic in "Risk to the Nth-Party Degree." Link to download in comments.

238

35 Comments

TOMORROW, representatives from the Cybersecurity and Infrastructure Security Agency and Cyentia Institute will take you on a tour through a decade of data analyzing #ransomware trends. This is not your typical "ransomware is really bad cuz [insert anecdote]" event. We'll measure how bad it actually is now vs then with rigorously modeled frequency and loss estimates your organization can use to better manage this risk. Drop any questions/comments about this research here, and we'll do our best to get to them! Register here: https://lnkd.in/eiucDxcD #cyberrisk #cyberattacks #cyberresilience #cybersecurity #infosec

17

3 Comments