Kestutis M.

I believe #MITRE #ATTCK evaluation is a great initiative, particularly considering the challenges of conducting extensive testing with numerous #EDR agents in place for proof of concept. However, it's crucial to address potential misinterpretations of the results: - Less than 100% detection does not necessarily indicate a poor product. Experienced Incident Responders understand that many ransomware attack victims receive multiple alerts before an attack succeeds. The issue often lies in the organization's response rather than the tools' failure. Missing a few TTPs is not an ideal situation, but how many organizations can handle all generated alerts properly? - Conversely, achieving 100% detection does not equate to flawless performance. If you look closer into the report, some products achieved full coverage but generated over 1,000 alerts. Alert fatigue can be more detrimental than overlooking a few TTPs. Excessive alerts may overwhelm organizations, highlighting the importance of striking a balance in detection capabilities. Choosing an EDR is never an easy task, considering it technical capability and operational effectiveness are equally important. Do not just trust the sales / marketing campaigns, study the products and result yourself. What is Kernel callback, what is ETW, what is eBPF, how SOC analysts can do their job with the tool. These are also vital but has never been reflected on any products comparison.

19

1 Kommentar

#SupplyChain security lapses leading to exploitable vulnerabilities have been a concern, but the recent attack in #Lebanon underscores the potential for physical harm. - Will this impact #technological #innovation amidst increased #TPRM and #SupplyChainSecurity measures? - What steps can be taken to mitigate this risk? Share your thoughts. #CyberResilience #NationState National Institute of Standards and Technology (NIST) European Union Agency for Cybersecurity (ENISA) #CyberWar #SupplyChain CyberEdBoard Community ClubCISO The CISO Collective

16

2 Kommentare

🚨 Strengthening Cyber Resilience: A Successful Exercise at the Swiss Financial Sector Cyber Security Center (FS-CSC) 🚨 Last week, the Swiss FS-CSC conducted an intensive cyber exercise aimed at bolstering our nation's cyber defenses. The scenario? A sophisticated cyber attack targeting Switzerland's payment systems, with potential nationwide repercussions. 💡 Key Highlights: 🔐 Scenario Simulation: The exercise simulated a coordinated cyber attack on critical payment infrastructures, challenging participants to respond swiftly and effectively to protect the integrity and availability of financial services. 🤝 Collaboration: Over 40 institutions, including banks, insurance, and regulatory bodies, participated, reflecting the collective effort needed to safeguard our financial ecosystem. 📈 Business Continuity: The exercise underscored the importance of robust business continuity plans, enabling organizations to maintain operations and customer trust even in the face of cyber adversity. 💬 Insights and Learnings: Post-exercise analysis highlighted several areas for improvement, including enhanced real-time communication channels. 👥 Teamwork and Coordination: The exercise reinforced the power of teamwork and the need for seamless coordination across the sector to effectively mitigate cyber threats. I am proud to be part of this journey and of the resilience and commitment demonstrated by all participants. This exercise is a testament to our proactive stance in ensuring the security and stability of Switzerland's financial sector. A special thanks go to all members of the "Exercises & Training" chapter, especially to Marc Henauer and Cameron Dicker, who have critical knowledge from years of cyber-exercising experience. 🔗 Next Steps: We are working on a detailed report and actionable insights from the exercise, which will be available for all our members. Contact me if your organization is currently not a member of the "Exercises & Training" chapter. Let's change that because, after the exercise, it is before the next exercise. Together, we continue to build a more secure and resilient financial future! #CyberSecurity #FinancialSector #FSCSC #Resilience #Collaboration #BusinessContinuity #CyberDefense #Switzerland

28

4 Kommentare

#Security | A new study from Hive Systems uncovers a startling reality: the public is misaligned with actual cybersecurity risks, leaving organisations exposed to the most common and effective attack methods. #cyber #trends #securitythreats

3

1 Kommentar

Dear Chariman, Board-member and C-level Executive. Okay - its a few years old ... Okay - you don't want to invest in security - its fluffy and not really showing on the books ... until, yeah - the day it's too late. You think it's like buying an insurence. IT's NOT! You probably don't even realize what the below numbers means. Cybercrime gangs – 9 hours and 42 minutes Iranian-sponsored threat groups – 5 hours and 9 minutes Chinese-sponsored threat groups – 4 hours North Korean-sponsored threat groups – 2 hours and 20 minutes Russian-sponsored threat groups – 18 minutes and 49 seconds ... and you're probably told by your IT-team "everything's under control" ! IT's NOT! You think the IT-team have you in the "driver seat" - controling direction, speed, destination etc. ... THEY NOR YOU ARE! In fact you're stucked into the trunk, blindfolded! See that's false sense of security. You think you can outsmart bad people looting your digital IP! YOU CAN'T Is there any hope for you? YES - BUT YOU HAVE TO STOP SWIMMING (IT'S ACTUALLY MORE LIKE FLOATING AROUND - AND YOU WILL DROWN EVENTUALLY). So stop that - get onto safe grounds with Zafehouze ... https://zafehouze.com

8

Dragnet "Between 27 and 29 May 2024 Operation Endgame, coordinated from Europol’s headquarters, targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot. The actions focused on disrupting criminal services through arresting High Value Targets, taking down the criminal infrastructures and freezing illegal proceeds. This approach had a global impact on the dropper ecosystem. The malware, whose infrastructure was taken down during the action days, facilitated attacks with ransomware and other malicious software. Following the action days, eight fugitives linked to these criminal activities, wanted by Germany, will be added to Europe’s Most Wanted list on 30 May 2024. The individuals are wanted for their involvement in serious cybercrime activities. This is the largest ever operation against botnets, which play a major role in the deployment of ransomware. The operation, initiated and led by France, Germany and the Netherlands was also supported by Eurojust and involved Denmark, the United Kingdom and the United States. In addition, Armenia, Bulgaria, Lithuania, Portugal, Romania, Switzerland and Ukraine also supported the operation with different actions, such as arrests, interviewing suspects, searches, and seizures or takedowns of servers and domains. The operation was also supported by a number of private partners at national and international level including Bitdefender, Cryptolaemus, Sekoia, Shadowserver, Team Cymru, Prodaft, Proofpoint, NFIR, Computest, Northwave, Fox-IT, HaveIBeenPwned, Spamhaus and DIVD."

1

Suspected APT28 Cyberattack Targets German Air Traffic Control: What We Know So Far. Germany’s air traffic control authority, Deutsche Flugsicherung (DFS), has reportedly been targeted by a suspected cyberattack attributed to APT28, also known as Fancy Bear. The group, believed to be associated with Russian military intelligence (GRU), is known for its sophisticated cyber espionage campaigns targeting governmental, military, and infrastructure entities worldwide. This latest attack on Germany’s critical infrastructure underscores the increasing risk of state-sponsored cyberattacks on national security. https://lnkd.in/e3jKpHgf

4

1 Kommentar

‘Security awareness has increased’ Independently of the Swiss IT Study, Thomas Holderegger, the ‘head of security’ at Accenture, has also noticed an increase in security awareness among Swiss companies. Credits: Computerworld Schweiz #CyberSecurity #CyberResilience #DataProtection #SwissStartUp #InfoSec #CyberCrime #DigitalTransformation #CyberResilienz #Datenschutz #Cybersécurité #RésilienceCyber #Innovation #Switzerland #CyberSicurezza https://lnkd.in/e5tg7kcn

1

🧠 "The human factor ensures that a potential attacker is given the opportunity and that it indeed is a favorable attack vector" The latest episode of our Human Firewall Podcast with Bundeswehr and NATO, examines the complex relationship between #cybersecurity and global political dynamics. We explore the types of #threats we're currently facing, how #globalpolitics shape cyber threats, and discuss strategies to support the human element in cybersecurity. 🔗 Interested in discovering how #geopolitics intertwine with cybersecurity? Don't miss this enlightening episode! #HuFiPod #humanfirewallpodcast #securitypodcast

34

CISA Alert: Large-Scale Spear-Phishing Campaign A foreign threat actor is running a significant spear-phishing campaign that targets various sectors, including government and IT. The campaign involves sending emails with malicious remote desktop protocol (RDP) files to gain unauthorized access to networks and potentially deploy harmful code. CISA advises restricting outbound RDP connections, blocking the execution of RDP files, enabling multi-factor authentication, and using phishing-resistant methods like FIDO tokens. Organizations are also encouraged to deploy endpoint detection systems, conduct user training, and monitor for suspicious activities. Below is an article that outlines the issue and recommendations made by CISA. M3Power offers email security and a suite of security services designed to help protect against sophisticated phishing attacks like the one outlined by CISA. If you're concerned about the impact of such threats on your organization or need assistance implementing CISA's recommended protective measures, please contact our team for expert guidance and support. Office: 816-767-9364 | Email: [email protected]

13

In a large-scale operation against global cybercrime, a number of servers were confiscated and domains taken offline. Several people were arrested and an arrest warrant was issued for others. Credits: Swiss IT Magazine #CyberSecurity #CyberResilience #DataProtection #SwissStartUp #InfoSec #CyberCrime #DigitalTransformation #CyberResilienz #Datenschutz #Cybersécurité #RésilienceCyber #Innovation #Switzerland #CyberSicurezza https://lnkd.in/eWtBZ-Ze

2

⚠️ #Team82 updated its analysis of the #Fuxnet malware with new information about an M-Bus fuzzer included in the Fuxnet source code being used to flood remote sensors and controllers with packets. There are also some additional details from the #Blackjack hacker group about the extent of their attack against Moscow's emergency response infrastructure. https://hubs.li/Q02t1CQ10

39

Cyberattack on German Air Traffic Control: APT 28 in the Crosshairs In today’s digital era, critical infrastructures ✈️ are increasingly under threat from sophisticated cyberattacks 💀 The recent incident targeting Germany’s 🇩🇪 air traffic control (DFS) is a stark reminder of this reality. While the attack, attributed to the infamous APT 28 group (also known as “Fancy 🐻 Bear”), fortunately did not disrupt air traffic, it did paralyze internal office communications, raising significant concerns. 📍 This incident underscores the persistent threats posed by advanced persistent threat (APT) groups like APT 28, which is believed to have strong ties to Russian 🇷🇺 military intelligence (GRU). Despite the robust operational systems of DFS, which remained unaffected, the breach 🔓 in office communication systems highlights vulnerabilities that must be addressed. At Aiuken Cybersecurity, we emphasize the importance of fortified cybersecurity strategies, especially for critical infrastructures. The ability to anticipate, detect, and respond to such sophisticated threats is crucial in safeguarding 🙌🏼 national and global security Our team 😉 is committed to helping organizations bolster their defenses against such persistent threats. Now more than ever, a proactive approach to cybersecurity is not just an option—it’s a necessity 👉🏻 Protect your company 👉🏻Train your staff #Cybersecurity #APT28 #FancyBear #CriticalInfrastructure #CyberDefense #AiukenCybersecurity

24

1 Kommentar

🔑 Apple’s proposal to reduce #TLS certificate lifespans to 47 days by 2028 has sparked intense discussions in the #PKI community. Shorter lifespans strengthen security but bring significant operational challenges for managing frequent renewals. This blog delves into the revised timeline, why #automation is essential for seamless certificate lifecycle management, and how organizations can achieve crypto-agility to stay resilient. ⬇️

2

#DORA on the Horizon: Day (19/30)   Today, let’s look at few other pieces of the standard ‘‘RTS on classification of major incidents and significant cyber threats’.. 𝐑𝐞𝐜𝐮𝐫𝐫𝐢𝐧𝐠 𝐈𝐧𝐜𝐢𝐝𝐞𝐧𝐭𝐬 Recurring incidents that individually do not constitute a major incident shall be considered as one major incident where the incidents meet all of the following conditions: a) the incidents have occurred at least twice within 𝟔 months;  b) the incidents have the same apparent (and specific) 𝐫𝐨𝐨𝐭 𝐜𝐚𝐮𝐬𝐞 c) the incidents collectively categorise as a major incident as per all previous criteria Financial entities shall assess the existence of recurring incidents on a monthly basis. This adds to the complexity of assessing incidents. Incidents which may seem like a minor incident can collectively become a major incident, if it has the same apparent root cause. Hence entities, will have to assess each incident against the 6 criteria even if it seems minor. The standard specifically puts a lot of importance to the root cause identification process. Entities need to have a good understanding of how problem and knowledge management for incidents work. More details are shared on the reporting of such incidents in a different standard which is ‘RTS and ITS on incident reporting’. 𝐒𝐢𝐠𝐧𝐢𝐟𝐢𝐜𝐚𝐧𝐭 𝐜𝐲𝐛𝐞𝐫 𝐭𝐡𝐫𝐞𝐚𝐭𝐬 Along with major incidents, entities 𝐦𝐚𝐲, 𝐨𝐧 𝐚 𝐯𝐨𝐥𝐮𝐧𝐭𝐚𝐫𝐲 𝐛𝐚𝐬𝐢𝐬 notify significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. This standard specifies criteria and materiality thresholds for a threat to be considered as significant. A cyber threat shall be significant, where all of the following conditions are met: a) the cyber threat, if materialised, could affect 𝐜𝐫𝐢𝐭𝐢𝐜𝐚𝐥 𝐨𝐫 𝐢𝐦𝐩𝐨𝐫𝐭𝐚𝐧𝐭 𝐟𝐮𝐧𝐜𝐭𝐢𝐨𝐧𝐬 of the financial entity, or could affect other financial entities, third parties, clients or counterparts, based on information available; b) the cyber threat has a high probability of materialisation at the financial entity or other financial entities c) the cyber threat could meet any of the criteria set out in criteria ‘𝐂𝐫𝐢𝐭𝐢𝐜𝐚𝐥 𝐬𝐞𝐫𝐯𝐢𝐜𝐞𝐬 𝐚𝐟𝐟𝐞𝐜𝐭𝐞𝐝’ or any of the materiality thresholds set out in ‘𝐂𝐥𝐢𝐞𝐧𝐭𝐬, 𝐟𝐢𝐧𝐚𝐧𝐜𝐢𝐚𝐥 𝐜𝐨𝐮𝐧𝐭𝐞𝐫𝐩𝐚𝐫𝐭𝐬 𝐚𝐧𝐝 𝐭𝐫𝐚𝐧𝐬𝐚𝐜𝐭𝐢𝐨𝐧𝐬’, ‘𝐑𝐞𝐩𝐮𝐭𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐢𝐦𝐩𝐚𝐜𝐭’, ‘𝐃𝐮𝐫𝐚𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐬𝐞𝐫𝐯𝐢𝐜𝐞 𝐝𝐨𝐰𝐧𝐭𝐢𝐦𝐞’, ‘𝐆𝐞𝐨𝐠𝐫𝐚𝐩𝐡𝐢𝐜𝐚𝐥 𝐬𝐩𝐫𝐞𝐚𝐝’, if the threat materialised When assessing the probability: a) applicable risks related to the cyber threat, including potential vulnerabilities of the systems that can be exploited; b) the capabilities and intent of threat actors to the extent known by the entity; c) the persistence of the threat and any accrued knowledge about incidents that have impacted the entity or its third-party provider, clients or counterparts

14