Sijo Abraham

Check this out for some EH

4

#DiyakoSecureBow ———————————— CISO as A Service (vCISO) CYBERSECURITY ADVISORY Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department Alert CodeAA21-200 Summary This Joint Cybersecurity Advisory was written by the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) to provide information on a Chinese Advanced Persistent Threat (APT) group known in open-source reporting as APT40. This advisory provides APT40’s tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help cybersecurity practitioners identify and remediate APT40 intrusions and established footholds. APT40—aka BRONZE MOHAWK, FEVERDREAM, G0065, Gadolinium, GreenCrash, Hellsing, Kryptonite Panda, Leviathan, MUDCARP, Periscope, Temp.Periscope, and Temp.Jumper—is located in Haikou, Hainan Province, People’s Republic of China (PRC), and has been active since at least 2009. APT40 has targeted governmental organizations, companies, and universities in a wide range of industries—including biomedical, robotics, and maritime research—across the United States, Canada, Europe, the Middle East, and the South China Sea area, as well as industries included in China’s Belt and Road Initiative. On July 19, 2021, the U.S. Department of Justice (DOJ) unsealed an indictment against four APT40 cyber actors for their illicit computer network exploitation (CNE) activities via front company Hainan Xiandun Technology Development Company (Hainan Xiandun). Hainan Xiandun employee Wu Shurong cooperated with and carried out orders from PRC Ministry of State Security (MSS) Hainan State Security Department (HSSD) intelligence officers Ding Xiaoyang, Zhu Yunmin, and Cheng Qingmin to conduct CNE. Wu’s CNE activities resulted in the theft of trade secrets, intellectual property, and other high-value information from companies and organizations in the United States and abroad, as well as from multiple foreign governments. These MSS-affiliated actors targeted victims in the following industries: academia, aerospace/aviation, biomedical, defense industrial base, education, government, healthcare, manufacturing, maritime, research institutes, and transportation (rail and shipping). Click here for a PDF version of this report. https://lnkd.in/dVQDgJHU https://lnkd.in/d4fd2xtZ Special Thanks❤️😇👍🏽🙏 CISA Alumni Group Cybersecurity and Infrastructure Security Agency -Secure Business Continuity- 2024.07.31 —————————————————— #CyberSecurity #MitreAttack #Chain #RiskManagement #SecureBusinessContinuity

9

Sunday thoughts... TL:DR? OSCAL for MAS 655 Cyber Hygiene... GRC Engineering, it looks different for every organisation, mostly based on your size and industry: heavily regulated or a global SaaS versus smaller regionally isolated start-ups. More progressive cloud native global SaaS organisations *are usually* ahead of the pack in terms of building out internal tooling and treating GRC as an engineering led or focused domain. I am a big believer that to start to make any real progress here you need two things: First, you need policies and obligations defined in machine readable format so that you can build simple to complex automations. If you asked people across your organisation how many official policies you have, and within those, how many control objectives are defined, and to who they are applicable, you will get a gazillion wrong answers. Simply getting your policies into code allows for a version controlled, machine readable, machine queryable control universe. Secondly, you need other teams and stakeholders to be onboard with the automation. What is the point of having all your policies and control catalogs defined in a machine readable format if your internal stakeholders or external auditor is going to send an RFI in a spreadsheet. Yeah, we have all been there. In reality, I should swap those around, get the stakeholder alignment first, then you can go and codify all your policies. But hold on, then along came LLMs, which do a great job of taking unstructured text, PDFs, wiki pages and docs and pulling them into responses and formats we might be happy with. Do we really need to spend the time and investment moving our policies into OSCAL, when we can just wrangle it via a LLM when we need to. Yes I think we do. LLMs certainly are helpful, but for now, we still need to keep moving towards machine readable policies, machine readable control catalogs, and machine readable system security plans. Why? Well, for the obvious reasons of schema validation, consistency, version control, integration into pipelines and policy as code engines, OPA, Lula, kyverno, etc. Augment your GRC program by taking the OSCAL, throw it at an LLM and get it to summarise for different audiences, post natural language reminders to devs on control they own, and plenty more. Today I was revisiting OSCAL and playing around with augmentations with OpenAI. More to come on that later. For now, here is the MAS Notice 655 Cyber Hygiene as an OSCAL Catalog and Profile. You can use go-oscal from Defense Unicorns to validate valid schema and a bunch of other stuff. https://lnkd.in/giw_KZBc #grcengineering #platformengineering #cloudsecurity

45

5 Comments

Cyber Security Agency of Singapore (CSA) is now a CVE Numbering Authority (CNA) assigning CVE IDs for vulnerabilities reported to CSA unless covered by the scope of another CNA    https://lnkd.in/gBM959Xv    #CVE #CNA #Vulnerability #VulnerabilityManagement #Cybersecurity

5

Cyber Security Agency of Singapore (CSA) is now a CVE Numbering Authority (CNA) assigning CVE IDs for vulnerabilities reported to CSA unless covered by the scope of another CNA    https://lnkd.in/gBM959Xv    #CVE #CNA #Vulnerability #VulnerabilityManagement #Cybersecurity

9

Practical Guide with useful tips and practical information, including; NMAP OpenVAS Metasploit Exploitation Use cases Great start for Penetration Testing 👍👍👍👍 #grcico

67

1 Comment

Silent Security-Audit Killers: 1. Policies and reality are not aligned 2. Misconfigured controls 3. Lack of budget to implement necessary controls 4. Poorly managed IAM 5. Lack of remediating vulnerabilities 6. Unrealistic SLA expectations 7. Incomplete employee security awareness trainings 8. No mobile device management 9. By-passing two-person checks 10. Not understanding requirements of the audit

14

9 Comments

🔍 Unveiling NIST CSF v2.0 Audit Checklist - Part 5: Respond (RS) & Recover (RC) 🔍 Before you scroll down Follow Niranjan V for more such Infosec Content. Reach out for ISO 27001 Mentorship, Training, and Guidance, & join our exclusive infosec group for early access to creative infosec content PS: Infosec Community Link shared in Comments Section 1️⃣ Introduction to the Document: Delve into the final stages of the NIST CSF v2.0 framework with our latest checklist, focused on the crucial Respond (RS) and Recover (RC) functions. 2️⃣ What's in the Document: This part of the checklist offers detailed guidance on how to effectively manage and recover from cybersecurity incidents. It includes actionable steps, best practices, and key metrics to ensure your organization’s swift response and recovery. 3️⃣ Conclusion: Enhance your audit preparedness and resilience with this comprehensive guide. Download now to ensure your organization is ready to respond and recover from any security challenge. #NIST #NISTCSF #Respond #Recover #audit #checklist #infosec #cybersecurity #Governance #Risk #Compliance #incident #management #SOC #Disaster #recovery #Guidance #document #free

255

21 Comments

#NIST has updated its CSF Ransomware Profile to reflect CSF 2.0 and released it for public comment. Share your thoughts with #NIST! https://lnkd.in/e_H3fDHf

39

𝐌𝐅𝐀: 𝐘𝐨𝐮𝐫 𝐬𝐡𝐢𝐞𝐥𝐝 𝐚𝐠𝐚𝐢𝐧𝐬𝐭 𝐮𝐧𝐚𝐮𝐭𝐡𝐨𝐫𝐢𝐳𝐞𝐝 𝐚𝐜𝐜𝐞𝐬𝐬. Enhance your security with 2-step verification. Multi-Factor Authentication (MFA) is a critical layer of security that can prevent unauthorized access even if passwords are compromised. Passwords alone are no longer sufficient to protect sensitive data. 𝐈𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭𝐢𝐧𝐠 𝐌𝐅𝐀 𝐢𝐧𝐯𝐨𝐥𝐯𝐞𝐬: ➡ 𝐒𝐞𝐭𝐭𝐢𝐧𝐠 𝐔𝐩 𝐌𝐅𝐀: Enable MFA on all accounts, especially those accessing sensitive or critical systems. ➡ 𝐂𝐡𝐨𝐨𝐬𝐢𝐧𝐠 𝐌𝐞𝐭𝐡𝐨𝐝𝐬: Use phishing resistant options such as number matching or consider hardware tokens for an additional layer of verification. 𝐀𝐝𝐝𝐢𝐧𝐠 𝐌𝐅𝐀 𝐢𝐬 𝐚 𝐬𝐭𝐫𝐚𝐢𝐠𝐡𝐭𝐟𝐨𝐫𝐰𝐚𝐫𝐝 𝐲𝐞𝐭 𝐩𝐨𝐰𝐞𝐫𝐟𝐮𝐥 𝐬𝐭𝐞𝐩 𝐭𝐨 𝗯𝗼𝗼𝘀𝘁 𝐲𝐨𝐮𝐫 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐝𝐞𝐟𝐞𝐧𝐬𝐞𝐬. 𝗟𝗲𝗮𝗿𝗻 𝗺𝗼𝗿𝗲 𝗮𝗻𝗱 𝘁𝗮𝗸𝗲 𝗮𝗰𝘁𝗶𝗼𝗻: ✔️Check out our podcast to learn more about securing credentials - https://lnkd.in/expzNevx ✔️Download our "𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗻𝗶𝘁𝗶𝗮𝘁𝗶𝘃𝗲𝘀: 𝗬𝗼𝘂𝗿 𝗕𝗹𝘂𝗲𝗽𝗿𝗶𝗻𝘁 𝘁𝗼 𝗗𝗲𝗳𝗲𝗻𝘀𝗲-𝗜𝗻-𝗗𝗲𝗽𝘁𝗵" guide and enhance your security posture today - https://lnkd.in/ePpG6mXA --- 🛡 I'm a blue team leader and proudly work for SecurIT360, an MSSP focused on cyber protection at every level. Follow, connect and make it tough for the bad guys to succeed.

8

SIEM Use Cases For Cybersecurity Analyst 1. Brute Force Detection 2. Malware Detection 3. Data Exfiltration Detection 4. Suspicious Network Activity 5. Phishing Email Detection 6. Unauthorised Access Attempt 7. Suspicious File Download 8. Privilege Escalation Attempt 9. Lateral Movement Detection 10. Command and Control (C2) Traffic Detection 11. Anomalous User Behavior 12. DNS Tunneling Detection 13. Insider Threat Detection 14. Suspicious Process Execution 15. File Integrity Monitoring 16. Web Server Attack Detection 17. Unusual Login Location 18. DDoS Attack Detection 19. Ransomware Activity Detection 20. Exploit Attempt Detection 21. Failed Login Attempts Threshold 22. Credential Dumping Detection 23. Port Scanning Activity 24. Suspicious PowerShell Command Execution 25. Rogue Access Point Detection 26. New Service Installation 27. Anomalous Database Query 28. Unauthorised File Access 29. Suspicious USB Device Activity 30. Firewall Policy Change Detection 31. Privileged Account Login Outside Business Hours 32. Endpoint Isolation Trigger 33. Suspicious Registry Key Modification 34. Active Directory Enumeration 35. Email Spoofing Detection 36. Suspicious Application Installation 37. HTTP Anomalies Detection 38. Network Traffic Spikes 39. User Account Creation 40. File Encryption Activity Detection 41. Suspicious VPN Connection 42. DNS Query for Known Malicious Domains 43. Unusual Process Parent-Child Relationship 44. SMB Lateral Movement Detection 45. Excessive File Access by a Single User 46. Suspicious Archive File Extraction 47. Detection of Default or Weak Credentials 48. Suspicious Scheduled Task Creation 49. Remote Desktop Protocol (RDP) Anomalies 50. Beaconing Traffic Detection 51. Shadow IT Application Usage 52. Cloud Storage Upload Spikes 53. Unauthorised Configuration Change 54. Tor Network Connection Detection 55. Anomalous File Deletion Patterns 56. Unauthorised API Call Detection 57. System Crash Dump Access 58. Browser Exploit Detection 59. Abnormal SSL Certificate Usage 60. Suspicious Script Execution in Browsers 61. Suspicious Outbound Traffic Volume 62. Email Attachment with Executable Files 63. Unauthorised Network Share Access 64. Excessive Admin Privilege Assignments 65. Anomalous Device Connection in Network 66. Suspicious Command Execution in CLI 67. Endpoint Beaconing to Non-Standard Port 68. Exploit Kit Activity Detection 69. Unauthorised Cloud Account Login 70. Excessive DNS Requests to External Servers 71. Suspicious DHCP Activity 72. Unauthorised Firmware Updates 73. Unusual IoT Device Behavior 74. Credential Harvesting Attempt Detection 75. Abuse of Remote Management Tools 76. Unauthorised Access to Backup Files 77. Unusual Binary Execution from Temp Directory 78. Suspicious ZIP/RAR File Creation 79. Unauthorised Access to Financial Data 80. Abuse of Group Policy Objects (GPO) #infosec

5

This repo has a huge collection of bug bounty reports sorted by vulnerabilities such as XSS, CSRF, IDOR, LFI and more. Do check it out 🔥 GITHUB LINK: https://lnkd.in/gY4BT9a Subscribe Our YouTube Channel: https://lnkd.in/dAFg-Zgn Join Our WhatsApp Group:https://lnkd.in/gS79mu28 #CyberSecurity #cyberdefense #offensivesecurity #bugbounty #bugbountytips #bughunting #ethicalhacking #ethicalhacker #penetrationtesting #penetrationtester

34

The Ticketmaster Data Breach May Be Just the Beginning - https://lnkd.in/gRVK2PEd #Singapore #CyberSecurity #Cyber #InfoSecurity #CyberAttack #InformationSecurity #Bitdefender #DataProtection #DataSecurity #DataBreach #Phishing #Malware #Ransomware

2

Tips to strengthen your Cyber security posture Design Develop and implement an Information Security Management System (ISMS) as an overall management system to strengthen your cyber security posture . 1. Implement an ISMS (ISO 27001) as an overall management system to oversee and manage cyber security. 2. Conduct a risk assessment (as part of ISMS) to identify critical assets, threats, and vulnerabilities. 3. Implement a firewall and intrusion detection/prevention system (IDPS). 4. Use strong passwords, enable multi-factor authentication (MFA), and limit access controls. 5. Keep software and systems up-to-date with regular patches and updates. 6. Use encryption for data at rest and in transit. 7. Implement a backup and disaster recovery plan. 8. Train employees on cyber security best practices and conduct regular awareness programs (as part of ISMS). 9. Limit bring your own device (BYOD) and implement a mobile device management (MDM) solution. 10. Use reputable antivirus software and a web application firewall (WAF). 11. Monitor your network and systems regularly for suspicious activity (as part of ISMS). 12. Implement an incident response plan (as part of ISMS). 13. Consider implementing a security information and event management (SIEM) system. 14. Limit access to sensitive data and systems to only those who need it. 15. Use two-factor authentication for remote access. 16. Regularly test your systems and networks for vulnerabilities (as part of ISMS). Additionally, consider the following: - Engage with a managed security service provider (MSSP) for expert guidance and support. - Develop a cyber security policy and incident response plan (as part of ISMS). - Stay informed about the latest threats and vulnerabilities (as part of ISMS). - Consider obtaining cyber insurance to protect against financial losses. - Continuously monitor and improve your cyber security posture (as part of ISMS). By implementing an ISMS as an overall management system, you can ensure a structured and systematic approach to managing cyber security risks and protecting your organisation from cyber threats.

8