Sandro Gauci

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

Thrilled to have the opportunity to analyze #vulnerability remediation timelines again, this time using data from NopSec. The chart below is based on a survival analysis of vulnerabilities across an environment. Essentially - the time it takes to remediate all affected assets after a vuln is discovered. Everytime I see analysis like this, I'm reminded of how different the real world of #vulnerabilitymanagement is from the "just patch it all yesterday" shallow advice that's so often bandied about. If it were that easy, vuln survival curves wouldn't look like this time after time. How does this square with your experience? I'll be discussing this chart and several others in a webinar next week. Register here and bring your questions, comments, and rants! https://lnkd.in/eHWDrEYN

92

26 Comments

Pager bombs. some discussion "is it is it not a cyber attack?" Some claim as the trigger was via "online" method then this = cyber attack. So question: are IEDs triggered via cell phone Xg considered a cyber attack then? Not in my opinion.

26

22 Comments

⚠ More on the Importance of ISO/IEC TS 12791:2024⚠ Many of you saw Adam Leon Smith DEng FBCS's post yesterday commenting on the release of ISO’s new technical specification (TS) document for the treatment of unwanted bias in certain AI systems. I don’t think everyone realizes what a big deal this really is, so today I thought we might explicate it a bit more. The primary goal of ISO/IEC TS 12791:2024 is to offer a structured approach for managing unwanted #bias in machine learning (ML) systems, with a specific focus on classification and regression tasks. It outlines practical methods to identify, assess, and address bias at each stage of the AI lifecycle, ultimately supporting ethical AI practices that yield fair and accurate outcomes. ➡Applicability This specification applies to organizations of all sizes and types that develop, implement, or operate AI systems, particularly those deploying ML models for classification and regression tasks. It’s useful across various verticals where AI-driven decisions impact individuals and groups, such as finance, healthcare, and public services. ➡Technical Aspects 🔶 ISO/IEC TS 12791 outlines methods to address unwanted bias in several AI lifecycle stages: 1. Inception and Stakeholder Identification - Emphasizes understanding diverse stakeholder perspectives, which helps identify and address potential biases early. 2. Design and Development - Provides guidance on selecting features and handling metadata to prevent and mitigate biases. 3. Verification and Validation - Recommends both static and dynamic testing to ensure the AI system performs consistently across diverse groups, supporting fairness and accuracy. 4. Continuous Monitoring and Re-evaluation - Mandates ongoing oversight to detect bias over time, especially when external conditions change. 5. Bias Treatment Techniques - Suggests data and algorithmic adjustments to reduce bias impact, including training adjustments, feature balancing, and use of diverse datasets. ➡ Supporting AI Governance via #ISO42001 For organizations implementing ISO42001 (AIMS), ISO/IEC TS 12791 serves as a key resource to meet your governance requirements related to fairness and non-discrimination in AI. Specifically: ✅Alignment with Risk Management (Clause 6): The standard’s focus on proactive bias identification and mitigation supports ISO42001's risk-based approach by managing bias as a potential risk factor. ✅Transparency and Accountability (Clause 7.5): Documenting bias mitigation steps fulfills ISO42001’s transparency requirements, ensuring that bias-related decisions are recorded and traceable. ✅Stakeholder Engagement (Clause 4.2): By identifying and considering stakeholders impacted by bias, organizations can enhance alignment with ethical AI governance, fostering trust and inclusivity. Special thanks to Deniz Celikkaya for coaching on today's article. A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou 🌐 https://lnkd.in/gFpvrndX

104

6 Comments

A few recent improvements by the team (🤘) to centrally collect and export forensic data from cloud resources like VMs and Containers, as well as on-premise systems: - Centrally store the evidence as .dd, .e01 or .zip - Download and export to your existing forensic tools - Download files from acquired systems, using “encrypted zip” for suspect files. -- Similar to VirusTotal Intelligence's Download File functionality for those who know it, but for your own data. All part of helping you build a central “Repeatable Investigation Process”

25

3 Comments

New Cyentia research, continuing our movie title/cover theme with SecurityScorecard. This one plays off Godzilla 2000 and focuses on digital supply chain risk among the world's largest organizations listed on the Global 2000. It joins "Close Encounters of the Third Party Kind" and "The Fast and the Frivolous," which you can find on our site at www.cyentia.com/research #cybersecurity #supplychainsecurity #thirdpartyrisk #supplychainrisk #cyberrisk

12

CMMC Level 2 Assessment Objective: Data in Transit PRACTICE: Organizations must implement cryptographic mechanisms to prevent unauthorized disclosure of controlled unclassified information (CUI) during transmission unless otherwise protected by alternative physical safeguards. ASSESSMENT: The intent of this requirement is to ensure CUI is cryptographically protected during transit, particularly on the internet. The most common way to accomplish this is to establish a transport layer security (TLS) tunnel between the source and destination using the most current version of TLS. Because the use of cryptography in this requirement is to protect the confidentiality of CUI, the cryptography used must meet the criteria specified in requirement SC.L2-3.13.11. Be prepared! Your assessor could ask to 🔍 EXAMINE system and communications protection policy. 🗣 INTERVIEW system or network administrators. 📝 TEST cryptographic mechanisms or mechanisms supporting or implementing transmission confidentiality. (CMMC Assessment Guide: Level 2 Version 2.11, page 222) #CMMC #DoD #cybersecurity #NIST #InformationSecurity https://bit.ly/45HMpUs

41

🔒 Critical Advisory Alert from CERT-In: Major CrowdStrike Falcon Sensor Update Issue 🔒 The Indian Computer Emergency Response Team (CERT-In) has issued a critical advisory following reports of widespread outages and crashes in Windows hosts due to a recent update to the CrowdStrike Falcon Sensor. This update has caused the dreaded Blue Screen of Death (BSOD), leaving systems inoperative. What Happened? The issue arose after a recent update to the CrowdStrike Falcon Sensor, which is widely used for endpoint protection. Despite CrowdStrike reverting the problematic changes, many systems remain affected. Immediate Steps to Mitigate the Issue: Boot Windows into Safe Mode or the Windows Recovery Environment. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory. Delete the file matching the pattern C-00000291*.sys. Reboot the system normally. CrowdStrike has acknowledged the issue and provided the above steps to stabilize systems. They have also updated their support portal with the latest information and recommendations. This incident underscores the critical importance of timely and effective incident response in cybersecurity. Organizations using the affected CrowdStrike Falcon Sensor are urged to apply the workaround immediately to prevent further disruptions. Staying updated with the latest patches and following best practices for incident response can mitigate such risks. Stay safe and secure! 🚀 #CyberSecurity #IncidentResponse #CERTIn #CrowdStrike #EndpointProtection #WindowsSecurity #BSOD #CyberAwareness

11

1 Comment

In my latest blog post, I discuss the role of weak fingerprinting signals in the context of bot and fraud detection. I use the example of language-related signals to illustrate how even signals that may look insignificant can be leveraged to detect inconsistencies introduced by bot frameworks and anti-detect browsers. https://lnkd.in/eZ2hcKeH

35

4 Comments

Credit Card Heist: E-commerce Sites Targeted Through WordPress Plugin Exploit Unknown threat actors are exploiting less-known WordPress code snippet plugins to embed malicious PHP code on victim sites, targeting credit card data. On May 11, 2024, Sucuri reported the abuse of the Dessky Snippets plugin, which has over 200 installations and allows users to add custom PHP code. Attackers leverage known plugin flaws or easily guessable credentials to gain admin access and install additional plugins for post-exploitation. The Dessky Snippets plugin is used to inject server-side PHP credit card skimming malware, stealing financial data. The malicious code, stored in the dnsp_settings option in the wp_options table, modifies the WooCommerce checkout process by adding fields that request credit card details. This data is then sent to "hxxps://2of[.]cc/wp-content/." The bogus form has autocomplete disabled, reducing browser warnings and suspicion. This tactic isn't new. Last month, Sucuri highlighted similar abuses involving the WPCode plugin and Simple Custom CSS and JS plugin, redirecting users to scam sites. E-commerce WordPress site owners should update their sites and plugins, use strong passwords, and regularly audit for unauthorized changes. #cybersecurity #infosec #security #wordpress #ecommerce #vulnerabilities #cybercrime

11

'Massive Cyber Attack on AWS (Amazon) Targets 230 Million Unique Cloud Environments.' The huge campaign enabled Access to 110,000 domains and more than 230 million endpoints resulting in data exfiltration into attacker controlled S3 buckets. Sophisticated attacks highlight the criticality of NOT making assumptions. Frameworks, Certifications, Massive Budgets and Teams of experts are rendered impotent and useless when basics are overlooked, even ignored. https://lnkd.in/envbXtye Before anyone asks, yes AWS DNS servers are INSECURE... Cybersec Innovation Partners GCHQ National Cyber Security Centre Cybersecurity and Infrastructure Security Agency National Institute of Standards and Technology (NIST) Central Intelligence Agency The White House ABC News BBC News CNBC CNN Fox News Media ITV News Sky News #InternetSecurity #DNS #PKI

291

40 Comments

What a great post from Dries on DORA en NIS2 differences and overlap. Answers most, if not all, of the questions I get on the subject! Must read, especially if you're active in the financial sector!

15

Recommended reading “Cybersecurity in Germany" written by Martin Schallbruch and Isabel Skierka-Canton, PhD. I just shared my review for the Cybersecurity Canon and recommended it for the Hall of Fame. This title was written in 2018, but gives tremendous insight to how cybersecurity is addressed in Germany. #cybersecuritycanon https://lnkd.in/esSTD_rw

1

Unlocking PKI: Why It's Not Yet Mainstream in Identity and Access Management 🚀"The Identity Navigator" Podcast - New Episode Alert🚀   In this episode, we dive into the world of Public Key Infrastructure (PKI) and explore why it's not more widely adopted in the Identity and Access Management (IAM) space,  despite being considered the gold standard of credential assurance by many experts.    We'll unravel the complexities of PKI, discuss its advantages and challenges, and examine the reasons behind its limited mainstream presence. Whether you're a security professional or just curious about IAM technologies, this episode will provide valuable insights into the potential of PKI and what it could mean for the future of digital security. Join us as we decode the mysteries of PKI and its role in modern identity management.   https://lnkd.in/eZdPsFy4   Tune in now and let's check them out together 🎧🔍    #TheIdentityNavigator #IAM #Podcast #TechTalk #IdentityAndAccessMAnagement

43

5 Comments

The convergence of IT Service Management (ITSM), the NIST Cybersecurity Framework (NISTCSF), and Digital Value Management best practices represents a powerful synergy that can significantly enhance an organization's operational efficiency, security posture, and overall business value. By aligning these three frameworks, organizations can establish a comprehensive approach to managing IT services, mitigating cyber risks, and protecting digital value resiliency across a digital ecosystem. The convergence of ITSM, the NIST CSF, and DVMS offers a powerful and comprehensive approach to managing IT services, mitigating cyber risks, and maximizing digital value resiliency. By aligning these frameworks, organizations can achieve a higher level of operational efficiency, business performance and trust with clients. As the digital landscape continues to evolve, the importance of this convergence will only increase. Organizations that embrace this integrated approach will be well-positioned to thrive in the digital age.  DVMS Institute #ITSM #nistcybersecurityframework #digitalvaluemanagement #cyberriskmanagement

22

3 Comments