Trevor M.

I’m curious, how often do you conduct TARA reviews to ensure compliance with ISO/SAE 21434? 🤔 As a cybersecurity analyst focused on advancing TARA review services, I’d love to understand if there’s a need for a simpler approach. Are you interested in tools like BH VSEC (https://lnkd.in/gyVa-4cr) to make TARA reviews easier? Also, what specific aspects of the TARA review process do you find most challenging? Your feedback will really help us focus on what matters most. Looking forward to hearing your thoughts! Feel free to share in the comments or ping me.

16

5 Comments

I've been assisting a few orgs hit with successful ransomware deployment lately where two newish things are at play - sharing is caring. They're doing initial recon over the phone for contact details, then flooding the users with email and/or Teams spam (think thousands of messages an hour). Then they phone up and pretend to be from IT to stop the spam - they use Microsoft Quick Assist to take remote control of the system, and install an SSH reverse shell backdoor, and stop the spam run. From there they hand off to another team, who move laterally and get domain admin, then another team does exfiltration and another encrypts. Two key learnings: - Get users to report very high volumes of spam to local IT support, and not accept blind calls to help - verify somehow. - Microsoft Quick Assist is installed *by default* in Windows 10 and 11, including in the Professional and Enterprise SKUs, and traverses firewalls and VPNs by design. To check your system, Windows key - type Quick and look for Quick Assist. All it takes to connect for a remote attacker is a 6 digit PIN. Remove the feature centrally, it's a big loophole.

1

Intro to Splunk

1

When was the last time your organization performed an Internal Security Audit? Audits don’t have to be overwhelming. Start by focusing on a specific area of your business and avoid letting the scope expand too much, blurring your focus. Most importantly, set clear goals for the audit beforehand. These goals might include improving access controls, setting up or fine-tuning an intrusion detection system, or creating a password management system that enforces your password policies. Check out this article that clearly unpacks Security Audits:

2

Ever logged in as an admin for a quick fix and thought, 'What's the harm?' 🤷‍♂️ Well, using your OS admin profile for daily tasks is a no-go. It's like leaving your front door wide open – you're inviting trouble. 🚪💥 Admin accounts have the 'keys to the kingdom,' and if compromised, it's game over for your system's security. Always use a standard account for daily work to keep those cyber baddies out. 🛡️ Want to stay safe? Let's connect and keep your digital world secure. 🌐 #CyberSecurity #AdminAccountRisk #StaySafeOnline

3

Hi everyone! Today is Thursday, September 5th, 2024. In todays cyber threat report I go over data theft. This includes Verkada agreeing to a settlement, CBIZ disclosing a data breach and a recent report showing how data breaches have skyrocketed this past year. Come back tomorrow for the next one! As always, stay vigilant! #StayInformed #Cyber #Threat #Technology #Theft #Settlement #Breach #Vigilant #Report

5

I fully embrace this approach. CrowdStrike has consistently delivered a great product, and I am confident this will continue. While a layered deployment of an n-1 scenario appears to be the best option, it is important to recognize that manual actions introduce errors. Companies unable to ensure strict update policies should still consider using the OTA approach. After all, we continue to use airplanes despite occasional incidents. Lessons should be learned 💯

3

In our latest episode of "The Other Side of the Firewall," Chris Abacon explains why a delay in DigiCert's emergency revocation might be essential for critical industries. 🌐 "Consider the types of certificates and where those certificates lie, and what services they're associated to based on your industry," said Chris. This delay is crucial for sectors like healthcare and finance, where the availability of care and essential services could be severely impacted. Learn why a phased approach ensures minimal downtime and uninterrupted services. Full episode 🔗 https://lnkd.in/eq4_7uM3 #CyberSecurity #DigiCert #BusinessContinuity #CriticalInfrastructure

10

Someone recently reached out to me indicating they had been compromised by malware on their computer, phone, and home network. Here is what I suggested. I hope this helps someone: For virus removal. I recommend you seek out a local retail type solution as they are licensed and insured. Microcenter and Best Buy offer services that may be helpful. I have included links below. https://lnkd.in/eeRpXNrc https://lnkd.in/eNiGg-ST Tips for securing your life… 1. For antivirus, I think the best package out there is Bitdefender. Once you have clean systems, I suggest Bitdefender (https://lnkd.in/e8jtJC-g ) to keep them secure. 2. Make sure you keep your computers and phone up to date with the latest OS versions and updates (Microsoft, Google, Samsung, and Apple offer long support windows). If your devices are old and no longer supported, it’s time to upgrade. 3. Use a wireless router that supports WPA3 (I suggest Netgear Orbi with Netgear Armor for maximum security https://lnkd.in/eQb7vHJn ). 4. Use a password manager to keep unique and complex passwords for each account you have (I suggest Bitwarden personal with Premium subscription https://lnkd.in/e3R6cX8x ). Complex passwords are passwords that are randomly generated and include upper case, lower case, numbers, and special characters and are of at least 16 characters in length. 5. Use 2-factor authentication (2FA) on every site that supports it. I recommend using a security key such as Yubikey-5 for ideal 2FA security (https://lnkd.in/eRidiaiM ).

5

I can’t believe it’s already October 😵‍💫😵‍💫😵‍💫this year is FLYING by. It’s also the first day of Cybersecurity Awareness Month for the nerds! I thought it’d be fun to do a daily post building on cybersecurity concepts. Cybersecurity Awareness Month Post #1: What IS Cybersecurity, Anyway, and Why Care?! We’ve all been there: Social media accounts taken over posting or messaging unusual things, credit card numbers stolen, another company revealing that your personal information was leaked by a “hacker”. Why did these things happen? Can we stop them? According to Cybersecurity and Infrastructure Security Agency , Cybersecurity “is the art of protecting networks, devices, and data from unauthorized access or criminal use and the practice of ensuring confidentiality, integrity, and availability of information.” Some key tenants are mentioned here, Confidentiality, Integrity, and Availability, known as the CIA triad. Confidentiality -> only those authorized can access systems or data. Integrity -> the confidence that only authorized changes by authorized individuals have been made. Availability -> Resources are accessible when needed. So, why did our Facebook page get taken over by some weirdo posting “I can’t believe their gone…” with a fake obituary? Why did our credit card information get stolen 🏴‍☠️ when Acme Corp. was breached? Because, one or more facets of the CIA triad failed. Data was SO available, it wasn’t confidential. 🔒 Maybe you’re not a cybersecurity professional, you’re just a person with a job concerned about your own protection. What can you do today without the resources of a company to protect your data, your credit card number, your personal information and, most importantly, your Facepage?! You can: 1. THINK before you CLICK. If it doesn’t look overly mainstream, and it’s on Facebook or a “sponsored” link on Google….avoid it. 2. Get a password manager. Password managers are cheap or free and make it easy to have a strong password you don’t have to remember, it’ll log you in nearly automatically and often will check for compromised passwords. 3. Set up MFA for as many logins as you can, this will protect you for the most part even if your password is compromised 4. Use a Credit Card for online purchases, this will protect you more easily than if you use your debit card (don’t tell Dave Ramsey fans). #cybersecurity #securityengineer #cybersecurityawarenessmonth

6

One of the best things to do to advance your #cybersecurity career and network are conferences, not all of us can afford big cons or travel to attend an event, that is why BSides conferences have always been a great option. I bet there is a #bsides conference happening either in your city or nearby. Dont' believe me? check out the list 👇 https://lnkd.in/eDdfU7u9

14

I'm getting a late start on this but Advent of Cyber Day 1: Welcome back to the wareville!! Day one of the Cyberadvent: First and foremost we are analyzing malicious traffic. This should always be done in a environment meant for analysis. in this case we are using a VM hosted by Try Hack Me. The scenerio assumes that a user went to a youtube video conversion site to grab the audio track. We can see that the converted produced two items. Song.mp3 and Somg.mp3. Using EXIFTOOL to examine the files we see song.mp3 is a song file, and Somg.mp3 is a .lnk file. Using EXIFTOOL we can also see that Somg.mp3 downloads a file. User Downloads Files -> User Runs Somg.mp3 -> Downloads and run Malicous file IS.PS1 -> File Finds Crypto information -> sends to Threat Actor controlled server.

3

I posted a summary about this yesterday. Today I made an infographic page of it. I am doing this to study for my CompTIA Security+ certification exam. I learned the concepts from Professor Messer's CompTIA Security+ videos. I used an example from my own personal experience when I first encountered a mismatched hashes. It was when I was downloading Fedora Linux .iso file. Even though I downloaded from the source website, this event sent me a wake-up call to always verify the hashes and the signature file. #comptiasecurityplus #studyforexam #professormesservideos #cybersecurity #fileintegrityverification #fileauthenticityverification

2

2 Comments

Why aren't there more cybersecurity apprenticeships? Even better question, why aren't there more apprenticeships for anyone who isn't a college student? Just because you benefit from socio-economic privilege doesn't mean that you have the aptitude or competence within a field. How many people do you know that went to college and either A) Stuck with their degree from beginning to end or B) Is actively using their degree... Only 27% of people go into their degree field after graduating college and almost everyone I know switched degrees several times. Education has done a very good job of selling education - but that is leaving a massive gap in talented less financially privileged individuals that would be a perfect fit into fields that are starving for help. I'm bewildered as to how almost every apprenticeship requires you to be a enrolled in college. Most college students have absolutely no idea what they want to do, and have succumb to social pressure; after listening to their teachers, parents, guidance counselors, and peers throughout junior high and high school pushing for college. A majority of your missing talent isn't even sitting in the sidelines, they haven't even been admitted into the stadium. Choosing people who have had more time to mature and think about what career path they are passionate about makes more sense to me. Plus they've developed a colossal amount of transferable skills throughout their life that make them more than qualified for an apprenticeship position. Is this higher education bias insurmountable? How do we solve this issue?

3

2 Comments

I generally try to keep it pretty positive here but the OffSec we loved is dead, and maybe with enough public shame they’ll reconsider some of this. Pour one out… When offsec announced the recent change for OSCP and OSCP+ requiring renewal payment and CPEs, I didn’t love it… BUT, I did like that my gov buds could now potentially use it to meet 8570. HOWEVER, the real motive is now crystal clear, as in Tyler Ramsbey‘s post below. Requirement for cert maintenance with no base option like OSCP/OSCP+. I loved offsec for the quality and intensity of the material. Morten and Sickness just sunset their AWE offering at BlackHat, and I see a clear prioritization of profit through the aforementioned, and sponsored courses with a single clear motive of passing the certs. They are quickly relegating themselves to fall along with the other B-tier certs people only take to get through HR gatekeeping (comptia, isc2, etc). If we’re being honest, as soon as they sold this was bound to happen, but it still hurts. Back when I took OSCP and OSCE it really meant something. Not just to HR, but to real deal hacker-types. People would really wear it as a badge of honor, as tacky as that is. I guess I wouldn’t tell you to avoid OSCP or similar, but it’s feeling more and more like a Comptia cert, day by day. Try harder OffSec. P.S. There are still tons of great people and companies out there with a core focus on learning hard shit. I don’t want to distract from this doom and gloom, but it’s really not all doom and gloom. Maybe another post for tomorrow… #tryharderoffsec

11

🚀 Big News! 🚀 I just aced the SecOps Certified AppSec Practitioner exam! 🎉 And guess what? It was so easy, I’m starting to think my computer’s firewall might be afraid of me now.😄 A huge shoutout to The SecOps Group for providing the exam voucher for free.☕💻 Excited to put my newfound skills to work and make the digital world a safer place, one line of code at a time. If you’re into AppSec, want to swap cyber war stories, or just want to chat about the best ways to bribe your computer with snacks, hit me up! Here’s to keeping hackers on their toes and turning vulnerabilities into victory dances! 🕺💪🔒 TIP to ace the exam-> Just Complete PortSwigger Client and server side labs and you all set to get all questions correct in just 20min. #AppSec #CyberSecurity #SecOps #Certified #TechHumor #StaySafe #ProfessionalGrowth

47

19 Comments