Author: hello@alienvault.com

 “Approximately 64% of global CISOs were hired from another company” according to the 2021 MH Global CISO Research Report. The reasons are because of talent shortages, the role is still new to some companies, and companies have not created a succession plan to support internal promotions.

To overcome these challenges, companies can look to Virtual Chief Information Security Officer (vCISO) or a vCISO as a service provider. Companies should consider both the vCISO candidate and the additional “as a service” capabilities that the Provider brings to support the security program. This article covers what to look for when selecting a vCISO and vCISO as a service provider.

What to look for with the candidate

Businesses will want to align their CISO requirements with the skillset and background of the candidate vCISO. For example, the business may want a vCISO with security architecture experience when they are deploying a managed firewall service. Alternatively, if the business has a need to build a Security Operations Center (SOC) then a vCISO with SOC deployment experience might be preferred. While experience in a focused area is beneficial, a vCISO will have the following fundamental skills that align and preferably expand past the business security needs.

• Provide executive-level advisory and presentations.
• Create and track a risk register with identified cybersecurity gaps.
• Ability to develop, implement, and manage cybersecurity roadmap.
• Run tabletop exercises to identify business unit priorities and create alignment.
• Respond to third-party due diligence requests.
• Hardware and software assets as well as data identification and risk analysis.
• Reporting on metrics and key performance indicators (KPIs).
• Deliver and report on vulnerability and penetration testing.
• Oversee reporting, steering, and committee meetings.
• Review and update incident response plans.
• Identification, mitigation, and remediation activities for security related events.
• Policy and procedure development, updating and creation.
• Budget and planning development.
• Develop and run security awareness training.

What to look for in a vCISO as a service provider

vCISO as a service expands the vCISO from an individual contributor into a team that is engaged to lead a program or initiative. For example, instead of having a vCISO with SOC building experience, the entire team is brought in to create the program and build the SOC. Building a relationship with the Provider helps businesses quickly engage resources to support these larger types of initiatives. As the relationship grows, the business builds trust and expands into a valuable partnership. Below are items to consider when trying to find the right trusted partner.

• Access to a team of experts for a specific topic or concern through collaboration and sharing between the provider’s internal vCISO committee.
• Provide a diverse group of professionals that allow the customer to get a vCISO who can quickly engage within the customer’s timeline and budget.
• Leverage the diverse experience gained by the provider because of their engagements in different industries and business sizes from small business to global enterprise.
• Strategy frameworks and resources to build a security program and help create a succession plan.
• Meet the customer timelines and budgets through different levels of retainers and engagement models.
• Addressing security topics and strategy objectively while providing unbiased recommendations to security challenges.
• Coverage area to support regional, national, and global footprints.

The vCISO role is a flexible model to help customers manage cost, enhance quality of their deliverables, and reduce the time it takes to deliver on security activities. Engagements can be for a specific project, to provide coverage while a permanent CISO is identified, or to take on the role full-time. These benefits strengthen the relationship between customers and service provider which in turn, create the trusted partnership that is needed for stronger security.

The post What to look for in a vCISO as a service appeared first on Cybersecurity Insiders.

Stories from the SOC is a blog series that describes recent real-world security incident investigations conducted and reported by the AT&T SOC analyst team for AT&T Managed Extended Detection and Response customers.

Executive summary

AT&T Alien Labs does a tremendous job of developing and maintaining a database of observed Indicators of Compromise (IOC) that have been involved with at least one customer through the Open Threat Exchange (OTX). Containing over 70 million reference points that cover an array of attack types, techniques, and industries, OTX provides an additional resource for the AT&T Security Operations Center (SOC) analysts to utilize in the event that an unrecognized event takes place on a customer’s network. Not only can an analyst browse external Open Source Intelligence (OSINT), but there is also a repository of previously identified IOCs that can be referenced to point out any sort of pattern or commonality. SOC analysts also have the ability to add newly observed IOCs or remove 'out of date' indicators that are no longer a threat to the customers we serve. 

The AT&T Managed Threat Detection and Response (MTDR) SOC detected a successful connection made between a customer asset and an IOC with a known reputation via OSINT as well as OTX. Signatures provided by the OTX reveal the potential IOC associated with the 'Cobalt Strike' Malware Family, which could be in relation to C2 Beaconing activity involving a customer asset. Upon further investigation, it was determined that the activity was indeed malicious, however due to the location of the subnet it proved to be benign in this specific case.

Initial alarm review

Indicators of Compromise (IOC)

From the initial breakdown of the alarm, the analysts knew that a connection was 'Allowed' from a customer owned IP to a specific domain 'tomatoreach[.]com' and external IP '192.243.59[.]12'. The known OTX reputation of the URL and IP is what caused the alarm to trigger. The external OSINT on the two observed IOCs confirmed the suspicious reputation.

Expanded investigation

Events search

Event logs of the actual alarm do not reveal any additional IOCs or supporting information as it pertains to the activity.

Event deep dive

Upon further investigation into the involved user around the time of the event, it was determined that the user was associated with browsing an additional 20+ suspicious IOCs. Subject of these newly identified domains varies from content streaming to blog posts. Each new IOC was presented with the investigation in hopes of correlating any unrecognized activity occurring.

Response

Building the investigation

Due to the fact that the observed IOCs contain a reputation both on the OTX as well as externally, this alarm looks to be a legitimate concern for the customer. Originally, it was received with a 'High' severity. After additional review, the investigation was opened with a 'Medium' severity because there were no obvious malicious actions taking place with the involved user other than the browsing of suspicious web sites, which may not be authorized under company policy. All supporting evidence was included in the investigation, and a recommendation for remediation was also provided.

Customer interaction

Per the customer's Incident Response Plan (IRP) a phone call was not required when this investigation was opened. Once addressed, the customer was able to confirm that what occurred was not in the scope of normal business activity. However, identifying the user and the host involved, the customer was able to establish the subnet being a “Guest” network that is authorized for personal use. MTDR's full breakdown of user involved web traffic was valued and aided in the effortless closing of this investigation.

The post Suspicious behavior: OTX Indicator of Compromise – Detection & response appeared first on Cybersecurity Insiders.

Stories from the SOC is a blog series that describes recent real-world security incident investigations conducted and reported by the AT&T SOC analyst team for AT&T Managed Extended Detection and Response customers.

Executive summary

Once a malicious actor has gained initial access to an internal asset, they may attempt to conduct command and control activity. The ‘Command and Control’ (C&C) tactic, as identified by the MITRE ATT&CK© Framework, consists “of techniques that adversaries may use to communicate with systems under their control within a victim network.” Cobalt Strike is an effective adversary simulation tool used in security assessments but has been abused by malicious actors for Command and Control of victim networks. If configured by attackers, it can be used to deploy malicious software, execute scripts, and more.

This investigation began when the Managed Extended Detection and Response (MXDR) analyst team received multiple alarms involving the detection of Cobalt Strike on an internal customer asset. Within ten minutes of this activity, the attacker launched a Meterpreter reverse shell and successfully installed remote access tools Atera and Splashtop Streamer on the asset. These actions allowed the attacker to establish multiple channels of command and control. In response, the MXDR team created an investigation and informed the customer of this activity. The customer determined that an endpoint detection and response (EDR) agent was not running on this asset, which could have prevented this attack from occurring. This threat was remediated by isolating the asset and scanning it with SentinelOne to remove indicators of compromise. Additionally, Cobalt Strike, Atera, and Splashtop Streamer were added to SentinelOne’s blacklist to prevent unauthorized execution of this software in the customer environment.

Initial alarm review

Indicators of Compromise (IOC)

An initial alarm was triggered by a Windows Defender detection of Cobalt Strike on an internal customer asset. The associated log was provided to USM Anywhere using NXLog and was detected using a Windows Defender signature. Multiple processes related to Cobalt Strike were attached to this alarm.

Cobalt Strike, as mentioned previously, is a legitimate security tool that can be abused by malicious actors for Command and Control of compromised machines. In this instance, a Cobalt Strike beacon was installed on the compromised asset to communicate with the attacker’s infrastructure. Windows Defender took action to prevent these processes from running.

Immediately following the Cobalt Strike detection, an additional alarm was triggered for a Meterpreter reverse shell.

A Meterpreter reverse shell is a component of the Metasploit Framework and requires the attacker to set up a remote ‘listener’ on their own infrastructure that ‘listens’ for connections. Upon successful exploitation, the victim machine connects to this remote listener, establishing a channel for the attacker to send malicious commands. A Meterpreter reverse shell can be used to allow an attacker to upload files to the victim machine, record user keystrokes, and more. In this instance, Windows Defender also took action to prevent this process from running.

Expanded investigation

Events search

During post-exploitation, an attacker may leverage scheduled tasks to run periodically, disable antivirus, or configure malicious applications to execute during startup. To query for this activity, specific event names, such as ‘Windows Autostart Location’, ‘New Scheduled Task’, and events containing ‘Windows Defender’, were added to a filter in USM Anywhere. An additional filter was applied to display events occurring in the last 24 hours. This expanded event search provided context into attacker activity around the time of the initial Cobalt Strike and Meterpreter alarms.

Event deep dive

Just after the Cobalt Strike and Meterpreter detections, a scheduled task was created named “Monitoring Recovery.” This task is identified by Windows Event ID 106:

This scheduled task was used to install two remote monitoring and management (RMM) applications: Atera and Splashtop Streamer.

Shortly after this task was created and executed, an event was received indicating “AteraAgent.exe” was added as a Windows auto-start service.

AteraAgent.exe is associated with Atera, a legitimate computer management application that allows for remote access, management, and monitoring of computer systems, but has been abused by attackers for command and control of compromised systems.

This change was followed by an event involving “SRService.exe” being added as a Windows auto-start service on this asset:

SRService.exe is associated with Splashtop Streamer Service, a remote access application commonly used by IT support, also abused by attackers for C&C communications.
At this point, the attacker attempted to create multiple channels for command and control using Cobalt Strike, Meterpreter, Atera, and Splashtop Streamer. While the Cobalt Strike and Meterpreter sessions were terminated by Windows Defender, Atera and Spashtop Streamer were successfully added as startup tasks. This allowed the attacker to establish persistence in the customer environment. Persistence, as identified by the MITRE ATT&CK framework, allows the attacker to maintain “access to systems across restarts, changed credentials, and other interruptions that could cut off their access.”

Response

Building the investigation

All alarms and events were carefully recorded in an investigation created in USM Anywhere. The customer was immediately contacted regarding this compromise, which lead to an ‘all-hands-on-deck’ call to remediate this threat. This compromise was escalated to the customer’s Threat Hunter, as well as management and Tier 2 analysts.

Customer interaction

The MXDR team worked directly with the customer to contain and remediate this threat. This asset was quarantined from the customer network where it was scanned for malicious indicators using SentinelOne. The customer installed the SentinelOne EDR agent on this asset to protect it from any current threats. Additionally, the unauthorized applications Cobalt Strike, Meterpreter, Atera, and Splashtop Streamer were added to SentinelOne’s blacklist to prevent future execution of these programs in the customer environment.

Limitations and opportunities

Limitations

While this compromise was quickly detected and contained, the customer lacked the protection required to prevent the applications Atera and Splashtop Steamer from being installed and added as Windows auto-start programs.

Opportunities

To protect an enterprise network from current threats, a multi-layered approach must be taken, otherwise known as ‘Defense in Depth.’ This entails multiple layers of protection, including Endpoint Detection and Response, implementation of a SIEM (Security Information and Event Management System), and additional security controls. With the addition of an EDR agent installed on this asset, this malicious behavior would have been prevented. AT&T’s Managed Endpoint Security (MES) provides endpoint detection and response and can be utilized along with USM Anywhere to actively detect, prevent, and notify the customer of malicious activity in their environment.

The post Stories from the SOC – Command and Control appeared first on Cybersecurity Insiders.

This blog was written by an independent guest blogger.

Despite years of industry efforts to combat insider threats, malicious behavior can still sometimes be difficult to identify. As organizations work towards building a corporate cyber security culture, many have begun looking into zero-trust architectures to cover as many attack surfaces as possible.

This action is a step in the right direction, but it also has the potential to raise fears and generate negative responses from employees. Zero-trust security could instill demotivation and resentment if taken as a sign of poor faith and mistrust, accelerating turnover rates and bringing the Great Resignation to a peak. 

How can an organization effectively navigate zero-trust without creating friction among employers and employees? In addition, how can they get there without holding trust-building exercises as part of an in-office environment?

Why trust matters in modern business environments

The security perimeter is no longer a physical location in a modern enterprise; it is a set of access points dispersed in and delivered from the cloud. In addition to identity, the authorization model should factor in the sensitivity of the data, the source location of the request, reliability of the endpoint, etc. The use of multiple cloud platforms and a growing number of endpoints can massively expand the attack surface.

The foundation of zero-trust security starts by eliminating the word trust. Criminals today don’t break into network perimeters; they log in with stolen credentials and then move laterally across the network, hunting for more valuable data. Protecting the path from identity to data is crucial – this is at the heart of an ID-centric zero-trust architecture. To do so, security teams should:

• Validate the user
• Verify the device
• Limit access and privilege

The layers that connect identity to data play essential roles in sharing context and supporting policy enforcement. A zero-trust architecture is continuously aware of identity and monitors for a change in context.

A new memorandum by the United States Government Office of Management and Budget (OBM) outlines why zero-trust architecture is crucial to securing web applications that are relied on daily. The SolarWinds attack reminds us that supply chain security is vital, and the recent Log4Shell incident also highlights how crucial effective incident response is, so finding a way to an improved security posture is imperative.

However, zero-trust does not mean encouraging mistrust through the organization’s networks, and companies should not have to rely on technologies alone for protection. When it is a team effort, security is best applied, and successful zero-trust depends on a culture of transparency, consistency, and communication across the whole organization. But how can organizations achieve this?

The two pillars of building (Zero) Trust

When building zero-trust in any organization, two key pillars must be considered – culture and tools.

As companies begin implementing zero-trust, they must also integrate it into their culture. Inform employees what’s going on, what the process of zero-trust entails, how it impacts and benefits them and the company, and how they can support the zero-trust process. By engaging employees and challenging them to embrace skepticism towards potential threats, businesses are planting the seeds of security across their organizational ecosystem. Once employees understand the value of zero-trust, they also feel trusted and empowered to be part of the broader cybersecurity strategy.

Once zero-trust has been implemented at the core of an organization’s cybersecurity culture, the next step is to apply best practices to implement zero-trust. There are several measures that organizations can take, including:

• Use strong authentication to control access.
• Elevate authentication.
• Incorporate password-less authentication.
• (Micro)segment corporate network.
• Secure all devices.
• Segment your applications.
• Define roles and access controls.

Although Zero-Trust is technology agnostic, it is deeply rooted in verifying identities. One of the first steps is identifying the network’s most critical and valuable data, applications, assets, and services. This step will help prioritize where to start and enable zero-trust security policies to be created. If the most critical assets can be identified, organizations can focus their efforts on prioritizing and protecting those assets as part of their zero-trust journey.

The use of multi-factor authentication is crucial here. It is not a case of if to use it, but when. Phishing-resistant MFA can’t be compromised even by a sophisticated phishing attack, which means the MFA solution cannot have anything that can be used as a credential by someone who stole it. This includes one-time passwords, security questions, and imperceptible push notifications.

The challenge of implementing zero-trust

One essential problem that most enterprises are dealing with is the issue of fragmented IAM. As a result, zero-trust implementation is fraught with high complexity, risks, and costs.

The key reason behind this problem is that organizations are operating multiple identity security silos. In fact, the Thales 2021 Access Management Index report indicates that 33% of the surveyed organizations have deployed three or more IAM tools. Coordinating that many systems can, at a minimum, create operational complexity, but it can also increase the risk of fragmented security policies, siloed views of user activity, and siloed containment.

A zero-trust culture should help enterprises with IAM silos to move towards a standardized zero-trust security model, with standardized security policies and adjustments orchestrated from a central control panel across underlying silos. The process should provide insights on security policy gaps and inconsistencies and recommend security policy adjustments based on zero-trust security principles.

Conclusion

A zero-trust approach to security is to cover all attack surfaces and protect organizations, but they mean nothing without people using them appropriately. Aligning company success and security with employee success and security is crucial. Deploying a centralized IAM solution that covers all attack surfaces ensures optimal protection and helps build confidence in a zero-trust business and computing environment.

The post Building trust in a Zero-Trust security environment appeared first on Cybersecurity Insiders.

This blog was written by an independent guest blogger.

Businesses that allow employees to work from home are more likely to encounter a new security threat — compromised smart home devices.

Smart technology connected to an employee’s home network, like smart thermostats, appliances, and wearables, can all fall victim to hackers. Workers that join their employer’s network remotely can unwittingly allow compromised devices to open the doors to hackers.

The right IT policies, training and technology can help businesses counter smart home device breaches.

Why hackers target smart home devices

Attacks against smart home devices are rising fast. There were more than 1.5 billion attacks on smart devices in the first half of 2021, with attackers generally looking to steal data or use compromised devices for future breaches and cryptocurrency mining.

IoT devices are often not as guarded as laptops or smartphones and are easier to breach. They may not be updated as frequently, making them vulnerable to well-known exploits. Users may also not notice unusual activity from an IoT device as readily, allowing hackers to use it as part of a botnet or further attacks.

At the same time, the number of smart home devices is growing fast. Consumers have access to a growing range of IoT appliances, including smart refrigerators, lightbulbs, coffee makers and washing machines. The smart home device market is expanding quickly, making it a fast-growing target for hackers.

As a result, smart home technology is a prime target for hackers who need devices to stage an attack or want to break into otherwise secure networks.

Protecting business networks from smart home security threats

Employees are ultimately responsible for their home devices, but a wider range of people and organizations can take action to make them more secure. Employers, IT departments, managed service providers (MSPs) and communication service providers (CSPs) have the power to improve safety.

Some IoT device security stakeholders, like CSPs, can also provide risk mitigation to customers who may not receive security support from their employer or IT team. Employers and IT departments can work with CSPs to cover aspects of home device security that they may not be able to manage on their own.

The right WFH policies and employee training can help protect business networks from an attack that uses smart home devices. In most cases, a combination of approaches will be necessary.

One popular strategy for securing WFH employee smart devices includes appointing an internal organizational member responsible for monitoring IoT security. They should require WFH employees with smart home devices to follow best practices, like automating updates and ensuring they are digitally signed.

Requiring home IoT devices to have a Secure Boot feature available and enabled will also be helpful. This ensures that the device’s bootloader executable is genuine and has not been tampered with, initiates basic logging and checks for available firmware updates.

This feature provides an excellent foundation for IoT device security and helps automate device updating. Secure Boot also lets IT teams verify that employee smart devices are not compromised.

It’s also important for an organization to formally determine its IoT risks and build a security policy. Companies that don’t know what kinds of dangers they face won’t be able to create a set of rules and requirements for WFH employees that keeps devices and networks safe.

Make sure IoT devices don’t become a security threat

Smart home devices are increasingly popular, but they can create significant security risks for employers. Having the right IT policy will help companies manage these risks.

A well-documented IoT policy that remote workers can follow, Secure Boot devices and a designated IoT security manager will make it easier for businesses to protect their networks from smart device security threats.

The post How to counter smart home device breaches appeared first on Cybersecurity Insiders.

Cyberattacks are alarming, and establishments must increase protections, embrace a layered attitude, and cultivate security-conscious users to combat growing concerns.

Cybersecurity leaders are being inundated with talent development resources offered, encompassing hiring, recruitment, and retention of the talent pipeline. Fifty percent of hiring managers typically deem that their candidates aren’t highly qualified. Globally, the cybersecurity professional shortage is estimated to be 2.72 million based on findings in the 2021 (ISC)2 Cybersecurity Workforce Study & ISACA State of Cybersecurity 2021 Survey.

The cybersecurity workforce demand is a standing boardroom agenda for CISOs and senior executive constituents. CISOs must work collaboratively alongside human resources to solve talent pipeline challenges.

A Cyber Seek 2021 assessment indicates 597, 767 national cybersecurity job openings; thus, assertively, organizations must address this immediate disparity through consensus-building, diversity of thought, and out-of-the-box thinking. CISOs must evaluate their current hiring practices, transform ideal-to-actual job descriptions, and scrutinize their HR/organizational culture to remove aggressive tendencies and embrace a more forward-leaning, authentic, and autonomous culture.

Talent development is considered the cornerstone to increasing diversity-infused candidates into the cybersecurity pipeline. Based on my experience, I have adopted a three-prong attack strategy to cultivate a unique palette of experience and knowledge to ascertain a solid talent-rich team.

This goes beyond the outdated mentality of third-party partnerships to lean on certificates, degrees, professional associations, and internship/fellowship programming to acquire unique talent. This approach, combined with interview preparation and stretch assignments, creates real-time, mutually beneficial skills for current team members.

Lastly, providing opportunities to showcase my employees’ newfound skills through conferences (internal/external), community engagements, and immersive responsibilities provide hands-on experiences & shadowing opportunities. This helps to level up knowledge transfer and strengthen mentorship/sponsorship programs that create a more synergistic, follow-then-lead approach to build the talent pipeline.

As a transformational leader, it is paramount to change current hiring practices to further reach untapped talent inside and outside the organization using my three-prong attack strategy:

1. Go where the talent is located. Seek talent that has the drive, ambition, and tenacity to level themselves up through self-driven, multipronged vectors and consequently are thirsty and self-motivated.

2. Survey current hiring practices to identify the talent gaps. (Who? Where? Why? When? What?  & How?). Build a diverse talent pipeline and create new partnerships that are currently serving the population previously identified in the gap analysis.

3. “Try before you buy” mentality. Increase credibility and employee confidence through stretch assignments, mentorships/sponsorships, and leadership development tasks to align employees with exposure and insight before leaping to a new role.

My guiding principles lead me to ignite my employees' inner authenticity and emotional intelligence to provide a team-oriented, future-oriented culture. This culture relies heavily on an in-group collectivism mindset to tap into “their inner leader.” Deeply coupled partnerships operate from a customized driver/navigator paradigm to provide an inclusive, autonomous environment.

In my experience, cybersecurity job descriptions primarily tend to be too inelastic. The panic-stricken job descriptions can turn away competent, qualified, and dedicated applicants. Plus, many highly qualified individuals do not have college degrees nor have attended boot camps or completed traditional security training that would be excellent security candidates.

Moreover, career changers are a large part of the untapped real estate that possess lucrative, diverse skillsets (i.e., lawyers, teachers, and librarians). Hiring candidates with the desire, passion, and willingness to learn or self-hone their skills should be treasured and respected.  Pioneering thought leadership is vital to building an above-board Diversity, Equity, and Inclusion (DEI) focused organization to complement current best practices interlaced with a meet-them-where-they-are mentality to cultivate good results.

The post Challenges that impact the Cybersecurity talent pipeline appeared first on Cybersecurity Insiders.

Resilience means more than bouncing back from a fall at a moment of significantly increased threats. When addressing resilience, it’s vital to focus on long-term goals instead of short-term benefits. Resilience in the cybersecurity context should resist, absorb, recover, and adapt to business disruptions.

Cyber resiliency can’t be accomplished overnight. For the longest time, the conversation around getting the cybersecurity message across at the board level has revolved around the business language. Businesses cannot afford to treat cybersecurity as anything but a systemic issue. While the board tends to strategize about managing business risks, cybersecurity professionals tend to concentrate their efforts at the technical, organizational, and operational levels. The languages used to manage the business and manage cybersecurity are different. This might obscure both the understanding of the real risk and the best approach to address the risk. Early on in my career, I was told to think of how to transform geek to CEO speak. That piece of advice still holds true.

Why? The argument for board-level cybersecurity understanding

The reality today is that cybersecurity is a critical business issue that must be a priority for every organization. As business operations become increasingly digitized, data has become one of the most valuable assets of any organization. This has resulted in increased expectations from customers, employees, regulators, and other stakeholders that an organization has developed appropriate resilience measures to protect against the evolving cyber threat landscape. The failure to do so presents substantial risks, including loss of consumer confidence, reputational damage, litigation, and regulatory consequences.

How? Changing the narrative away from the ‘team of no.'

The ‘how’ equation comes in two distinct yet equally important parts. One is levelling-up of the board’s cybersecurity knowledge. The other ensures that security teams get board-level support. The second of these requires those teams to help change the narrative: instead of being the 'team of no,' security teams need to be seen as influencers. Enablers and not enforcers, in other words.

It's time to stop repeating how things can't be done (on security grounds). Rather, we need to preach from the business transformation book and explain how they can be. We must stop operating out of silos and build out relationships with all business players, embedding 'scenario thinking' and responsiveness into organizational cyber functioning. But just as importantly, to address the first part, the board needs to proactively plan and prepare for a cyber-crisis; only by understanding the risks can the business be in the right strategic place to combat them successfully.

Cybersecurity teams should equip the board with the following as a starting point. 

• A clear articulation of the current cyber risks facing all aspects of the business (not just IT); and
• A summary of recent cyber incidents, how they were handled, and lessons learned.
• Short- and long-term road maps outlining how the company will continue to evolve its cyber capabilities to address new and expanded threats, including the related accountabilities in place to ensure progress; and
• Meaningful metrics that provide supporting essential performance and risk indicators of successful management of top-priority cyber risks that are being managed today

Business and cybersecurity success go hand in hand

As the board’s role in cyber-risk oversight evolves, the importance of having a robust dialogue with the cyber influencers within an organization cannot be overestimated. Without close communication between boards and the cyber/risk team, the organization could be at even greater risk.

If this sounds like a cybersecurity grooming exercise, that's because it is. Preparing cybersecurity practitioners with business acumen for the board to act as the voice of educated reason isn't such a bad idea, is it? The best businesses thrive because they have people at the very top who can exert control based on informed decision-making when a crisis looms. Leaving cybersecurity out of this success equation in 2022 is a very risky game.

The post Cybersecurity and resilience: board-level issues appeared first on Cybersecurity Insiders.

This blog was written by an independent guest blogger.

The Domain Name System (DNS) is an important tool that connects devices and services together across the Internet. Managing your DNS is essential to your IT cybersecurity infrastructure. When poorly managed, DNS can become a huge landscape for attackers.

Nonetheless, when properly configured, DNS is a key line of defense against cyber threats for your organization. DNS filtering is an essential component of business cybersecurity. The best part about DNS filtering is that it is simple and effective to implement. Think of DNS filtering as another component in building a secure network. Implementing a DNS web filtering solution will protect your network in many different ways.

In this article, we’ll discuss how DNS systems work and how DNS filtering works. Then we’ll take a look at how DNS filtering can improve the security of your network. Finally, we’ll take a look at some of the other issues you might face with your DNS system.

DNS filtering to improve security

What is the Domain Name System (DNS)?

The Domain Name System, abbreviated DNS, is a tech solution for matching domain names (also called web addresses) to IP addresses, like 192.168.1.1. DNS is useful because it allows you to access the web without memorizing IP addresses. If you’re old enough, you might remember memorizing all of your friends’ telephone numbers, but today most people don’t bother.

How does DNS work?

DNS works by taking a web address and then matching it to the right IP. 

1. When you open a web browser (like Safari or Firefox), you typically type in a web address, like www.att.com, into the address bar. The browser then sends a DNS query to a specialized web server called a DNS resolver.
2. The DNS resolver then checks for an IP that matches the name you type into the web browser. It does this by either checking additional DNS servers or by checking its own cache.
3. Third, the DNS resolver “resolves” the domain by sending a reply to the user’s web browser with the correct IP address.
4. Finally, the user’s web browser contacts the server at the IP address that the DNS resolver looked up to establish a connection and load the web page.

Why is DNS so important?

The DNS system is essential to be able to access the web. Unless you have the web addresses of all your favorite websites memorized, you can’t load any web content before the DNS resolution process occurs. As a result, DNS filtering is a smart, effective way of enhancing security.

Furthermore, today web security is a top priority for businesses. This is because cybersecurity is no longer just an IT issue, but it’s a practical business issue as well.

How does DNS filtering work?

Because all DNS queries go to a DNS resolver, DNS resolvers can also be used as a filter to block malicious activity. For instance, a specially configured DNS resolver can refuse to resolve queries for certain domains that are listed on a private or publicly-maintained blocklist (sometimes called a blacklist). 

Similarly, for even greater and enhanced security, DNS resolvers can also be configured to only permit access to the web through an allowlist (or whitelist). An allowlist is a list of websites that users are permitted to access. Any attempts to visit unauthorized websites will prevent the page from loading.

For example, imagine an employee browsing Facebook at work. The employee comes across a Facebook post with a link to win $1,000,000, so they never have to work again. When the employee clicks the link, the query is first sent to a DNS resolving service. The service compares the link to a list of unapproved websites. If it turns out that the link is to an unauthorized website, the DNS resolver will block the request.

As it turns out, in this scenario, the $1,000,000 prize was actually a phishing attempt, and the request is blocked. This is one way that you can configure DNS filtering services.

Bring phishing attacks and inappropriate browsing to a halt

A blocklist isn’t just for stopping phishing attacks. A blocklist can list harmful domains and IP addresses that are curated by the cybersecurity community or are maintained by your own cybersecurity team. Consider joining OTX, the Open Threat Exchange, where you can stay up to date on the latest developments in emergent cybersecurity threats.

In some cases, DNS filters are automated, where they will check websites for malicious code. Often, JavaScript is a primary culprit for these types of malicious websites. When malicious code is detected, the website and IP address are automatically added to the blocklist.

As a plus, DNS filtering can also be used to block objectionable content. A common way this is done is by blocking adult content. Unsurprisingly, these websites frequently contain malware and cause other security concerns, so they are probably best blocked anyway. DNS filtering is often used in conjunction with a firewall to enhance security protections.

Block malware with secure DNS servers

Malware is a type of software designed to execute bad code that steals information or takes control of a user’s device. Using secure DNS servers is one way to enhance security and prevent malware from taking hold. Secure DNS servers can also enhance the privacy of user data. Cloudflare, a popular web hosting backup service, offers a DNS resolving service called 1.1.1.1 that wipes all of its DNS query logs after 24 hours.

In order to increase security, it’s recommended that you enable several additional security tools when utilizing DNS resolution services. DNSSEC is a protocol that verifies DNS resolver information and makes sure they have not been compromised by an attacker.

Additional protocols like DNS over TLS (DoT) and DNS over HTTPS (DoH) encrypt your DNS queries and replies. Encrypting DNS queries is vital because it prevents attackers from analyzing your queries and tracking which websites your users visit. When used in conjunction with threat monitoring and detection, your security will be a step above everyone else.

Stop DNS spoofing

A final form of DNS security to be aware of is DNS spoofing. DNS spoofing is sometimes called cache poisoning. When a computer takes data from a cache (a saved index), it does not know if the IP has changed since the last time a website was visited. If that’s the case, a computer can maliciously change values in a cache and redirect users to malicious websites. 

DNS spoofing is done using malicious software like Ettercap, dns2proxy, SSLStrip+, and others. In some cases, hackers gain access using a user’s computer. When they do, the hackers gain access to the DNS cache and manipulate the addresses.

Preventing DNS spoofing is easy if you utilize a secure DNS service. Additionally, preventing users from phishing attempts also helps increase security.

Use multiple forms of protection

DNS filtering is just one step in building a cybersecurity defense net. Cybersecurity is all about identifying potential threat vectors and eliminating them. Remember, there are plenty of other dangers to educate yourself and be aware of, whether it’s e-mail security to potential threats from hackers and malware. Grab AT&T’s latest cybersecurity insights report to learn more about the latest issues in cybersecurity.

Additional thought: try using tools such as GetWeave to find out what people are saying online about the security of your business.

The post How DNS filtering can help protect your business from Cybersecurity threats appeared first on Cybersecurity Insiders.

Stories from the SOC is a blog series that describes recent real-world security incident investigations conducted and reported by the AT&T SOC analyst team for AT&T Managed Extended Detection and Response customers.

Executive summary

One of the most prevalent threats today, facing both organizations and individuals alike, is the use of ransomware. In 2021, 37% of organizations said they were victims of some type of ransomware attack. Ransomware can render large amounts of important data inaccessible nearly instantly. This makes reacting to potential ransomware events in a timely and accurate manner extremely important. Utilizing an endpoint security tool is critical to  help mitigate these threats. However, it is vital to maintain vigilance and situational awareness when addressing these threats, and not rely solely on one piece of information when performing analysis.

The AT&T Managed Extended Detection and Response (MXDR) analyst team received an alarm stating SentinelOne had detected ransomware on a customer’s asset. The logs suggested the threat had been automatically quarantined, but further analysis suggested something more sinister was afoot. The same malicious executable had been detected on that asset twice before, both times reportedly being automatically quarantined. This type of persistent malware can be an indicator of a deeper infection such as a rootkit. After a more in-depth analysis and collaboration with the customer, the decision was made to quarantine and power off the asset, and replace the asset entirely due to this persistent malware.

Initial alarm review

Indicators of Compromise (IOC)

The initial SentinelOne alarm alerted us to an executable ‘mssecsvc.exe’:

The name of the executable as well as the file path is cleverly crafted to imitate a legitimate Windows program.

Expanded investigation

Events search

Searching events for the file hash revealed it had been repeatedly detected on the same asset over the last 2 weeks. In each instance the event log reports the executable being automatically quarantined by SentinelOne.

Additionally, a seach in USM Anywhere revealed two previous investigations opened for the same executable on the same asset. In both previous investigations the customer noted SentinelOne had automatically quarantined the file but did not take any further action regarding the asset.

Event deep dive

In the new instance of this alarm the event log reports SentinelOne successfully killed any processes associated with the executable and quarantined the file.

 

This may lead one to believe there is no longer a threat. But the persistent nature of this file raises more questions than the event log can answer.

Reviewing additional indicators

It is important to not rely on a single piece of information when assessing threats and to go beyond just what is contained in the logs we are given. Utilizing open-source threat intelligence strengthens our analysis and can confirm findings. Virus Total confirmed the file hash was deemed malicious by multiple other vendors.

The executable was also analyzed in JoeSandbox. This revealed the file contained a device path for a binary string ‘FLASHPLAYERUPDATESERVICE.EXE which could be used for kernel mode communication, further hinting at a rootkit.

Response

Building the investigation

Despite the event log suggesting the threat had been automatically quarantined, the combination of the repeat occurrence and the findings on open-source threat intel platforms warranted raising an investigation to the customer. The customer was alerted to the additional findings, and it was recommended to remove the asset from the network.

The customer agreed with the initial analysis and suspected something more serious. The analysts then searched through the Deep Visibility logs from SentinelOne to determine the source of the mssecsvc.exe. Deep Visibility logs allow us to follow associated processes in a storyline order. In this case, it appears the ‘mssecsvc.exe’ originated from the same ‘FlashPlayerUpdateService.exe’ we saw in the JoeSandbox analysis. Deep Visibility also showed us that mssecsvc.exe had a Parent Process of wininit.exe, which was likely to be the source of persistence.

Customer interaction

Another notable feature of USM Anywhere is the ability to take action from one centralized portal. As a result of the investigation, the analysts used the Advanced AlienApp for SentinelOne to place the asset in network quarantine mode and then power it off. An internal ticket was submitted by the customer to have the asset replaced entirely.

Limitations and opportunities

Limitations

A limiting factor for the SOC is our visibility into the customer's environment as well as what information we are presented in log data. The event logs associated with this alarm suggested there was no longer a threat, as it had been killed and quarantined by SentinelOne. Taking a single instance of information at face value could have led to further damage, both financially and reputationally. This investigation highlighted the importance of thinking outside the log, researching historical investigations, and combining multiple sources of information to improve our analysis.

The post Stories from the SOC – Persistent malware appeared first on Cybersecurity Insiders.

This blog was written by an independent guest blogger.

Cybersecurity is a complex task that is never complete. It’s an ongoing proactive practice of securing, monitoring, and mitigating threats. It’s a constant cycle where threats and vulnerabilities are detected, teams investigate and mitigate any issues, then network cybersecurity systems are reinforced to combat the next potential threat. 

Business operations increasingly rely on numerous devices and digital tools to accomplish daily tasks. Laptops, smartphones, desktops, business applications, and software are used to protect sensitive data in an era of remote and hybrid working options. In today’s world, business endpoint security is an absolute requirement to prevent costly breaches. 

There’s no question that cybersecurity should be a number one focus for businesses that want to keep growing. But it’s challenging to improve and scale cybersecurity efforts in an environment that is constantly changing, with new threats and technologies constantly being developed. To make things worse, the cybersecurity labor crisis only intensifies. 

If your organization is struggling to maintain adequate cybersecurity personnel with the necessary knowledge and expertise to protect your organization’s most valuable assets, then look at these tips to help your company stay ahead of the cybersecurity labor crisis and keep growing your business. 

What is the cybersecurity labor crisis?

As the demand for cybersecurity services increases, the number of knowledgeable cybersecurity professionals looking for full-time employment dwindles. The US Bureau of Labor Statistics expects “IT security analyst” to be one of the top 10 fastest growing occupations over the next decade. Cybersecurity only accounts for 13% of the IT market overall, yet the amount of cybersecurity job postings is three times greater than other IT positions. 

2020 marked a significant shift as remote work became a reality in nearly every industry. This has led to increased cybersecurity needs as companies add numerous devices to their networks to accommodate remote workers. The result? Overworked technology professionals and IT teams. 

Despite the number of open cybersecurity positions, companies are having difficulty finding talent to fill in the gaps. Right now, it’s a workers’ game. Without adjusting to the needs of cybersecurity workers, businesses will be left without and could leave their networks vulnerable to damaging cyber-attacks. 

Tips to keep growing your business during the cybersecurity labor crisis

The past few years have pushed cybersecurity professionals to their limits. In one of the most in-demand industries, they experience heavy workloads, long hours, and limited flexibility. It’s no wonder that technology professionals are burning out and seeking work-from-home opportunities like freelancing, consulting, building their own small businesses, or working for competitors with a better offer. 

To overcome the cybersecurity labor shortage, companies must realign their business models to a customer-centric perspective. Instead of making business decisions purely for profits and productivity, companies should also improve their company cultures to enhance their employees' work experiences. Here are some tips to help you stay ahead of the cybersecurity labor shortage and attract top talent to your organization:

Update your benefits package

Arguably, the first thing businesses should do is update their benefits package. The values of workers have changed since the onset of the pandemic. Cybersecurity professionals now seek flexibility and remote working options that allow them to more efficiently manage their work-life balance. 

Recent surveys reveal the benefits that employees want the most: 

• 95% want better health care benefits
• 71% value retirement benefits
• 50% need family leave benefits
• 29% expect a more flexible work environment

Businesses should also take a look at their compensation and benefits packages. If your competitors offer the same salary with more time off, better 401(k) options, and six months of paid parental leave, you can guess where valued employees might end up. Adjust the salaries of your cybersecurity professionals to reflect the value they bring to your company and open up your company to a broader talent pool. 

Seek out diverse talent

Job experts say that there are plenty of opportunities to bring new talent to tech positions like cybersecurity. The best way to do that is through diversity. DE&I has been a hot topic for organizations in light of recent social movements calling for equality across people of different experiences, races, and genders. But committing to seeking out diverse talent is more than just the right thing to do. It can also be a smart business move for companies that want to grow during the cybersecurity labor shortage. 

Although gender equality in the workplace has come a long way since the 60s, when women couldn’t even open a bank account, only 25% of cybersecurity professionals are women in 2022. 

Even more shocking, only 3% of cybersecurity professionals are Black. Subconscious bias plays a big part in how recruiters evaluate potential candidates, so companies should work toward more equitable recruiting practices. 

Organizations should also look at the diversity represented across their existing teams. Look for crucial skills in historically underrepresented groups such as minorities and people with disabilities. And provide plenty of opportunities for training, advancement and high-level positions for people with diverse identities. 

Leverage third party monitoring and support

Another great way to continue scaling your business is to leverage technology. There are many different types of software and managed services that help businesses maintain their cybersecurity ecosystem without an in-house IT team or to help fill in talent gaps. Digital tools that utilize automation, machine learning, and AI can help reduce the number of tedious processes that workers have to devote time to so that they can focus on higher-value activities. 

A great example of an application that helps mitigate security risks through intuitive tools and automation is Visualping. Website defacement monitoring tool makes it easy to track visual or code changes, as well as monitor links and other sensitive elements on your organization’s website. Instead of cybersecurity personnel monitoring changes 24/7, this streamlined application allows teams to get security alerts through text, email, Slack, and more. 

Invest in professional development

While spending money is the last thing that business owners looking to scale want to do, it is often the best way to ensure that you have all the resources necessary to level up. And when it comes to personnel, your investment can mean the difference between growing or lagging. 

Companies should invest in their current employees just as much as (if not more than) acquiring new talent. By providing education and cross-training for roles in your organization, you can arm yourself against the cybersecurity labor shortage. Programs such as one-on-one coaching, in-house training, and shadowing help your current employees upskill while on the job. And you build a team of talented cybersecurity professionals. 

Professional development is a great way to retain employees and improve their skills simultaneously. Organizations should outline clear career paths for each role and offer competitive compensation to attract driven individuals that are eager to learn. This gives your workers a goal to work towards, as well as builds a sense of ownership and loyalty among employees. 

Partner with higher education

Another great way to stay ahead of the labor shortage and enhance your operations is to develop partnerships with higher education and other industry-related programs. Top companies know this secret to success and consistently offer funding and resources in exchange for a direct funnel into cybersecurity positions. Companies can offer internships, speak at industry events, and recruit at universities to find unique talent that can help scale your business. 

There are many ways that organizations can get involved in the education sector. Look at your competitors and discover the ways that they are encouraging young college students to look into the field of cybersecurity or how you can create a direct funnel of talented individuals to your organization. 

Final thoughts

The demand for, and demands on cybersecurity professionals has left workers burnt-out, tired, and willing to leave their positions to seek out better opportunities on their own. Companies that want to keep growing their business are facing challenges as the cybersecurity workforce dwindles. According to a recent study, 57% of organizations feel the negative impacts of the cybersecurity labor shortage. To attract and retain knowledgeable cybersecurity professionals, companies need to develop new employment models that give workers the things they need to be satisfied and successful. 

The post How to stay ahead of the Cybersecurity labor crisis and keep growing your business appeared first on Cybersecurity Insiders.