Wednesday, April 27, 2022
Monday, June 21, 2021
What is a security breach?
A security breach is any incident that results in unauthorized access to computer data, applications, networks or devices. It results in information being accessed without authorization. Typically, it occurs when an intruder is able to bypass security mechanisms.
Technically, there's a distinction between a security breach and a data breach. A security breach is effectively a break-in, whereas a data breach is defined as the cybercriminal getting away with information. Imagine a burglar; the security breach is when he climbs through the window, and the data breach is when he grabs your pocketbook or laptop and takes it away.
Confidential information has immense value. It's often sold on the dark web; for example, names and credit card numbers can be bought, and then used for the purposes of identity theft or fraud. It's not surprising that security breaches can cost companies huge amounts of money. On average, the bill is nearly $4m for major corporations.
It's also important to distinguish the security breach definition from the definition of a security incident. An incident might involve a malware infection, DDOS attack or an employee leaving a laptop in a taxi, but if they don't result in access to the network or loss of data, they would not count as a security breach.
Examples of a security breach
When a major organization has a security breach, it always hits the headlines. Security breach examples include the following:
Equifax - in 2017, a website application vulnerability caused the company to lose the personal details of 145 million Americans. This included their names, SSNs, and drivers' license numbers. The attacks were made over a three-month period from May to July, but the security breach wasn't announced until September.
Yahoo - 3 billion user accounts were compromised in 2013 after a phishing attempt gave hackers access to the network.
eBay saw a major breach in 2014. Though PayPal users' credit card information was not at risk, many customers' passwords were compromised. The company acted quickly to email its users and ask them to change their passwords in order to remain secure.
Dating site Ashley Madison, which marketed itself to married people wishing to have affairs, was hacked in 2015. The hackers went on to leak a huge number of customer details via the internet. Extortionists began to target customers whose names were leaked; unconfirmed reports have linked a number of suicides to exposure by the data breach.
Facebook saw internal software flaws lead to the loss of 29 million users' personal data in 2018. This was a particularly embarrassing security breach since the compromised accounts included that of company CEO Mark Zuckerberg.
Marriott Hotels announced a security and data breach affecting up to 500 million customers' records in 2018. However, its guest reservations system had been hacked in 2016 - the breach wasn't discovered until two years later.
Perhaps most embarrassing of all, being a cybersecurity firm doesn't make you immune - Czech company Avast disclosed a security breach in 2019 when a hacker managed to compromise an employee's VPN credentials. This breach didn't threaten customer details but was instead aimed at inserting malware into Avast's products.
A decade or so ago, many companies tried to keep news of security breaches secret in order not to destroy consumer confidence. However, this is becoming increasingly rare. In the EU, the GDPR (General Data Protection Regulations) require companies to notify the relevant authorities of a breach and any individuals whose personal data might be at risk. By January 2020, GDPR had been in effect for just 18 months, and already, over 160,000 separate data breach notifications had been made - over 250 a day.
Thursday, June 17, 2021
What is web application firewall
A web application firewall sits logically between your web application and a server that supports the Internet, and protects against certain HTML attacks such as cross-site scripting, SQL injection, and more. It can be hardware or cloud based, or it can be baked into the application itself to determine whether each client trying to access the server should allow access.
next generation firewall
Packets can be filtered using more than link status and source and destination addresses. This is where NGFW comes into play. It unifies the rules for what individual apps and users can do and brings together data collected from different technologies to make better decisions about what traffic to allow and what traffic to leave.
For example, some of these NGFWs perform URL filtering, terminate Secure Sockets Layer (SSL) and Transport Layer Security (TLS) connections, and support software-defined wide area networks (SD-WAN) over WANs for dynamic SD connections. apply.
Tuesday, June 15, 2021
Managed service delivery model Paas & SaaS
What is a managed service delivery model? The delivery model for managed services depends on the type of service being managed or delivered. For example, cloud models typically include three types of delivery models:
PaaS (Platform as a Service)
Software as a Service (SaaS)
Infrastructure as a Service (IaaS)
Here's what you need to know about each model and the benefits it can bring to your business.
PaaS
In the PaaS software delivery model, developers rent everything they need to build a specific application. A cloud provider is required to provide access to the operating system, infrastructure and development tools.
PaaS is known to simplify web application development. From a developer's point of view, the entire backend management process happens behind the scenes. Although PaaS looks similar to serverless computing, there are many differences between the two.
Examples of PaaS include Magento Commerce Cloud, Force.com, Stratos, Apache Stratos, OpenShift, Windows Azure, and Heroku.
software as a service
SaaS is a software delivery model in which a third-party service provider is responsible for hosting the application. A provider is a person who provides these applications to customers over the Internet.
SaaS is considered closely related to on-demand computing software and application service provider (ASP) software delivery models. As with ASP, this model involves a provider that hosts the client's software and then delivers it to authorized end users over the Internet.
Thursday, June 10, 2021
How to prevent data breaches
There are no security tools or controls that can completely prevent data breaches. Common sense security practices are the most reasonable way to prevent data breaches. It includes well-known security fundamentals such as:
Conduct ongoing vulnerability assessments
penetration testing
Implement proven malware protection
Use strong passwords/passwords
Continuous application of necessary software patches to all systems
While these steps will help prevent intrusion into your environment, information security experts recommend encrypting sensitive data on-premises or in the cloud. If you successfully break into your environment, encryption prevents threat actors from accessing your real data.
Additional measures to prevent breaches and minimize their impact include well-written security policies for employees and ongoing security awareness training to promote these policies and those trained.
These policies may include concepts such as the Principle of Least Privileges (POLP), which give employees the least privilege and administrative powers to do their job.
Organizations should also have an incident response plan that can be implemented in the event of an intrusion or breach. These plans typically include a formal process for identifying, containing, and quantifying security incidents.
Tuesday, June 8, 2021
Best key Functions Performed by the SOC
Taking stock of available resources
SOC is responsible for two types of assets: the various devices, processes, and applications for which they are responsible for protection, and the defensive tools at their disposal to ensure that protection.
What the SOC protects
SOC Network cannot protect devices and data that it cannot see. Without visibility and control of devices in the cloud, there are likely to be blind spots in the network security posture that can be found and exploited. SOC's goal is therefore to have a complete picture of the business threat landscape, including not only the different types of terminals, servers and software on the site, but also third-party services and the traffic that flows between them. assets.
How SOC is protected
The SOC must also have a complete understanding of all available cybersecurity tools and all workflows used in the SOC. This increases agility and allows the SOC to operate at maximum efficiency.
Preventive preparation and maintenance.
Even the best equipped and fastest response processes cannot avoid problems in the first place. To help keep attackers at bay, the SOC implements preventive measures, which can be divided into two main categories.
Preparation
Team members must stay informed about the latest security innovations, the latest cybercrime trends, and the development of new threats on the horizon. This research can help create the creation of a safety roadmap that provides guidance for the company's future cyber security efforts, and a disaster recovery plan that will serve as a quick guide in the worst case scenario. case.
Preventive maintenance
This step includes all measures taken to hinder successful attacks, including regular maintenance and updating of existing systems; update firewall policies; repairing vulnerabilities; and the white list, black list and security of the application.
Continuous proactive monitoring
The tools used by SOC scan the network 24/7 to report any anomalies or suspicious activity. 24 hour network monitoring allows SOC to be immediately informed of emerging threats, providing the best opportunity to prevent or mitigate damage. Monitoring tools can include SIEM or EDR, the more advanced of which can use behavioral analysis to "teach" systems the difference between daily operations and actual threat behavior, thereby minimizing the amount of screening. and analysis to be performed by humans
Classification and management of alerts
When the monitoring tools issue alerts, it is the SOC's responsibility to examine each one closely, to eliminate any false positives and to determine how aggressive the real threats are and what they can target. This allows them to properly classify emerging threats, first addressing the most pressing issues.
Responding to threats
These are the actions that most people think of when they think of SOC. As soon as an incident is confirmed, the SOC acts as the first responder, performing actions such as closing or isolating endpoints, stopping dangerous processes (or preventing their execution), deleting files, etc. The objective is to meet the need and have the least possible impact on business continuity.
Recovery and sanitation
After an incident, the SOC will work to restore systems and recover lost or compromised data. This may include cleaning and restarting endpoints, reconfiguring systems, or, in the case of ransomware attacks, implementing viable backups to prevent ransomware. If successful, this step will return the network to the state it was in before the incident.
Records management
SOC is responsible for collecting, maintaining and periodically reviewing the log of all network activities and communications for the entire organization. This data helps define a baseline for "normal" network activity, can reveal threats, and can be used for correction and forensic analysis after an incident. Many SOCs use SIEM to aggregate and correlate data streams from applications, firewalls, operating systems, and endpoints, which produce their own internal records.
Root cause investigation
After an incident, the SOC is responsible for determining exactly what happened when, how, and why. During this investigation, SOC uses log data and other information to trace the problem back to its source, which will help prevent similar problems in the future.
Refine and improve security
Cybercriminals are constantly improving their tools and tactics, and to stay one step ahead of them, SOC must constantly improve. During this stage, the plans outlined in the safety roadmap come to life, but this refinement can also include practical practices, such as teamwork in red and purple.
Compliance management
Many SOC processes are guided by established best practices, but some are governed by compliance requirements. SOC is responsible for the regular audit of its systems to ensure compliance with these regulations, which may be issued by its organization, its sector or its government agencies. Examples of such regulations include GDPR, HIPAA and PCI DSS. Acting in accordance with these regulations not only protects the confidential data entrusted to the company, but also protects the organization against damage to reputation and legal challenges resulting from a violation.
Thursday, June 3, 2021
Network Security Assessment
This section explains the rationale behind a high-level Internet-based network security assessment and penetration testing. Complete control over your network and data requires taking a proactive approach to security, an approach that begins with an assessment to identify and classify risks. Network security assessment is an integral part of any security lifecycle.
business advantage
From a business perspective, information assurance is what makes the business possible. As a security consultant, I have helped many retail customers secure the 802.11 wireless networks used in their stores. By designing and implementing a secure network, these retailers can, for example, implement queuing technology to reduce costs and increase efficiency.
The shortcomings of network security and users' compliance with security policies often allow Internet-based attackers to find and compromise networks. Here are some of the latest examples of companies falling victim to these determined attackers:
RSA Security (http://www.2600.com/hacked_pages/2000/02/www.rsa.com/)
OpenBSD (http://lists.jammed.com/incidents/2002/08/0000.html)
NASDAQ (http://www.wired.com/news/politics/0,1283,21762.00.html)
Playboy Enterprises (http://www.vnunet.com/news/1127004)
Cryptologic (http://lists.jammed.com/isn/2001/09/0042.html)
These concessions occurred similarly, and in some cases resulted in substantial losses. Cryptologic is an online casino gaming provider that lost $1.9 million within hours to a determined attacker. In most major incidents, attackers use more than one technique, including:
Misconfigured or compromised peripheral systems associated with the target network
Direct damage to critical network components using custom zero-day exploit scripts and tools
Using redirect attacks to compromise network traffic (including ARP spoofing, ICMP redirects, and VLAN hacking)
It decrypts user account passwords and uses these credentials to compromise other systems.
Protecting your network and data from targeted attacks requires trust and understanding of your network's technical security, as well as adherence to security policies and incident response procedures. This book covers evaluating technical security and improving the integrity and resilience of IP networks. Heeding the advice presented here and acting preemptively will ensure adequate network security.
IP: Fundamentals of the Internet
IPv4 (Internet Protocol Version 4) is a family of network protocols currently used by all public Internet sites to communicate with each other and transfer data. From the perspective of network security assessment methodology, this book comprehensively explains the steps to be taken during the security assessment of IPv4 networks.
Subscribe to:
Posts (Atom)