Craig McDonald

https://lnkd.in/gajwVyQ2 Lets decode this A third party contractor was given admin access 🚫 ⛔ Ask yourself: ❓ ❓ - Who is approving access in your environment? - Does the approver know what are the implications of providing that access? Just because someone from the application or infra team approved this, it doesn't mean such access can be given. Security engineer should understand the consequences. - Do you have a list of users in your environment that has admin access to anything? - What is the process to revoke access?  - Do you have tools in place to monitor this access on a continuous basis? The contractor doesn't even know the credentials are stolen, of course, how would he/she would even know that! 🔑 🔑 Ask yourself: ❓ ❓ - Are you implementing CIS benchmarks and hardening principles? - Is your team spending enough time to understand these benchmarks? - There is indeed a benchmark to "Disable Password Saving" on the browser. All access that is made to Exchange server, VPN is from a valid credential. So security teams would not generally doubt unless there is additional context provided. 👽 👽 Ask yourself: ❓ ❓ - Are your infra and application logs sent to your SIEM solution for context analysis, anomaly detection, correlation of events? VPN is not configured with MFA 🔏 🔏 Many leaders would want a great user experience by disabling MFA as they think that the end users would not accept entering one more credential. Ask yourself: ❓ ❓ - Do you have a list of your applications that are public facing? - Which of these don't have MFA in place? - Can you convince your leadership team to put MFA in place by showing such incidents? - Does your product and sales teams understand the criticality of having MFA so they can explain to their end users? Many times sales teams bring such requests that end users are not happy with MFA and impacting user experience. One good thing that security software spotted the intrusion 👏 👏 Ask yourself: ❓ ❓ - Do you have any tools in place to spot such activity? - Is the tool setup to notify such incidents? - Do you have a strong team that can understand such incidents and take action? - Do you have a proper triaging process? - Are your service providers monitoring these 24/7? - Are you looking at the data that they are presenting and see if they are actually handling these right? - Do you have tools in place to see if data is being exfiltrated (possibly a good DLP solution) - Do you know on what systems your critical information exist? - Do you have application and infra architecture diagrams to understand your data flows? - Do you know if your critical data is being encrypted at rest? There are many other items that can be looked into when reviewing holistic security. It's not easy to implement great security unless you have strong security professionals managing this on a regular basis. 🕵‍♂️ 🕵‍♀️

10

Netlas and RST Cloud Forge Alliance to Enhance Cyber Threat Intelligence and Threat Hunting Capabilities Netlas.io, a leading platform for internet-wide scanning and external attack surface management, and RST Cloud, a premier Australian provider of cyber threat intelligence (CTI) solutions, are pleased to announce a strategic collaboration aimed at bringing additional value to customers of both organisations. With the release of the new Netlas version, users will now benefit from the inclusion of RST Cloud’s contextualised IoC (Indicators of Compromise) data from their extensive database, aggregated through multiple CTI sources across the globe within the Netlas platform. This includes data about related threat type and threat attribution, reputational score and False Positive flag. This integration empowers cybersecurity professionals with advanced tools for identifying potential threats during their investigations. “Indicators of compromise very logically complement the data provided by Netlas. With the vulnerability labels and other data provided, this will allow users to even better understand the degree of danger of the objects in their scope,” said Arthur Kotylevskiy, CEO at Netlas. “From RST Cloud’s perspective, this collaboration allows us to utilise Netlas’ extensive internet-wide scanning capabilities to identify new IoCs and enhance our threat intelligence services.” said Founder of RST Cloud, Yury Sergeev. The collaboration offers several key benefits: For Netlas users: – Access to RST Cloud’s threat intelligence data, enhancing the identification of malicious IP addresses and domains. – Comprehensive threat context to improve incident analysis and remediation efforts. – Enhanced decision-making through the availability of reliable and up-to-date threat data. For RST Cloud users: – Leveraging Netlas’ scanning capabilities to identify new IoCs and enrich threat intelligence and extending RST Cloud capabilities to access the most relevant IoCs (including malicious IP, C&C servers). – Gaining wider visibility into devices and services exposed to the internet using Netlas’ threat hunting engine to identify infrastructure owned by malicious actors. Together, Netlas.io and RST Cloud are dedicated to delivering unparalleled cybersecurity services, equipping professionals with the necessary tools to stay ahead of evolving cyber threats. This strategic collaboration marks a significant step forward in enhancing threat intelligence and external attack surface management for customers worldwide.

9

Our first #cybersecfarmers calf was born on the farm this week. Say hello to Sugar 🐮 NGL, it was a big milestone for us. (kinda like an MSP hitting that first $1M ARR in their vCISO practice 😉) This was the culmination of about 1.5 years of work and learning. And we've been fortunate to have a farmer as our neighbor who's been a guide along the way. - Repairing and selling us his old chute - Assisting with the AI breeding process - Planting, cutting, and baling hay for feed - And more helpful advice than I can count Point is, we did most of the work, but would have never gotten here without a guide to: - Give us mechanisms we didn't have - Keep us from critical mistakes - Provide a path to success And we were happy to pay him for his expertise to get it off the ground. But more than that, he truly wants to see us do well - has given encouragement, checks up on us, and is personally invested in our journey. It got me thinking. This is similar to way the PowerGRYD is set up for MSPs. If you're willing to put in the work, you get systems, a guide, and mechanisms to put you on the path to profit. And if I'm being honest... I'm personally invested in your success. So if you want to build something to support scaling your vCISO services to $1,000,000+ Drop me a comment or DM with the word "Scale" and let's have a convo about your goals... or head here next: https://lnkd.in/dV2xyx9j

81

39 Comments

⚠️Cybersecurity Alert ⚠️ACSCs NCSC Michelle Warns of Major Ransomware Breach in Australian undisclosed Healthcare Provider with possible nation wide implications! Who is it? National Cyber Security Coordinator, Lieutenant General Michelle McGuinness, warns of a significant ransomware attack and data breach in an Australian healthcare provider. McGuinness stresses the need for a coordinated government response. 🛡️ Government Agencies Mobilize Response: Australian Cyber Security Centre and Australian Federal Police collaborate to investigate. McGuinness promises updates, emphasizing cooperation with the affected organization. 📢 Minister Clare O’Neil Addresses Concerns: Minister for Cyber Security Clare O’Neil pledges government support without disclosing the company's identity. She urges against speculative discussions hindering response efforts. 🔍 Stay Informed: Stay updated as the situation progresses. Let’s remain vigilant in safeguarding our digital infrastructure. #CyberSecurity #Ransomware #DataBreach More details: https://lnkd.in/dAwEtQxM

3

6 Comments

Another one (if we trust Akira) falls - Australia seems to be quite the target of late. Good reason to highlight the true ROI of cyber security products (and threat intelligence) huh! A great time to review how SentinelOne XDR technology detects and responds to Akira ransomware - i'd link the video but LinkedIn hates external links now. We love Flashpoint for our customers to reduce risk and increase protection with this decisive threat intelligence. If you would like a "spotlight" review done on your business to see what is out there about you - please DM me or email caity (at) sustainability .tech "Vulnerability management, password management and staying appraised of dark web threats can help organizations harden defenses against Akira ransomware" - securityintelligence "Akira ransomware actors have used known Cisco vulnerabilities like CVE-2020-3259 and CVE-2023-20269 to breach organizations through virtual private network (VPN) services that did not have multifactor authentication enabled. The hackers also use spear phishing campaigns and other tools to breach organizations. Once inside, they typically disable security software as a way to avoid detection while moving laterally. " Jason Duerden Shabeel Shah Beth Allen

27

1 Comment

An Australian superannuation fund, faced a severe data loss when Google Cloud mistakenly deleted their account and backups across multiple regions. Despite internal backups failing, an external backup saved their data. The incident highlights the risks of relying solely on one cloud provider and underscores the necessity of a robust multi-cloud backup strategy. #UniSuperDataLoss #CloudComputingRisk #MultiCloudBackup #DataRecovery #CloudSecurity

1

2 Comments

The Critical Role of Physical Security for Australian Businesses in 2024: Trends and Strategies Our New Blog is Live!! https://lnkd.in/gGAD8s22

2

You don't just have to take our word for it ... hear why Somerville, a trusted Australian MSP, relies on Scality to give its customers top-notch data storage and protection. With Scality, Somerville has achieved: 🎯 Strong revenue growth in its data protection business 🎯 ~30% TCO savings 🎯 Faster customer onboarding with seamless scalability 🎯 Peace of mind that customer data is immutable and ransomware-proof CEO Craig Somerville shares more in this short video. #datastorage #backup #datasecurity

28

From a #cybersecurity perspective alone, this news should trigger significant concern for businesses that are trying to operate resiliently. These concerns, while significant, are not insurmountable … but they do need to be addressed. Lets go through them: 1) the first and obvious one is ‘what if employees are cutting and pasting sensitive information / company trade secrets into ChatGPT?’ This one should be addressed in multiple ways, depending on the risk for the organisation. 2) a less obvious one, but one that has the potential for even bigger harm is ‘what if employees are using output from LLM’s and its wrong or completely made up?’. Weve seen this happen before and we continue to see this now. How will this affect your organisational reputation? 3) what is driving employees to have to feel as though they are using the technology in secret? This one is perhaps the most harmful of all three from a #cultural and #morale perspective. Is it a fear that they have that if they are discovered, it may make seem incapable, or lazy, or replaceable? Like all things, #AI is one of a number of tools that modern business professionals can and should use - safely. The same way hammers, drills, screwdrivers, saws and the like are for the trades, and exactly the same way that its really really easy to lose a finger using a saw unsafely. If youre unsure of how to best #riskmanage AI in your business, ping me.

19

As ever some really helpful explanation from James Patrick on cross domain workflows. Well worth a listen and James is always up for a deeper discussion #digital #technology #cyber #cybersecurity

8

1 Comment

Do you give your team cyber security training? You really should. It’s one of the most powerful ways to protect your business from being breached. The more up to date your people are on the latest scams, the greater the protection. But the way you train your people can have a big impact on how much they take in. And if you’re still just training them once a year with a boring course, that’s not enough. There’s a better way. My latest tech update talks about the most effective way to train your team and protect your business. You can get it here. #Training #CyberSecurity #DataTheft https://lnkd.in/gdrkPVEG

1

"#AI threats are perceived as a looming problem. Forty-three per cent of security professionals predict that traditional #security tools will not be up to the challenge of detecting AI-powered attacks. Forty-seven per cent fear the impact of attacks on their supply chains by such attacks, but on the other hand, 100 per cent of organisations are investing in AI application development." Read more: https://ow.ly/IKkb50SlpfT

1

The latest Australian Cyber Security Centre's Notifiable Data Breaches report contains statistics that are eye-opening! From July to December 2023, the breakdown of cyber incidents reveals a striking pattern: out of the top 6 reported incidents, 3 involve compromised credentials. Individually, these incidents may seem unrelated, but together they paint a clear picture. Compromised credentials—whether through phishing, brute-force attacks, or unknown methods—account for 58% of all cyber incidents. This makes one thing crystal clear: running a business without a robust cyber security strategy leaves it vulnerable. Implementing a password management tool can be a crucial defense against these attacks. In today's digital landscape, these strategies aren't just optional or "nice to have" – they are a must-have for every business! 🔒💼 #CyberSecurity #DataBreach #BusinessSecurity #PasswordManagement #CyberStrategy

7

2 Comments

Another breach has occurred, impacting Western Sydney University. The breach, which took place between May 2023 and January 2024, raises concerns about data security and detection measures. Despite the efforts to prevent such incidents, the consequences for individuals affected by the data leak and the university's reputation are significant. With ample funding and access to talented individuals, why wasn't this breach detected earlier? It's a critical question that prompts reflection on the systems in place. Is your company covered or prepared for issues like this? #DataSecurity #Cybersecurity #BreachDetection #UniversityChallenges

3

The threat landscape is not slowing down - CERT NZ reported another $18.3m of losses from security events to NZ businesses in their latest guidance at the end of 2023. One area of security which is fast evolving is antivirus, so we're shining the spotlight on how next-generation Managed Detection and Response with our partner Huntress can offer greater protection against the latest threats. https://lnkd.in/gnqvr7qW

7