Posts

Threat Hunting Steps

The process of proactive cyber threat hunting typically involves three steps: a trigger, an investigation and a resolution. Step 1: The Trigger A trigger  points threat hunters to a specific system or area of the network for further investigation when advanced detection tools identify unusual actions that may indicate malicious activity. Often, a hypothesis about a new threat can be the trigger for proactive hunting. For example, a security team may search for advanced threats that use tools like fileless  malware  to evade existing defenses. Step 2: Investigation During the  investigation phase , the threat hunter uses technology such as  EDR (Endpoint Detection and Response)  to take a deep dive into potential malicious compromise of a system. The investigation continues until either the activity is deemed benign or a complete picture of the malicious behavior has been created. Step 3: Resolution The resolution phase  involves communicating relevant malicious activity
Post a Comment
Read more

Spam vs. Phishing: What Is the Difference?

Both spam and phishing are related to social engineering, a general term for any activity in which an attacker is trying to manipulate you into revealing personal information. Passwords, account credentials, social security numbers--you should always think twice before giving out this information. Always verify who is really on the other end of the line. What is spam? Spam is unsolicited and unwanted junk email sent out in bulk to a wholesale recipient list. Typically, spam is sent for commercial purposes. However, spam email can also contain a malicious attempt to gain access to your computer, so email security becomes an important defense. What is phishing? Phishing is a common type of cyber attack that everyone should learn about to protect themselves. Phishing attacks are fraudulent communications that appear to come from a reputable source. The goal is to trick the recipient into giving away sensitive data or to install malware in the form of spyware on the victim&
2 comments
Read more

The Threat Intelligence Lifecycle

So, how does cyber threat intelligence get produced? Raw data is not the same thing as intelligence — cyber threat intelligence is the finished product that comes out of a six-part cycle of data collection, processing, and analysis. This process is a cycle because new questions and gaps in knowledge are identified during the course of developing intelligence, leading to new collection requirements being set. An effective intelligence program is iterative, becoming more refined over time. 1. Planning and Direction The first step to producing actionable threat intelligence is to ask the right question. The questions that best drive the creation of actionable threat intelligence focus on a single fact, event, or activity — broad, open-ended questions should usually be avoided. Prioritize your intelligence objectives based on factors like how closely they adhere to your organization’s core values, how big of an impact the resulting decision will have, and how time sensitive the
Post a Comment
Read more

What Threat Vectors Do Malicious Actors Target?

Open or unsecured ports offer a low effort, high return on investment threat vector for most malicious actors. Ports act as the gatekeepers to your IT systems, giving physical devices access to external devices such as connected printers or on-premises servers. In other words, even though these access points may be located in your physical buildings, they create a threat vector by using the internet so that devices can “talk” to one another. Why do malicious actors target ports? Ports provide an electronic entryway into your systems, software, and networks because they allow devices to create the two-way communication paths through which data travels. Often, attackers insert malware or ransomware into devices using these ports. Once the malware infects one device, it can spread to all devices connected to the network. Some ports provide malicious actors with an exit strategy. Malicious actors can gain access to your data, but they need a way to download the information. When
Post a Comment
Read more

The Biggest Threats in Cyber Security

AI-Driven Attacks We’ve seen it in science fiction films but it looks like reality that computers are learning to attack on their own. Different cyber security platforms are embracing the modern AI to overcome these attacks but hackers are also using the same technology to launch new attacks at their end. Experts suggest that the hackers adopt powerful AI tools for automated attacks and expand their domain in various cyber security reports. Adversarial AI attacks are particularly worrying, because they are so powerful. Theft of data in the past attacks caused a great deal of fear due to the money, time and effort required to carry it out. Now AI has made it easier for hackers to execute several types of attacks within the same time frame and using very less energy. Even with the few lines of codes, hackers can now solve the problem of years into seconds and gain access throughout the network. Phishing Phishing is among the oldest scams and is considered green as ever
2 comments
Read more

2020’s Top Cybersecurity Challenges

2020 has started. This is a time when pundits and writers assess what happened in the past year and look ahead. This blog will provide commentary and context on the big trends picked by top minds in cybersecurity threat intelligence . Inevitably, threats like phishing and ransomware will continue to keep CIOs up at night. What new events, tactics and concepts will shape cybersecurity in 2020? More importantly, how can companies safeguard their company against threats both old and new? Relying on trusted partners and solid tools can be the antidote. 1.    Cloud Vulnerabilities There is a misconception that storing data and handling processes in the Cloud guarantees security. In reality, misconfigured cloud instances resulted in more than half of data breaches in 2019. This trend will inevitably continue well into 2020. Amazon’s  configuration guide  for businesses to establish their own cloud environment is well over 100 pages, allowing for human error when implementi
1 comment
Read more

End-user protection in Cyber Security

End-user protection or endpoint security is a crucial aspect of cybersecurity. After all, it is often an individual (the end-user) who accidentally uploads malware or another form of the cyber threat to their desktop, laptop or mobile device. So, how do cyber-security measures protect end-users and systems? First, cyber-security relies on cryptographic protocols to encrypt emails, files, and other critical data. This not only protects information in transit but also guards against loss or theft. In addition, end-user security software scans computers for pieces of malicious code, quarantines this code, and then removes it from the machine. Security programs can even detect and remove  malicious code hidden in Master Boot Record  (MBR) and are designed to encrypt or wipe data from a computer’s hard drive. Electronic security protocols also focus on real-time  malware detection . Many use heuristic and behavioral analysis to monitor the behavior of a program and its code to defen
Post a Comment
Read more