Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers

Cyber forensics are being investigated by cyber spies and hackers across the world.

Cyber forensics wordt onderzocht door cyberspionnen en hackers over de hele wereld.

2nd International Workshop On Cyber Forensics And Threat Investigations Challenges Call For Papers2nd International Workshop On Cyber Forensics And Threat Investigations Challenges Call For Papers

2e internationale workshop over cyber forensisch onderzoek en bedreigingsanalyse Uitdagingen Call For Papers2de Internationale Workshop over Cyber Forensics en Uitdagingen voor bedreigingsonderzoeken Call For Papers

2nd International Workshop On Cyber Forensics And Threat Investigations Challenges Call For Papers

2nd International Workshop On Cyber Forensics And Threat Investigations Challenges Call For Papers

2nd International Workshop On Cyber Forensics And Threat Investigations Challenges Call For Papers ≈ Packet Storm

Shanghai National Police breach traced to exposed database dashboard. Update on the Marriott International breach. California community college suffers malware attack. Maui ransomware is no vacation.  NPM supply chain attack appears to be part of a large-scale campaign.

Hackers have been targeting healthcare businesses in China, including the University of Maryland. The BBC’s weekly The Boss series profiles different business leaders from around the world.

Hackers hebben het gemunt op gezondheidszorgbedrijven in China, waaronder de Universiteit van Maryland. De wekelijkse serie The Boss van de BBC geeft profielen van verschillende bedrijfsleiders van over de hele wereld.

In what many are calling the largest data breach in history, a hacker claims to have stolen the data of a staggering one billion Chinese residents from a Shanghai National Police database. Cybersecurity experts have verified that the breach was the result of an oversight that left a dashboard used to manage the data exposed on a public web address without password protection, essentially making it fair game to anyone with basic technical knowledge. Names, addresses, national identification numbers, phone numbers, and criminal case details are among the compromised data, and the Christian Science Monitor notes that dates of birth indicate the trove includes information on minors.

In wat velen het grootste datalek in de geschiedenis noemen, beweert een hacker de gegevens van maar liefst een miljard Chinese inwoners te hebben gestolen uit een databank van de Nationale Politie van Shanghai. Deskundigen op het gebied van cyberbeveiliging hebben geverifieerd dat de inbreuk het resultaat was van een onoplettendheid waardoor een dashboard dat werd gebruikt om de gegevens te beheren, zonder wachtwoordbeveiliging op een openbaar webadres werd geplaatst, waardoor het in wezen vrij spel had voor iedereen met technische basiskennis. De gegevens bleven meer dan een jaar blootliggen, totdat de hacker in kwestie ze schoonveegde en de gegevens verving door een losgeldbriefje waarin tien bitcoin werd geëist voor de teruggave.

Shanghaied data. Update on the Marriott breach. California college suffers cyberattack. Maui ransomware. NPM supply chain attack update.

For the past decade, Fortinet’s FortiGuard Labs has been a FIRST Team that collaborates with the international confederation of trusted computer incident response teams. Read more about how this collaboration benefits the industry and Fortinet customers. 

Fortinet is a leading cybersecurity agency, which aims to increase the risks of cybercrime. But what is it like to work with the industry?

Fortinet is een toonaangevend bureau voor cyberbeveiliging. Maar hoe is het om met de industrie samen te werken?

Fortinet has been a founding partner or frequent collaborator with such high-profiled, well-respected organization as the Cyber Threat Alliance (CTA), the World Economic Forum (WEF), International Criminal Police Organization (INTERPOL), North Atlantic Treaty Organization (NATO) Communications and Information (NCI) Agency, and the Forum of Incident Response and Security Teams (FIRST). For the past 10 years, Fortinet’s FortiGuard Labs has been a FIRST Team that collaborates with the international confederation of trusted computer incident response teams. As an international, not-for-profit organization comprised of 600+ members from over 100 countries FIRST’s membership is composed of both national CERT (Computer Emergency Response Teams) and CSIRT teams across - but not limited to - government agencies, academia, commercial enterprises, and financial corporations from a variety of industries.

De afgelopen 10 jaar is Fortinet's FortiGuard Labs een FIRST Team geweest dat samenwerkt met de internationale confederatie van vertrouwde computer incident response teams. Als internationale non-profitorganisatie met meer dan 600 leden uit meer dan 100 landen bestaat het lidmaatschap van FIRST uit zowel nationale CERT-teams (Computer Emergency Response Teams) als CSIRT-teams van - maar niet beperkt tot - overheidsinstanties, de academische wereld, commerciële bedrijven en financiële ondernemingen uit uiteenlopende bedrijfstakken. De panelleden zullen de nadruk leggen op doeltreffende publiek-private samenwerking, waarbij mondiale bedrijven en andere cyberresponders zij aan zij met de rechtshandhavingsinstanties kunnen werken, om dat resultaat te bereiken.

Fortinet is proud to have been at the forefront of the global cybersecurity industry since our founding 20+ years ago. Our industry leadership is demonstrated by our continuous commitment to working with non-profits and private industry, including competitors, dedicated to making the digital world a safer place.

Fortinet has been a founding partner or frequent collaborator with such high-profiled, well-respected organization as the Cyber Threat Alliance (CTA), the World Economic Forum (WEF), International Criminal Police Organization (INTERPOL), North Atlantic Treaty Organization (NATO) Communications and Information (NCI) Agency, and the Forum of Incident Response and Security Teams (FIRST).

For the past 10 years, Fortinet’s FortiGuard Labs has been a FIRST Team that collaborates with the international confederation of trusted computer incident response teams. As an international, not-for-profit organization comprised of 600+ members from over 100 countries FIRST’s membership is composed of both national CERT (Computer Emergency Response Teams) and CSIRT teams across - but not limited to - government agencies, academia, commercial enterprises, and financial corporations from a variety of industries. Together, Fortinet and FIRST have been cooperatively assisting with the managing of cybersecurity incidents and promoting incident prevention programs.

At FIRST’s 34th annual conference in Dublin, Ireland (June 26 – July 1), where over 1,000 specialists representing six continents to participate in critical discussions to bolster cyber defenses, FortiGuard Labs’ Global Threat Intelligence Team leader Derek Manky will be a featured panelist in a formal discussion titled “Driving Public-Private Cooperation to Combat Cybercrime.”

FIRST’s featured panel presentation, “Driving Public-Private Cooperation to Combat Cybercrime”, examines how – with cybercrime presenting a major risk to prosperity in the global digital economy – to systematically address this threat, it is imperative to raise the cost of conducting cybercrime and increase the risks for cybercriminals. The panelists will emphasize effective public-private cooperation, with global businesses, and other cyber responders, working side by side with law enforcement, can help to achieve that outcome. In the session, the panelists will also explore what is needed to achieve such collaboration.

“With every alliance and collaboration, Fortinet works toward its mission to secure users, devices, applications, and edges everywhere. When we grow our collective intelligence, we can better combat and disrupt advanced threats, deploy security controls to counteract the latest moves, and deliver greater security for our customers and all organizations,” commented Derek Manky, Chief Security Strategist and Vice President, Global Threat Intelligence. “Through Fortinet’s collaborations with organizations like the CTA, FIRST, INTERPOL, NATO NCI, and WEF we advance cyberthreat information sharing. This advancement will then enable us to collectively disrupt the cybercriminal ecosystem. Our relationship with FIRST is an excellent example of intelligence collaboration with the industry in mind. While FortiGuard Labs processes billions of threat events on any given day, no single entity will have a complete vision of the cyberthreat landscape and this is why mutually beneficial relationships with organizations like FIRST are so critical to further advancing security practices and defenses for our customers and for the overall industry.”

How the FIRST and Fortinet Collaboration Benefits Industry and Fortinet Customers

The collaboration with FIRST is a two-way street. Fortinet provides its expertise to FIRST and its membership, and FIRST generates data, content, and knowledge that Fortinet uses to even more consistently communicate and secure its customers. For example, the Fortinet Product Security Assurance Policy and Information Security Management System are based on recognized industry standards, including best practice recommendations supplied by FIRST.

In a recent Fortinet Threat Research blog titled “Using EPSS to Predict Threats and Secure Your Network,” Paolo Di Prodi, Senior Data Scientist at Fortinet’s FortiGuard Labs and EPSS Special Interest Group (SIG) member, writes about a couple of FIRST tools and how they are used by the security industry: “The Common Vulnerability Scoring System (CVSS) …[that] highlights how exploitable different vulnerabilities are. And now, EPSS (Exploit Prediction Scoring System) can supplement CVSS by providing dynamic insight into the likelihood that a vulnerability will be exploited. It produces a probability score of a rational number between 0.0 and 1.0, and the higher the score, the greater the probability that a vulnerability will be exploited.”

According to Paolo, the CVSS scoring system is used worldwide to prioritize software vulnerabilities. He goes on to say how EPSS is “a new score that can predict the likelihood of exploitation of software vulnerabilities” and how it should be used in with CVSS to prioritize vulnerability patching.

“The takeaway is that organizations that properly deploy and train EPSS will need to patch fewer vulnerabilities than they would have using the classic CVSS strategy while maintaining the same level of protection.”

As it happens, Fortinet' contributes to EPSS’s “ground truth” by providing critical information derived from daily observations of exploitation-in-the-wild activity and from other sources of data provided by FortiGuard Labs. Hence, the more Fortinet contributes to helping FIRST and the cybersecurity industry, the more the company helps itself and helps Fortinet customers.

Fortinet is looking forward to more decades of productive collaboration with FIRST and to bringing the outputs of that collaboration to the industry and to its customers.

Learn more about Fortinet’s FortiGuard Labs threat research and intelligence organization and the FortiGuard Security Subscriptions and Services portfolio.

Celebrating A Decade of Public Sector and Private Industry Collaboration on Cybersecurity with FIRST

Microsoft's response to several issues, including Follina and recent problems with Azure, has stirred debate among security experts who question its handling of vulnerability disclosure.

Microsoft has been criticised for its recent response to a security vulnerability in its cloud services.

Microsoft heeft kritiek gekregen op zijn recente reactie op een beveiligingslek in zijn clouddiensten.

But the tech giant’s initial response to the issue, and several others, stirred debate among security experts who question Microsoft’s recent handling of vulnerabilities. They eventually acknowledged the issue, but several security experts have aired concerns about Microsoft’s responses to a number of vulnerability reports. On Monday, Amit Yoran, the CEO of cybersecurity firm Tenable, released a lengthy blog post criticizing Microsoft for its recent response to two disclosed vulnerabilities affecting the Azure Synapse service.

Maar de eerste reactie van de techgigant op de kwestie, en verscheidene andere, heeft de discussie aangewakkerd onder beveiligingsexperts die vraagtekens zetten bij Microsofts recente aanpak van kwetsbaarheden. Uiteindelijk werd het probleem erkend, maar verschillende beveiligingsexperts hebben hun bezorgdheid geuit over de reacties van Microsoft op een aantal meldingen van kwetsbaarheden. Maandag heeft Amit Yoran, de CEO van cyberbeveiligingsbedrijf Tenable, een lange blogpost gepubliceerd waarin hij Microsoft bekritiseert voor zijn recente reactie op twee onthulde kwetsbaarheden die de Azure Synapse-dienst aantasten.

Microsoft finally released a patch for the much-discussed Follina vulnerability — CVE-2022-30190 — amid fixes for 55 other issues on Tuesday. But the tech giant’s initial response to the issue, and several others, stirred debate among security experts who question Microsoft’s recent handling of vulnerabilities.

Microsoft initially claimed Follina “wasn’t a security issue” after being sent evidence by the head of advanced persistent threat (APT) hunting organization Shadow Chaser Group. They eventually acknowledged the issue, but several security experts have aired concerns about Microsoft’s responses to a number of vulnerability reports.

On Monday, Amit Yoran, the CEO of cybersecurity firm Tenable, released a lengthy blog post criticizing Microsoft for its recent response to two disclosed vulnerabilities affecting the Azure Synapse service.

“After evaluating the situation, Microsoft decided to silently patch one of the problems, downplaying the risk. It was only after being told that we were going to go public, that their story changed…89 days after the initial vulnerability notification…when they privately acknowledged the severity of the security issue,” Yoran said.

“To date, Microsoft customers have not been notified. This is a repeated pattern of behavior. Several security companies have written about their vulnerability notification interactions with Microsoft, and Microsoft’s dismissive attitude about the risk that vulnerabilities present to their customers.”

Yoran went on to say that Microsoft’s frequent reticence to notify customers of issues was “a grossly irresponsible policy.”

In response to questions about Yoran’s comments, Microsoft told The Record that it only assigns CVEs to issues that require customers to take action.

“We addressed the issues that Tenable reported to us and no customer action is required,” a spokesperson said.

Aaron Turner, CTO at security company Vectra, said he understood both sides of the debate as a longtime former Microsoft security team member. Microsoft wants to have the freedom to manage their cloud services the way they see fit, Turner said.

“I was at Microsoft in the worst of times, from 1999 through 2006 when the company had to go from some of the worst security update management policies to eventually leading the industry in predictability, transparency and one of the best supporters of responsible disclosure,” he said.

Turner explained that he knows and respects Yoran personally but did not think the blog post was constructive. The rules around responsible disclosure do need to be updated, according to Turner, but he noted that both sides “have room for improvement.”

Turner said there needs to be clearer rules around research into core PaaS and IaaS technologies as well as easier ways for cloud platform operators to provide testing capabilities to researchers and clear responses to responsibly-disclosed vulnerability information.

“Over the last three decades of my career, I’ve had to stand in the shoes of all participants in this debate. I worked for the US government researching system vulnerabilities for two years. I’m working for a security technology provider now,” he told The Record.

“What are the rules for attribution when PaaS and IaaS vulnerabilities are remediated? These are complex topics and don’t have simple answers.”

Several other researchers were less forgiving of Microsoft, pointing out that more than 33% of the vulnerabilities added to the Cybersecurity and Infrastructure Security Agency’s list of known exploited bugs came solely from Microsoft.

Microsoft had the most vulnerabilities added to the list in every month this year. The company provides about 80% of U.S Government productivity and collaboration software.

Andrew Grotto, former White House Director for Cybersecurity Policy, argued that Microsoft’s market dominance was part of the problem.

“The data speaks to an outsized representation of Microsoft products having the most critical vulnerabilities. On some level, it may reflect the sheer prevalence of Microsoft products, but it’s not like there aren’t other vendors whose products are constantly poked and prodded and tested,” explained Grotto, now a cybersecurity professor at Stanford University.

No other vendor “appears with the same frequency and level of severity in terms of vulnerabilities that Microsoft’s products seem to” according to Grotto

“Does the market force Microsoft to remedy this problem or not? What worries me is, right now, there is not a ton of competition, so I’m a bit pessimistic about this trend changing,” he said.

Steven Weber, professor of the Graduate School of Information at UC Berkeley, said procurement is the best way to drive positive changes in security practices.

Government procurement practices right now are making the government less secure but also hurting the private markets as well, Weber explained, because it is not creating greater demand for better security.

“It’s important to keep in context that the widespread market penetration of a company’s products is no explanation for why its products are the most vulnerable. That would be like saying ‘lots of people like sugary drinks, and that’s why we keep finding out that sugary drinks are bad for you,’” Weber said.

“What we ought to be asking is, given that we know and are shown again and again that the products are highly vulnerable, why do they remain so prevalent in the market?”

Debate rages over Microsoft vulnerability practices after Follina, Azure issues

After a massive breach exposed sensitive data on more than 50 million customers, T-Mobile has agreed to pay a $350 million settlement.

T-Mobile has filed a tentative settlement with the owners of its mobile phone provider, Barracuda. But what does this mean for those affected?

T-Mobile heeft een voorlopige schikking getroffen met de eigenaars van zijn mobiele telefoon provider, Barracuda. Maar wat betekent dit voor de gedupeerden?

Just about one year ago, in August 2021, T-Mobile suffered a truly massive data breach, in which sensitive data on more than 50 million customers was exposed and offered for sale on the dark web. Then, this past July 24, we learned that T-Mobile had filed a tentative settlement agreement to close out the multiple class-action suits filed on behalf of U.S. residents affected by the breach. In the settlement, the company offers to pay $350 million into a fund to be paid out to affected customers.

Ongeveer een jaar geleden, in augustus 2021, werd T-Mobile getroffen door een echt grootschalig datalek, waarbij gevoelige gegevens van meer dan 50 miljoen klanten werden vrijgegeven en te koop werden aangeboden op het dark web. vernamen wij dat T-Mobile een voorlopige schikkingsovereenkomst had ingediend om een einde te maken aan de vele collectieve rechtszaken die waren aangespannen namens inwoners van de VS die door de inbreuk waren getroffen. In de schikking biedt het bedrijf aan 350 miljoen dollar in een fonds te storten dat aan de getroffen klanten zal worden uitbetaald.

Just about one year ago, in August 2021, T-Mobile suffered a truly massive data breach, in which sensitive data on more than 50 million customers was exposed and offered for sale on the dark web. This included the names, addresses, Social Security numbers, driver's licenses, and ID information of about 48 million people.

Then, this past July 24, we learned that T-Mobile had filed a tentative settlement agreement to close out the multiple class-action suits filed on behalf of U.S. residents affected by the breach. In the settlement, the company offers to pay $350 million into a fund to be paid out to affected customers. In addition, they will be required to invest an additional $150M in cybersecurity between now and the end of 2023.

Of course, the total costs of the breach to T-Mobile are considerably higher. How many customers have switched to other providers as a direct result of this debacle? How much more are they having to spend to acquire each new customer?

There’s even a social-justice angle. One commentator, writing in Forbes, argues that, because T-Mobile’s business includes a disproportionate percentage of prepaid phone sales, the breach is especially damaging to Black and other disadvantaged communities. Talk about a PR nightmare!

The only bright spot is that following the announcement of the settlement, T-Mobile’s stock price got a nice bump, presumably because it put an end to the uncertainty that investors hate more than anything.

Lessons for the rest of us

The high-level lesson, of course, is that just about anything it takes to prevent having all your customers’ sensitive data breached is worth doing. Skimping on security can very well come back to bite you, hard. (T-Mobile denies having inadequate security in place, but the company has a bad history of getting hacked and losing data. There were two back-to-back breaches in 2020, and they lost more data in in yet another breach later in 2021.)

The specific cause of this breach is a matter of some dispute, with some analysts concluding that the attackers used stolen credentials or phishing attacks to gain entry, while T-Mobile’s CEO claims that it was a “brute force” attack. But in a very important sense, it doesn’t really matter which technique or vector the attackers exploited in this particular case.

That is to say, it matters to T-Mobile — they definitely want to prioritize addressing whatever vulnerability made this breach possible. But to the rest of us the only thing that matters is making sure we are effectively securing ALL threat vectors and attack surfaces.

Most of us don’t store data on dozens of millions of customers (wouldn’t that be nice!), but a major data breach can still have devastating consequences for any business. So it’s simply prudent to make sure that you have comprehensive security in place that is capable of detecting and blocking even the most sophisticated types of threat.
• Email security — Phishing and other email-based techniques remain the most common means of initiating an attack that leads to a data breach. These techniques evade many traditional security strategies. To effectively protect this crucial attack surface, start by using Barracuda Email Threat Scan, a free service that checks your Microsoft 365 mailboxes for dormant and unnoticed malicious emails to provide visibility into the scale of your exposure. Then consider one of the three Barracuda Email Protection plans to get security that addresses every aspect of email security to stop cyber crooks at the first stage of an attack.
• App and cloud security — As online apps and websites become more complex, expose more potentially vulnerable APIs, and increasingly rely on third-party scripts and libraries that are executed at the browser, hackers are finding new and ingenious ways to exploit novel vulnerabilities. At the same time, keeping cloud and hybrid networks secure and properly configured is becoming a lot more complex. Use the free services Barracuda Vulnerability Manager and Barracuda Cloud Assessment Manager to identify vulnerabilities and get advice about remediation. Then find out how Barracuda Cloud Application Protection delivers advanced, comprehensive web application and API protection (WAAP) to secure all your workloads in the cloud.
• Network protection — Network-based attacks are on the rise, and preventing them from causing a data breach requires a multilayered approach to security. Barracuda Network Protection is a platform that brings together various state-of-the-art capabilities to deliver a true secure access service edge (SASE) architecture. Zero trust access ensures continuous, granular control over which devices and users access which digital assets far more effectively than multi-factor authentication. Secure SD-WAN hardens network security while also boosting overall performance and reducing costs. Barracuda Web Security adds a crucial layer of protection against web-based threats. And Barracuda Industrial Security protects vulnerable internet-connected devices and machinery deployed in the field.
• Data protection — A modern backup system is a critical part of your overall security infrastructure, one that is too often overlooked. Barracuda Backup and Barracuda Cloud-to-Cloud Backup use advanced strategies to make sure that you always have rapid, granular access to complete, up-to-date backups of all your data, no matter where it is stored. This ensures that in the case of a successful ransomware attack, or a disaster, or (most commonly) accidental deletion of important data, you can recover in a matter of minutes or hours. And Barracuda Data Inspector monitors and scans your OneDrive and SharePoint files to detect many types of potentially sensitive, protected, and malicious data that’s improperly stored in vulnerable locations. You can run a free scan to see what’s there now.

It’s unlikely that most organizations are vulnerable to a breach anywhere near as large as the one that T-Mobile is reeling from — or that they’ll have to shell out hundreds of millions of dollars in compensation. But how high does the cost have to be for you to make sure you’re using the most advanced preventive measures available?

Barracuda makes it very easy to schedule a demo or set up a free trial of all the platforms and solutions that I’ve described here. And that’s really the best way to get a first-hand impression of how powerful they are, and of how simple and intuitive they are to configure, use, and maintain.

Start by using our free scanners to get a sense of how vulnerable you may be to different types of threats. Then use that info to prioritize your security-improvement plans. And then schedule a free demo or trial to find out if Barracuda’s comprehensive security solutions are right for your team and your organization. Barracuda sales engineers are just a no-phone-trees call away, and one of them will be more than happy to help you navigate every step of the process.

See what threats are hiding in your Microsoft 365 inboxes.

Lessons from T-Mobile’s $350M breach settlement

Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!    For the

If you’re a security expert, what do you know about security?

Als je een beveiligingsexpert bent, wat weet je dan over beveiliging?

Afraid of missing important security news during the week? Every week we put together a curated list of all important security news in one place, for your reading pleasure. Did you enjoy this list?

Bang om belangrijk veiligheidsnieuws te missen tijdens de week? Elke week stellen wij een lijst samen van al het belangrijke beveiligingsnieuws op één plaats, voor uw leesplezier. Heeft u genoten van deze lijst?

Afraid of missing important security news during the week? We’re here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!

For the less technical
• Reported explosion at Google data center may have caused outage
• Cloudflare: The mechanics of a sophisticated phishing scam and how we stopped it
• An epic bank scandal in China adds to social tensions over finance

For the more technical
• Cisco releases advisories for bug affecting more than 1 million security devices
• Dancing on the architecture of VMware Workspace ONE Access
• The hacking of Starlink terminals has begun
• CloudGuard Spectral detects several malicious packages on PyPI – the official software repository for Python developers
• Sending spammers to Password Purgatory with Microsoft Power Automate and Cloudflare Workers KV
• Novel news on Cuba ransomware: Greetings from Tropical Scorpius
• So RapperBot, what ya bruting for?

Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.

IT Security Weekend Catch Up – August 12, 2022

In this interview, a VP of Internal Security and IT discusses the challenges of the cloud and why you should get your cloud security certificate from CSA.

When it comes to cybersecurity, there is a growing number of IT professionals getting their certificates.

Op het gebied van cyberbeveiliging halen steeds meer IT'ers hun certificaat.

This is part of a blog series interviewing cybersecurity professionals who have earned their Certificate of Cloud Security Knowledge (CCSK). In this blog, we'll be interviewing Nikolay Akatyev, VP of Internal Security and IT, Horangi Cyber Security. In your current role at Horangi Cyber Security, you oversee corporate and application security, as well as IT.

Dit maakt deel uit van een blogreeks waarin cyberbeveiligingsprofessionals worden geïnterviewd die hun Certificate of Cloud Security Knowledge (CCSK) hebben behaald. In deze blog interviewen we Nikolay Akatyev, VP van Internal Security en IT, Horangi Cyber Security. In uw huidige rol bij Horangi Cyber Security houdt u toezicht op bedrijfs- en applicatiebeveiliging, evenals op IT.

This is part of a blog series interviewing cybersecurity professionals who have earned their Certificate of Cloud Security Knowledge (CCSK). In these blogs we invite individuals to share some of the challenges they face in managing security for cloud computing and how they were able to leverage knowledge from the CCSK in their current roles. In this blog, we'll be interviewing Nikolay Akatyev, VP of Internal Security and IT, Horangi Cyber Security.

1. In your current role at Horangi Cyber Security, you oversee corporate and application security, as well as IT. Can you tell us more about what your job involves?

Let me focus on the cybersecurity side of my role. Our company is a cybersecurity company providing both professional cybersecurity services and a multi-cloud security product. So internal security has strategic importance at Horangi. As our company sees security as a business enabler for our clients, we mirror that mentality internally. We build and operate internal security in a way that allows our employees to innovate without fear. They can deliver business without continuously looking over their shoulders, fearing whether they are doing something wrong from the security point of view.

To be more specific, we deploy and run a lot of cloud security tools, as Horangi is a cloud-native business, and both our consultants and software engineers run their workloads in the cloud. So, internally, we establish policies and processes. We also deploy and operate cloud-native security tools and our product, Warden.

2. Can you share with us some complexities in managing cloud computing projects?

The ease of deployment and scaling in the cloud is its main advantage as well as a challenge. Implementing projects along with providing their security in the cloud needs a different mindset. The security team needs to partner with the implementers of the cloud projects so they can have full visibility and the ability to react fast. The security team should not prohibit the implementers from moving fast and innovating. The security team needs to understand the cloud well, observe, react quickly, and guide the implementers about the security aspects of their implementations in the cloud.

3. In managing cloud projects, what are useful tips you could share with IT professionals to avoid common pitfalls?

IT professionals need to focus on two things: learn the cloud and use the right tools.
• Learn the cloud. It’s easy to start using the cloud. But when using the cloud professionally and at scale in production, the complexity can become overwhelming without doing it in a cloud-native and platform-specific way. Fortunately, major cloud service providers (CSPs), as well as reputable organizations like CSA, have good documentation and tutorials on how to use it correctly. I recommend that after finishing research or running a POC, IT professionals need to step back, reflect, learn the documentation in-depth and rebuild their product in a proper cloud-native way. And security should be a natural part, not an afterthought, of this process. The documentation of CSPs and other relevant organizations always has a security part. Don’t skip it; learn it as a part of learning the whole platform.
• Use the right tools. I observe that CSPs provide a lot of services. They have core services that they implement well in scalable and usable ways. But other services they implement just to have, and I don’t find them easy to use or have deep specific functionality. Usually, security services and tools by CSPs have such characteristics. Find tools that are solving your specific problem, easy to use for that problem, and integrate well with the chosen cloud platform.

4. What made you decide to earn your CCSK? What part of the material from the CCSK has been the most relevant in your work and why?

My principle is to let professionals do the job they do the best. CSA is focusing on the cloud. I consider their work and research very focused and professional, so I decided that undertaking training and exams from them would be very beneficial for me. Moreover, CSA has had a proven history, while other organizations have just started adding cloud-related topics.

To prepare for the exam, I took an online training course from CSA. That alone was generally enough, maybe because I already had hands-on experience with development in the cloud and securing it. For those preparing for the CCSK, I recommend practicing first with the cloud, deploying workflows with your own hands and experiencing what an end-to-end solution looks like, then taking a CCSK training and reviewing all referenced materials. And you should be good to go.

5. How does the CCM help communicate with customers?

We work with many mature clients, and they always have a due diligence process. In one instance, our client explicitly asked to fill the CCM as a part of the due diligence process. So, having the CCM ready would help shorten the procurement cycle and enable scaling the response to due diligence requests.

6. What’s the value in a vendor-neutral certificate like the CCSK or CCSP versus getting certified by AWS? In what scenario are the different certificates important?

All of them have value, but in different ways. Vendor-specific certificates are hands-on. They bring value when you want to prove your experience with specific technologies. They also enable the company to establish partnerships with CSPs.

The CCSK sits at a higher level. It summarizes knowledge across domains, gives value to managers and consultants who work with a broader range of technologies, and covers such aspects as risk management, vendor management, architecture, and multi-cloud.

7. Would you encourage your staff and/or colleagues to obtain CCSK or other CSA qualifications? Why?

Yes. Particularly, I would recommend it to my colleagues from the professional cybersecurity services business unit and my team members responsible for cybersecurity compliance. As I mentioned earlier, it is useful to refer to risk management and other higher-level knowledge in the CCSK when advising the clients or managing our own internal multi-cloud requirements.

8. What is the best advice you will give to IT professionals in order for them to scale new heights in their careers?

Prepare, or, even better, get proven experience, to be able to enable the business. We believe that security is a business enabler, and this is how we communicate internally and to the clients. So if an IT professional can obtain business acumen, they can become invaluable to a company. They will then be able to be more flexible when requesting a budget for IT and security, as IT and security would be seen not just as a commodity or blocker, but as a business enabler. It enables the company to work with more mature clients, deliver higher quality service faster, and have better visibility and understanding of the market through data.

The CCSK can help with that direction. IT professionals can have proven knowledge and membership in a relevant community, enabling them to guide the business towards new partnerships and markets.

CCSK Success Stories: From the VP of Internal Security | CSA

Network segmentation is a best practice and when done correctly it improves network security and

The SolarWinds breach has been linked to a massive cyber-attack that has left more than 100 people dead.

De inbreuk bij SolarWinds is in verband gebracht met een grootschalige cyberaanval waarbij meer dan 100 mensen om het leven zijn gekomen.

Every organization is at risk for cyberattacks, and it’s unsettling that the attackers are so good at maximizing the damage to their victims. The time an attacker spends inside a network is referred to as ‘dwell time,’ and it’s measured from the point of intrusion to the point of detection. Long dwell times increase the damage of an attack, often in ways that can’t be measured.

Elke organisatie loopt het risico op cyberaanvallen, en het is verontrustend dat de aanvallers zo goed zijn in het maximaliseren van de schade aan hun slachtoffers. Aanvallers die de bedrijfsverdediging omzeilen, zullen zich zo lang mogelijk in het netwerk verbergen, zelfs als ze van plan zijn een ransomware-aanval uit te voeren. Lange verblijftijden verhogen de schade van een aanval, vaak op een manier die niet kan worden gemeten.

Every organization is at risk for cyberattacks, and it’s unsettling that the attackers are so good at maximizing the damage to their victims. Their tactics are increasingly sophisticated and often involve some type of email attack, bot attack, or even just old-school social engineering. Attackers who bypass company defenses will hide inside the network as long as possible, even if they’re planning to launch a ransomware attack. They use this time to explore the network, steal data and user credentials, destroy backups, and do anything else they can do to set themselves up for future attacks.

The time an attacker spends inside a network is referred to as ‘dwell time,’ and it’s measured from the point of intrusion to the point of detection. Long dwell times increase the damage of an attack, often in ways that can’t be measured. The SolarWinds breach is the perfect example of this. The intruders entered the network in early 2019 and were not discovered until December 2020. The exact number of victims and costs associated with the attack remain unknown.

Network segmentation is one of the easiest and most effective ways to reduce dwell time. For those of you not familiar with this practice, it’s just like it sounds: You divide your network into different sections (segments) and you ‘lock the doors’ between them.

You’ve seen this concept at work in high-security buildings that restrict access to certain parts of the facility to people who have been granted permission to enter that restricted section. This keeps people from wandering around and exploring areas that are critical to operations or contain sensitive information. Segmentation does something similar for your network.

There are immediate security benefits to separating your network into multiple contained segments:
• Segmentation creates a smaller attack surface within the network. An intruder will be limited to the segment that was breached. The attacker can go no further unless they successfully breach another segment. Isolating your mission-critical servers and data can prevent an intruder from gaining access to your resources through a neglected printer or rogue smart device.
• Segmentation makes it easier to detect and isolate security incidents. The division between the segments helps contain the spread of malware and viruses. It limits the areas where the intruder can hide, and it can improve the efficiency of security monitoring.

There are non-security benefits as well. For example, POS devices fall under strict compliance rules. Assigning POS devices their own segment helps companies by limiting the cardholder data environment (CDE) and reducing the scope of PCI DSS compliance.

Segmentation also improves network performance by separating traffic. A good example of improving both security and performance is the separation of a public network from private resources. A shopping center or school campus that offers free wireless access to guests would want that traffic separated from the line-of-business applications. This keeps the potential traffic congestion of public wireless access isolated to assigned segments.

Gartner analysts have warned against over-segmentation, which can complicate the management and use of the network. One Gartner study found that over 70% of segmentation projects had to be re-architected because the segmentation made it too difficult for authorized users to access what they needed to perform their work.

“A principle of network segmentation is to group like resources together, to minimize security overhead: Build a fence around the car park, not a fence and gate around every car. ~Gartner”

Barracuda can help you secure your network while making it easier to manage. Visit our website for more information on Barracuda CloudGen Firewall, secure SD-WAN, and other network security solutions.

How network segmentation can help secure your business

Pursuing a SOC 2 audit is a multi-step process. This blog clarifies the SOC 2 audit process and explains the role of SOC 2 auditors and compliance software.

When it comes to cybersecurity, companies need to demonstrate their ability to protect data and information.

Als het om cyberbeveiliging gaat, moeten bedrijven aantonen dat zij in staat zijn gegevens en informatie te beschermen.

Pursuing a SOC 2 audit is a multi-step process, which can seem confusing at first glance given the fact that there are vendors that provide compliance software, and other vendors who are themselves certified SOC 2 auditors. This blog will clarify the SOC 2 audit process, as well as explain the role of SOC 2 auditors and compliance software. When and How to Use SOC 2 Software ToolsThere are multiple steps to completing a SOC 2 audit.

Enter, SOC 2 (Service Organization Control 2), een populaire audit die getuigt van het vermogen van een bedrijf om gegevens en informatie te beschermen. Het nastreven van een SOC 2-audit is een proces dat uit verschillende stappen bestaat, wat op het eerste gezicht verwarrend kan lijken, gezien het feit dat er verkopers zijn die nalevingssoftware leveren, en andere verkopers die zelf gecertificeerde SOC 2-auditors zijn. Wanneer en hoe SOC 2-softwaretools gebruikenEr zijn verschillende stappen om een SOC 2-audit te voltooien.

Data breaches and ransomware attacks continue to dominate the news cycle. To protect data, and position themselves favorably among prospects and customers, companies need to demonstrate a commitment to cybersecurity.

Enter, SOC 2 (Service Organization Control 2), a popular audit that attests to a company’s ability to protect data and information. It’s a strong validator for any company looking to demonstrate its commitment to cybersecurity to partners and customers.

Pursuing a SOC 2 audit is a multi-step process, which can seem confusing at first glance given the fact that there are vendors that provide compliance software, and other vendors who are themselves certified SOC 2 auditors.

This blog will clarify the SOC 2 audit process, as well as explain the role of SOC 2 auditors and compliance software.

When and How to Use SOC 2 Software Tools

There are multiple steps to completing a SOC 2 audit. Many companies start with a readiness/gap assessment, which is the process of reviewing existing controls in place and identifying those that need to be improved or implemented. This process can be executed via an audit consultant, or through specialized software tools that help simplify this process (like A-SCEND).

Compliance software tools typically provide automated workflows and compliance templates, comparing your existing controls against the controls within a selected compliance framework — which, in this case, would be the SOC 2 framework.

Typically, this software allows you to visualize progress toward compliance goals, assign tasks related to evidence collection or policy updates, and collaborate all in one dashboard. Software tools provide a simple way to understand the framework requirements, assess them against your existing policies and procedures, and manage the process of updating policies. While these tools help to better prepare for an audit and streamline the assessment process, an experienced auditor is still a critical component of compliance.

When and How to Use SOC 2 Auditors

Software tools can only take you so far with SOC 2. They can help prepare a company for a SOC 2 audit, but not complete the audit itself. When the actual audit takes place, companies must turn to a SOC auditor.

SOC 2 audits are regulated by the American Institute of Certified Public Accountants (AICPA) and must be completed by an external auditor from a licensed CPA firm. This is the only way a company can receive an official SOC 2 report, whether it’s a Type 1 or Type 2 report.

An official SOC 2 report is valid for one year following the date the report was issued. Future annual audits must also be completed by an external auditor from a licensed CPA firm.

If your organization plans to use software to prepare for an audit, it’s helpful to work with a software partner who can also conduct the official audit (as a certified CPA) because it provides an added layer of convenience throughout the SOC 2 process and results in a reputable report. 



Organizations need to go beyond the data collection by their compliance software tool and conduct further due diligence, such as observations and walkthroughs (conversations) between the audit team and the client. SOC 2 auditors may also find that they need additional data or evidence necessary to validate the design and operating effectiveness of a complete control set. When you use the same company for a technology-enabled audit, and a SOC 2 report, the software is designed to request all audit materials needed, including manually operated controls and supporting evidence. In this convenient scenario, you can save time, resources, and money.

Stephanie Oyler is the Vice President of Attestation Services at A-LIGN focused on overseeing a variation of many assessments within the SOC practice. Stephanie’s responsibilities include managing key service delivery leadership teams, maintaining auditing standards and methodologies, and analyzing business unit metrics. Stephanie has spent several years at A-LIGN in service delivery roles from auditing and managing client engagements to overseeing audit teams and providing quality reviews of reports. Prior to joining A-LIGN, Stephanie worked for CBIZ, the tenth largest accounting firm in the U.S., providing auditing services in the financial accounting spectrum for various industries including automobile, hospitality, not-for-profit, real estate, and cloud architecture. Stephanie graduated from the University of South Florida with a bachelor’s degree of Science in Accounting. During her time at the University of South Florida, Stephanie was an active member of Beta Alpha Psi, an international honor society for Accounting, Finance, and Information Systems students and professionals.

Who Performs a SOC 2 Audit? The Role of SOC 2 Auditors | CSA

By Guy Rosefelt, CPO, Sangfor Technologies NFTs have become very popular with collectors and are more ubiquitous every day.  The idea of owning a one-of-a-kind object even in the digital world is very attractive.  The

In our series of letters from African journalists, novelist and writer Jonathan Marcus looks at how security issues affect crypto-wallets.

In onze reeks brieven van Afrikaanse journalisten bekijkt romanschrijver en schrijver Jonathan Marcus hoe veiligheidskwesties crypto-wallets beïnvloeden.

The idea of owning a one-of-a-kind object even in the digital world is very attractive. But artists and creatives of all types, be it painting and graphics, music, photography, and even video can now create and sell unique works that cannot be replicated. Besides security issues, they are being used by criminals for money laundering of cryptocurrency, and I do not see the value in something that will immediately become worthless when the internet apocalypse happens and your NFT wallet is no longer accessible.

Het idee is niet nieuw, aangezien het kopen van unieke voorwerpen in games al tientallen jaren bestaat. Maar kunstenaars en creatieven van alle soorten, of het nu gaat om schilderen en grafiek, muziek, fotografie, en zelfs video, kunnen nu unieke werken maken en verkopen die niet kunnen worden nagemaakt. Naast beveiligingsproblemen worden ze door criminelen gebruikt voor het witwassen van cryptocurrency, en ik zie de waarde niet in van iets dat onmiddellijk waardeloos wordt als de internetapocalyps gebeurt en je NFT wallet niet meer toegankelijk is.

NFTs have become very popular with collectors and are more ubiquitous every day. The idea of owning a one-of-a-kind object even in the digital world is very attractive. The idea is not new as buying unique items inside games has been around for decades. But artists and creatives of all types, be it painting and graphics, music, photography, and even video can now create and sell unique works that cannot be replicated.

First, I need to disclose I am not a huge fan of Non-Fungible Tokens (NFTs). Besides security issues, they are being used by criminals for money laundering of cryptocurrency, and I do not see the value in something that will immediately become worthless when the internet apocalypse happens and your NFT wallet is no longer accessible. But that is just me. Until that happens let’s talk about the security issues. Security issues include phishing scams to access crypto-wallets and steal NFTs, and selling counterfeit items, but the issue I want to discuss is using NFTs to distribute malware.

VIA, a company that specializes in solutions for infrastructure and government, reported that they discovered instances of malware being injected into NFTs and demonstrated how easy it is. It makes sense as NFTs are normally media files that have historically been used to inject code or embed malicious software that runs when open. All being an NFT does is verify that it is the only file of its kind using blockchain. But it does nothing to verify the safety of the file. VIA has even created an open-source tool to scan NFTs to look for malicious code or software in the file.

So, the next time you spend thousands of dollars on an NFT, make sure, even if it comes from a reputable vendor, to scan it before opening it and hope there is a return policy if you find something unexpected. Otherwise, your crypto wallet might have a surprise for you once the internet apocalypse ends.

Guy is Chief Product Officer for Sangfor Technologies. He has over 20 years experience (though some say it is one year’s experience twenty times) in application and network security, kicking it off with 10 years in the U.S. Air Force, reaching rank of captain. After his time in the USAF building the first fiber to the desktop LAN and other things you would find in Tom Clancy novels, Guy worked at NGAF, SIEM, WAF and CASB startups as well as big-name brands like Imperva and Citrix. He has spoken at numerous conferences around the world and in people’s living rooms, written articles about the coming Internet Apocalypse, and even managed to occasionally lead teams that designed and built security stuff. Guy is thrilled to be in his current position at Sangfor — partly because he was promised there would always be Coke Zero in the breakroom. His favorite cake is German Chocolate.

Guy can be reached online at guy.rosefelt@sangfor.com or on Twitter at @otto38dd and at our company website www.sangfor.com.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

2e Internationale Workshop over Cyber Forensics And Threat Investigations Uitdagingen Call For Papers ≈ Packet Storm

Vergelijkbare publicaties

Lessen uit T-Mobile's $350M schikking

IT-beveiligingsweekend inhaalslag - 12 augustus 2022

CCSK succesverhalen: Van de VP van Interne Veiligheid | CSA

Hoe netwerksegmentatie uw bedrijf kan beveiligen

Wie voert een SOC 2-audit uit? De rol van SOC 2 auditors | CSA

NFTS zijn cool maar gevaarlijk

Inbeslaggenomen gegevens. Update over de Marriott inbraak. Californische universiteit lijdt onder cyberaanval. Maui ransomware. Update over de NPM-aanval op de toeleveringsketen.

Viering van een decennium van samenwerking tussen de openbare sector en de particuliere sector op het gebied van cyberbeveiliging met FIRST

Debat woedt over Microsoft kwetsbaarheid praktijken na Follina, Azure problemen