Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata (namely title) before outputting them in the generated gallery, which could Read more

A vulnerability in the Envira Gallery has been reported by the FBI.

Een kwetsbaarheid in de Envira Galerij is gemeld door de FBI.

Follow the instructions, as they will assist you in mitigating the WordPress vulnerability that been reported in CVE-2021-24126. The latest version contains the CVE-2021-24126 fix. • Utilize the references The CVE-2021-24126 references have been provided for a reason.

Volg de instructies, want ze zullen u helpen bij het verminderen van de WordPress kwetsbaarheid die is gemeld in CVE-2021-24126. De laatste versie bevat de CVE-2021-24126 fix. Controleer of CVE-2021-24126 is gemitigeerd.

Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata (namely title) before outputting them in the generated gallery, which could lead to privilege escalation.

Follow the instructions, as they will assist you in mitigating the WordPress vulnerability that been reported in CVE-2021-24126.
• Install the latest version of WordPress Navigate to the official WordPress website and download the latest version of WordPress. The latest version contains the CVE-2021-24126 fix.
• Perform a vulnerability assessment Perform a scan on your WordPress environment(s), and check for vulnerabilities. Verify if CVE-2021-24126 has been mitigated.
• Utilize the references The CVE-2021-24126 references have been provided for a reason. Utilize these references and make sure that you are correctly informed.

CVE-2021-24126: Wordpress plugin vulnerability

The Record by Recorded Future gives exclusive, behind-the-scenes access to leaders, policymakers, researchers, and the shadows of the cyber underground.

Hackers have been warned to update their systems after a number of devices were infected with the Dead bolt ransomware.

Hackers zijn gewaarschuwd om hun systemen te updaten nadat een aantal apparaten waren geïnfecteerd met de Dead bolt ransomware.

QNAP urges users to update after new Deadbolt ransomware attacks discoveredData-storage hardware vendor QNAP urged users Thursday to immediately patch network attached storage (NAS) devices after several were infected recently with the Deadbolt ransomware. There has been significant debate among QNAP NAS users about whether even updated versions of the system are still vulnerable to the ransomware, which emerged in January. It is unclear where members of the Deadbolt ransomware group are based.

QNAP spoort gebruikers aan om te updaten na ontdekking van nieuwe Deadbolt ransomware-aanvallenData-opslag hardware leverancier QNAP drong er donderdag bij gebruikers op aan om network attached storage (NAS) apparaten onmiddellijk te patchen nadat een aantal onlangs waren geïnfecteerd met de Deadbolt ransomware. Er is veel discussie geweest onder QNAP NAS gebruikers over de vraag of zelfs bijgewerkte versies van het systeem nog steeds kwetsbaar zijn voor de ransomware, die in januari opdook. Het is onduidelijk waar de leden van de Deadbolt ransomware groep zijn gevestigd.

QNAP urges users to update after new Deadbolt ransomware attacks discovered

Data-storage hardware vendor QNAP urged users Thursday to immediately patch network attached storage (NAS) devices after several were infected recently with the Deadbolt ransomware.

QNAP said its Product Security Incident Response Team found that the new attacks “targeted NAS devices using QTS 4.3.6 and QTS 4.4.1, and the affected models were mainly TS-x51 series and TS-x53 series.” QTS is software that allows NAS users to manage the devices, share files and perform other tasks.

“QNAP urges all NAS users to check and update QTS to the latest version as soon as possible, and avoid exposing their NAS to the Internet,” QNAP said.

There has been significant debate among QNAP NAS users about whether even updated versions of the system are still vulnerable to the ransomware, which emerged in January. It is unclear where members of the Deadbolt ransomware group are based.

A spokesperson for QNAP told The Record that the infected devices seem to be limited to QTS versions 4.3.3 to 4.4.1.

“We recommend users update their QTS up-to-date so that the risk could be much lower,” the spokesperson said.

The company declined to answer questions about how many infections were recently discovered and how vulnerable those who have updated still are to Deadbolt infections.

In January, dozens of people turned to QNAP message boards and Reddit to say they logged on only to find the Deadbolt ransomware screen. People reported losing decades of photos, videos and irreplaceable files.

Other companies’ devices also have been attacked: Users of Asustor’s NAS hardware were also warned in February of potential Deadbolt ransomware infections after dozens of people took to Reddit and other message boards to complain of attacks.

Security company Censys reported that of the total 130,000 QNAP NAS devices sold, 4,988 services “exhibited the telltale signs of this specific piece of ransomware.”

The Taiwanese NAS giant initially urged users to disconnect their instances from the internet and update their systems.

Previously, the ransom note demanded 0.03 bitcoin for the decryption key and said, “You have been targeted because of the inadequate security provided by your vendor (QNAP).” At least one user on Reddit reported paying the ransom and not getting the decryption key.

The group also sent out a message directly to QNAP in January claiming all affected customers were “targeted using a zero-day vulnerability.”

“We offer you two options to mitigate this (and future) damage,” the group said, demanding a payment of 5 bitcoin in exchange for details about the alleged zero day used to launch the attack, or 50 bitcoin for a universal decryption master key and information about the zero day.

“There is no way to contact us. These are our only offers,” the January message reportedly said.

QNAP faced some backlash from its users after eventually releasing a forced firmware update that caused a range of issues for those considering paying the ransom.

Others said it was concerning that the company had a backdoor into its systems, while some said the forced update did little to actually address the issues of people who had already been infected with Deadbolt.

Even with the QTS update, at least one user confirmed getting hit with Deadbolt while using 5.0.0.1891 build 20211221 on a tvs-1282t3. QNAP would not confirm or deny that there was another vulnerability being exploited, according to Bleeping Computer.

Security company Emsisoft released its own version of a decryptor after several victims reported having issues with the one they received after paying a ransom. Some users even said they never got a decryptor after paying the ransom, while others said the decryptor malfunctioned.

Emsisoft’s decryptor requires users to have already paid the ransom and received the decryption keys from the Deadbolt ransomware operators.

Emsisoft CTO Fabian Wosar said QNAP users who got hit by DeadBolt and paid the ransom are struggling to decrypt their data because of the forced firmware update issued by QNAP “removed the payload that is required for decryption.” Wosar urged victims to use their tools instead.

“This will not get you around paying the ransom. Victims will still need to provide the key. It is merely an alternative decryption tool if you can’t use the mechanism provided by the threat actors due to QNAP forcing a firmware update,” Wosar said.

After a brief respite, Censys said more than 1,000 QNAP devices were infected with the Deadbolt ransomware in March.

QNAP urges users to update after new Deadbolt ransomware attacks discovered

Juice jacking makes you vulnerable to identity theft and malware. In this post, we look at juice jacking attacks and how to avoid them.

Juice jacking is one of the most common attacks on mobile phones in the world, according to the BBC’s weekly The Boss series.

Juice jacking is een van de meest voorkomende aanvallen op mobiele telefoons ter wereld, zo blijkt uit de wekelijkse serie The Boss van de BBC.

Have you ever been out and about with your phone in desperate need of a charge? And did you happen to stumble upon a public charging station and plug your phone into one of its USB ports? But did you know that you could have fallen victim to a juice jacking attack when you did that?

Bent u ooit op stap geweest met uw telefoon die dringend opgeladen moest worden? En bent u toevallig op een openbaar oplaadstation gestuit en hebt u uw telefoon in een van de USB-poorten gestoken? Maar wanneer u uw telefoon op een USB-poort aansluit, kan hij technisch gezien zowel elektriciteit als gegevens overbrengen.

Have you ever been out and about with your phone in desperate need of a charge? Probably. We’ve all been there. And did you happen to stumble upon a public charging station and plug your phone into one of its USB ports? Maybe. Many of us have. But did you know that you could have fallen victim to a juice jacking attack when you did that? Probably not.

We tend to associate charging with electricity rather than data. But when you plug your phone into a USB port, it can technically transfer both electricity and data. And if it can transfer data, it can do things like exfiltrate your personal information and upload malware to your device.

This post looks at what juice jacking is, how it works, and what you can do to steer clear of it.

Brian Krebs coined the term juice jacking in 2011 after he conducted a proof of concept attack at DEFCON. When users plugged their phones into a free (and compromised) charging station, a message was displayed on the kiosk screen:

“You should not trust public kiosks with your smartphone. Information can be retrieved or downloaded without your consent. Luckily for you, this station has taken the ethical route, and your data is safe. Enjoy the free charge!”

And that message illustrates the crux of juice jacking. Juice jacking occurs when a malicious actor has infected a USB port (or the cable attached to the port) with malware. That typically occurs on public charging stations you find in airports, shopping centers, and coffee shops, among other places.

Once your phone is connected and charging, the attacker could download your files and information or monitor your keystrokes on the device. They could also infect your phone by uploading a virus or malware onto it, leading to all sorts of fun stuff.

When you connect your phone to your computer via USB, it typically gets mounted as an external drive, and you can access and copy files to and from your phone. That’s because, as mentioned above, your typical USB port isn’t simply a power socket but a data channel as well.

A typical USB port comprises five pins, only one of which is used for charging. Two other ones are used for data transfer, and the remaining two are used as an attached device presence indicator and the ground, respectively.

Usually, the phone’s operating system disables the data transfer capabilities as soon as the phone is plugged in. You may have seen a prompt on your phone asking you to “trust” the computer you’re connected to. Trusting the host computer enables data transfers. If you choose not to trust the host machine or ignore the prompt, data transfers will not be possible – unless you connect your phone to an infected public charging station.

Infected USB ports can silently enable data transfer modes on your phone once connected. You won’t be prompted and won’t have any indication that this is happening. Once you unplug your phone, you may have had your personal information stolen, and your phone may well be infected with a virus or malware – lucky you.

There are different types of juice jacking attacks, check them out below.

We touched upon this payload above. One of the common goals of juice jacking attacks is to exfiltrate unsuspecting users’ personal information. The actual stealing of the data will typically be fully automated and will happen very quickly. And given how intimate we are with our phones today, this could lead to compromised credit cards, bank accounts, email, health records, etc. It’s just not worth a quick charge.

Once the attacker restores data transfer capabilities, it can flow both ways. That means that they will be able to upload malware or a virus onto your phone. Once infected, your phone will be susceptible to all of the harms associated with malware/virus infections: data loss, loss of functionality, random network connections, device slowdown, installation of other malware, etc.

A multi-device juice jacking attack is essentially the same as the malware/virus infection attack in that the attacker infects your device with malware. The difference is simply that the malware that was loaded onto your phone is designed to infect the other USB charging ports on the charging station. That scales up the attack and enables the attacker to compromise multiple devices simultaneously, growing their payload.

In a disabling juice jacking attack, the mobile phone is, well… disabled. Once connected to the infected charging port, the attacker will load malware onto the phone, effectively disabling it for the legitimate user while retaining full control over the device for themselves. The same harms as above follow a disabling juice jacking attack, with the added bonus of potentially being used as part of a DDoS attack.

Where are you most at risk of juice jacking attacks?

Anywhere there’s a public USB charging station, there’s a risk of falling victim to a juice jacking attack. But the place where these attacks are the most prevalent is airports. And there are a few reasons for this.

First, to maximize the return on their investment, attackers need a lot of potential targets. Airports are high transit areas, and so they fit the bill perfectly. Also, the airport is one of those places where many will feel it’s critical to have their mobile phone nicely charged, maximizing the chances they would plug their device into the charging station.

Add to that the fact that airports are often stressful and time-pressured environments, which tend to promote quick decisions – such as ignoring sound advice and plugging your phone into a public charging station.

That being said, all public charging stations are a security risk.

What devices are vulnerable to juice jacking attacks?

Most juice jacking attacks end up happening on mobile phones. But that doesn’t mean mobile phones are more vulnerable to juice jacking attacks than other devices. It’s simply because they’re the most used mobile device and hence, the device that’s most likely to need a charge on the go.

But any device that charges via USB is vulnerable. That means mobile phones and tablets, but also smartwatches, fitness bracelets, and even laptops (if they support USB charging – and many do).

The first and most fool-proof way to avoid juice jacking attacks is simply not to use public charging stations. If your phone runs out of power, bite the bullet and go phoneless until you can charge it safely. That may be a big ask, but you’re guaranteed success with this method!

Enable and use your device’s software security measures

Mobile devices come with some technical protections against juice jacking and other security threats. If you must use a public charging station, put as many of the following tips into practice:
• Disable your device’s option to automatically transfer data when a charging cable is connected. This is the default on iOS devices. Android users should disable this option in the Settings app.
• Lock your device once connected to the charging station. That will prevent it from being able to sync or transfer data.
• If your device displays a prompt asking you to “trust this computer,” it means you’ve connected to another device, not simply a power outlet. Deny the permission, as trusting the computer will enable data transfers to and from your device. This last point may not be fool-proof, but it’s still better than actively allowing data transfers

You can also turn your device off before charging it. However, many mobile phones (I’ve experienced this with an iPhone) automatically turn on when connected to power. So your mileage may vary. If your mobile phone does not turn on automatically when connected to power, this is an effective safeguard.

Instead of having no plan B and being stuck using a charging station, unleash your inner MacGyver and have a backup.
• Carry an extra charger and cable with you, and find a wall outlet to charge your device if needed.
• Carry a USB battery with you. These are cheap, readily available, and many of them can recharge your device multiple times.
• Bring a backup battery with you. If your device has a removable battery, you can simply swap it out with a fully charged one when needed.

All of the above options are better than using a public charging station and will prevent you from falling victim to a juice jacking attack.

USB passthrough devices are small devices that look like a USB flash drive. You insert your USB cable into the passthrough device, and it prevents any data from being transmitted over that cable. It does this by disabling the data pins (see above) in the USB cable.

USB passthrough devices, sometimes called USB condoms, are a great way to protect yourself from juice jacking attacks. They’re cheap, work well, and are readily available in electronics shops (primarily online ones).

Alternatively, you can use a USB charging cable that only allows for charging, barring the potential for data transfers by either disabling or not including the data transfer pins in the USB connector. These cables provide the same protection as USB passthrough devices.

So those are the ins and outs of juice jacking attacks. While not the most prevalent attack today, the number of incidences can only grow as our smartphone addiction culture marches on. Hopefully, this post will help you better understand and mitigate the risks of juice jacking and, with a bit of luck, avoid them altogether.

Stay safe (and charge your devices before you leave the house).

Juice jacking: What it is, how it works, and how to avoid it

Aside from unsophisticated “smash and grab” style data thefts and ransomware attacks, the initial identity theft is only the beginning.

Hackers are increasingly trying to secure their identity when they are targeted by a single set of compromised credentials.

Hackers proberen steeds vaker hun identiteit veilig te stellen wanneer zij het doelwit zijn van een enkele reeks gecompromitteerde inloggegevens.

As we have repeatedly seen, a single set of compromised credentials can be enough to infiltrate an organization and drop a virtual bomb in its network. The Colonial Pipeline ransomware attack was made possible with just one set of credentials. More recently, the ransomware and data theft attack on Planned Parenthood also seems to have started with a compromised account.

Deze kunnen lijken op AD en andere kritieke middelen die aanvallers zoeken en hebben een tweeledig doel: hen op het verkeerde been zetten en een beveiligingswaarschuwing afgeven. AD is een essentiële troef voor de aanvaller, omdat hij deze kan bevragen om bevoorrechte accounts te vinden, zoals domeinbeheerders met de toegangsniveaus die nodig zijn om hun escalatie voort te zetten. Op dit punt is de situatie inderdaad nijpend voor de doelorganisatie, aangezien de aanvaller vrijwel onbeperkte toegang krijgt tot kritieke gegevens en systemen, en ook de mogelijkheid heeft zijn sporen uit te wissen om te kunnen blijven bestaan.

Cybersecurity has come to be defined by identity, with almost every attack today revolving around gaining control of a user’s identity as a means of accessing critical data and systems. Verizon’s latest data breach report found that credentials are the most sought-after form of data.

As we have repeatedly seen, a single set of compromised credentials can be enough to infiltrate an organization and drop a virtual bomb in its network.

The Colonial Pipeline ransomware attack was made possible with just one set of credentials. More recently, the ransomware and data theft attack on Planned Parenthood also seems to have started with a compromised account.

So how can enterprises limit the blast radius of a stolen identity?

Why AD is the key to identity attacks

Aside from unsophisticated “smash and grab” style data thefts and ransomware attacks, the initial credential theft is only the beginning. Cybercriminals seek to escalate their privileges before executing their attack so that they can maximize the impact and potential spoils.

Most firms now employ strategies like identity access management (IAM) and privileged access management (PAM) to authenticate user identities. But they must also look beyond this to protect the very mechanisms that govern identification.

The most important of these is Active Directory, the beating heart at the center of every organization that handles the bulk of its identity management processes.

AD is an essential asset for the attacker as they can query it to locate privileged accounts such as domain admins with the access levels needed to continue their escalation. The cybercriminal community has developed a multitude of techniques to access and exploit AD, including Golden Ticket attacks, Kerberoasting, and Windows Security Identifier (SID) history injection.

Compromising AD makes it far easier for the intruder to locate and access a powerful account such as a domain controller. At this point, the situation is dire indeed for the target organization, as the attacker gains practically unlimited access to critical data and systems, as well as the ability to erase their tracks to maintain persistence.

AD has also become a popular target for disruptive ransomware attacks. Encrypting AD causes tremendous disruption and increases the likelihood of the victim paying the ransom to restore access.

Diffusing the attacker’s bomb before it can go off

Most cybersecurity strategies are naturally defensive and, therefore, reactive. The traditional approach has been to set up as many layers of security as possible and hope that it is enough to stop an attacker or, at least, slow them down long enough to catch them before they cause too much damage.

Many firms that have suffered a breach believed they were doing everything right, with a good security team and multiple tools such as EDR focused on keeping intruders out. However, these defense layers were often bolted to the outside rather than applied to core business systems.

The rising volume and cost of breaches make it clear this reactive approach is no longer enough. Attackers are consistently able to exploit user identities to reach deep within the network and execute their strike at the time and place of their choosing.

So instead, organizations need to take the fight to the attackers. This strategy calls for a more proactive approach that seeks to disrupt the attacker’s toolkit and prevent them from executing their attack. It’s almost impossible to stop attackers from acquiring stolen credentials, but this is meaningless if identity misuse can be detected and stopped before the attacker can strike.

Deceptive tactics offer one effective way of disrupting the attacker and buying time for security teams to move in and diffuse their virtual bomb. Deception has become more widespread in recent years, often taking the form of lures placed within the network that mimic real files. These can resemble AD and other critical assets sought by attackers and have the dual purpose of both throwing them off the scent of the real thing and triggering a security alert.

Firms can also take things a step further by combining deceptive lures with a cloaking approach that hides the real assets from sight. Threat actors rely on automated tools like Bloodhound to sniff out targets such as AD for them, and they aren’t used to the idea of these toolkits failing them. They will have little idea they are going astray when their tools miss the hidden targets and get diverted by convincing decoys.

The key to success is detecting when credential theft and abuse occur. If organizations can recognize when certain identities access the network illegitimately, they can respond and stop the attack in its tracks. The sooner in the attack cycle this occurs, the smaller the blast radius will be.

Reducing the blast radius of credential theft

Network segmentation is a best practice and when done correctly it improves network security and

The SolarWinds breach has been linked to a massive cyber-attack that has left more than 100 people dead.

De inbreuk bij SolarWinds is in verband gebracht met een grootschalige cyberaanval waarbij meer dan 100 mensen om het leven zijn gekomen.

Every organization is at risk for cyberattacks, and it’s unsettling that the attackers are so good at maximizing the damage to their victims. The time an attacker spends inside a network is referred to as ‘dwell time,’ and it’s measured from the point of intrusion to the point of detection. Long dwell times increase the damage of an attack, often in ways that can’t be measured.

Elke organisatie loopt het risico op cyberaanvallen, en het is verontrustend dat de aanvallers zo goed zijn in het maximaliseren van de schade aan hun slachtoffers. Aanvallers die de bedrijfsverdediging omzeilen, zullen zich zo lang mogelijk in het netwerk verbergen, zelfs als ze van plan zijn een ransomware-aanval uit te voeren. Lange verblijftijden verhogen de schade van een aanval, vaak op een manier die niet kan worden gemeten.

Every organization is at risk for cyberattacks, and it’s unsettling that the attackers are so good at maximizing the damage to their victims. Their tactics are increasingly sophisticated and often involve some type of email attack, bot attack, or even just old-school social engineering. Attackers who bypass company defenses will hide inside the network as long as possible, even if they’re planning to launch a ransomware attack. They use this time to explore the network, steal data and user credentials, destroy backups, and do anything else they can do to set themselves up for future attacks.

The time an attacker spends inside a network is referred to as ‘dwell time,’ and it’s measured from the point of intrusion to the point of detection. Long dwell times increase the damage of an attack, often in ways that can’t be measured. The SolarWinds breach is the perfect example of this. The intruders entered the network in early 2019 and were not discovered until December 2020. The exact number of victims and costs associated with the attack remain unknown.

Network segmentation is one of the easiest and most effective ways to reduce dwell time. For those of you not familiar with this practice, it’s just like it sounds: You divide your network into different sections (segments) and you ‘lock the doors’ between them.

You’ve seen this concept at work in high-security buildings that restrict access to certain parts of the facility to people who have been granted permission to enter that restricted section. This keeps people from wandering around and exploring areas that are critical to operations or contain sensitive information. Segmentation does something similar for your network.

There are immediate security benefits to separating your network into multiple contained segments:
• Segmentation creates a smaller attack surface within the network. An intruder will be limited to the segment that was breached. The attacker can go no further unless they successfully breach another segment. Isolating your mission-critical servers and data can prevent an intruder from gaining access to your resources through a neglected printer or rogue smart device.
• Segmentation makes it easier to detect and isolate security incidents. The division between the segments helps contain the spread of malware and viruses. It limits the areas where the intruder can hide, and it can improve the efficiency of security monitoring.

There are non-security benefits as well. For example, POS devices fall under strict compliance rules. Assigning POS devices their own segment helps companies by limiting the cardholder data environment (CDE) and reducing the scope of PCI DSS compliance.

Segmentation also improves network performance by separating traffic. A good example of improving both security and performance is the separation of a public network from private resources. A shopping center or school campus that offers free wireless access to guests would want that traffic separated from the line-of-business applications. This keeps the potential traffic congestion of public wireless access isolated to assigned segments.

Gartner analysts have warned against over-segmentation, which can complicate the management and use of the network. One Gartner study found that over 70% of segmentation projects had to be re-architected because the segmentation made it too difficult for authorized users to access what they needed to perform their work.

“A principle of network segmentation is to group like resources together, to minimize security overhead: Build a fence around the car park, not a fence and gate around every car. ~Gartner”

Barracuda can help you secure your network while making it easier to manage. Visit our website for more information on Barracuda CloudGen Firewall, secure SD-WAN, and other network security solutions.

How network segmentation can help secure your business

Pursuing a SOC 2 audit is a multi-step process. This blog clarifies the SOC 2 audit process and explains the role of SOC 2 auditors and compliance software.

When it comes to cybersecurity, companies need to demonstrate their ability to protect data and information.

Als het om cyberbeveiliging gaat, moeten bedrijven aantonen dat zij in staat zijn gegevens en informatie te beschermen.

Pursuing a SOC 2 audit is a multi-step process, which can seem confusing at first glance given the fact that there are vendors that provide compliance software, and other vendors who are themselves certified SOC 2 auditors. This blog will clarify the SOC 2 audit process, as well as explain the role of SOC 2 auditors and compliance software. When and How to Use SOC 2 Software ToolsThere are multiple steps to completing a SOC 2 audit.

Enter, SOC 2 (Service Organization Control 2), een populaire audit die getuigt van het vermogen van een bedrijf om gegevens en informatie te beschermen. Het nastreven van een SOC 2-audit is een proces dat uit verschillende stappen bestaat, wat op het eerste gezicht verwarrend kan lijken, gezien het feit dat er verkopers zijn die nalevingssoftware leveren, en andere verkopers die zelf gecertificeerde SOC 2-auditors zijn. Wanneer en hoe SOC 2-softwaretools gebruikenEr zijn verschillende stappen om een SOC 2-audit te voltooien.

Data breaches and ransomware attacks continue to dominate the news cycle. To protect data, and position themselves favorably among prospects and customers, companies need to demonstrate a commitment to cybersecurity.

Enter, SOC 2 (Service Organization Control 2), a popular audit that attests to a company’s ability to protect data and information. It’s a strong validator for any company looking to demonstrate its commitment to cybersecurity to partners and customers.

Pursuing a SOC 2 audit is a multi-step process, which can seem confusing at first glance given the fact that there are vendors that provide compliance software, and other vendors who are themselves certified SOC 2 auditors.

This blog will clarify the SOC 2 audit process, as well as explain the role of SOC 2 auditors and compliance software.

When and How to Use SOC 2 Software Tools

There are multiple steps to completing a SOC 2 audit. Many companies start with a readiness/gap assessment, which is the process of reviewing existing controls in place and identifying those that need to be improved or implemented. This process can be executed via an audit consultant, or through specialized software tools that help simplify this process (like A-SCEND).

Compliance software tools typically provide automated workflows and compliance templates, comparing your existing controls against the controls within a selected compliance framework — which, in this case, would be the SOC 2 framework.

Typically, this software allows you to visualize progress toward compliance goals, assign tasks related to evidence collection or policy updates, and collaborate all in one dashboard. Software tools provide a simple way to understand the framework requirements, assess them against your existing policies and procedures, and manage the process of updating policies. While these tools help to better prepare for an audit and streamline the assessment process, an experienced auditor is still a critical component of compliance.

When and How to Use SOC 2 Auditors

Software tools can only take you so far with SOC 2. They can help prepare a company for a SOC 2 audit, but not complete the audit itself. When the actual audit takes place, companies must turn to a SOC auditor.

SOC 2 audits are regulated by the American Institute of Certified Public Accountants (AICPA) and must be completed by an external auditor from a licensed CPA firm. This is the only way a company can receive an official SOC 2 report, whether it’s a Type 1 or Type 2 report.

An official SOC 2 report is valid for one year following the date the report was issued. Future annual audits must also be completed by an external auditor from a licensed CPA firm.

If your organization plans to use software to prepare for an audit, it’s helpful to work with a software partner who can also conduct the official audit (as a certified CPA) because it provides an added layer of convenience throughout the SOC 2 process and results in a reputable report. 



Organizations need to go beyond the data collection by their compliance software tool and conduct further due diligence, such as observations and walkthroughs (conversations) between the audit team and the client. SOC 2 auditors may also find that they need additional data or evidence necessary to validate the design and operating effectiveness of a complete control set. When you use the same company for a technology-enabled audit, and a SOC 2 report, the software is designed to request all audit materials needed, including manually operated controls and supporting evidence. In this convenient scenario, you can save time, resources, and money.

Stephanie Oyler is the Vice President of Attestation Services at A-LIGN focused on overseeing a variation of many assessments within the SOC practice. Stephanie’s responsibilities include managing key service delivery leadership teams, maintaining auditing standards and methodologies, and analyzing business unit metrics. Stephanie has spent several years at A-LIGN in service delivery roles from auditing and managing client engagements to overseeing audit teams and providing quality reviews of reports. Prior to joining A-LIGN, Stephanie worked for CBIZ, the tenth largest accounting firm in the U.S., providing auditing services in the financial accounting spectrum for various industries including automobile, hospitality, not-for-profit, real estate, and cloud architecture. Stephanie graduated from the University of South Florida with a bachelor’s degree of Science in Accounting. During her time at the University of South Florida, Stephanie was an active member of Beta Alpha Psi, an international honor society for Accounting, Finance, and Information Systems students and professionals.

Who Performs a SOC 2 Audit? The Role of SOC 2 Auditors | CSA

By Guy Rosefelt, CPO, Sangfor Technologies NFTs have become very popular with collectors and are more ubiquitous every day.  The idea of owning a one-of-a-kind object even in the digital world is very attractive.  The

In our series of letters from African journalists, novelist and writer Jonathan Marcus looks at how security issues affect crypto-wallets.

In onze reeks brieven van Afrikaanse journalisten bekijkt romanschrijver en schrijver Jonathan Marcus hoe veiligheidskwesties crypto-wallets beïnvloeden.

The idea of owning a one-of-a-kind object even in the digital world is very attractive. But artists and creatives of all types, be it painting and graphics, music, photography, and even video can now create and sell unique works that cannot be replicated. Besides security issues, they are being used by criminals for money laundering of cryptocurrency, and I do not see the value in something that will immediately become worthless when the internet apocalypse happens and your NFT wallet is no longer accessible.

Het idee is niet nieuw, aangezien het kopen van unieke voorwerpen in games al tientallen jaren bestaat. Maar kunstenaars en creatieven van alle soorten, of het nu gaat om schilderen en grafiek, muziek, fotografie, en zelfs video, kunnen nu unieke werken maken en verkopen die niet kunnen worden nagemaakt. Naast beveiligingsproblemen worden ze door criminelen gebruikt voor het witwassen van cryptocurrency, en ik zie de waarde niet in van iets dat onmiddellijk waardeloos wordt als de internetapocalyps gebeurt en je NFT wallet niet meer toegankelijk is.

NFTs have become very popular with collectors and are more ubiquitous every day. The idea of owning a one-of-a-kind object even in the digital world is very attractive. The idea is not new as buying unique items inside games has been around for decades. But artists and creatives of all types, be it painting and graphics, music, photography, and even video can now create and sell unique works that cannot be replicated.

First, I need to disclose I am not a huge fan of Non-Fungible Tokens (NFTs). Besides security issues, they are being used by criminals for money laundering of cryptocurrency, and I do not see the value in something that will immediately become worthless when the internet apocalypse happens and your NFT wallet is no longer accessible. But that is just me. Until that happens let’s talk about the security issues. Security issues include phishing scams to access crypto-wallets and steal NFTs, and selling counterfeit items, but the issue I want to discuss is using NFTs to distribute malware.

VIA, a company that specializes in solutions for infrastructure and government, reported that they discovered instances of malware being injected into NFTs and demonstrated how easy it is. It makes sense as NFTs are normally media files that have historically been used to inject code or embed malicious software that runs when open. All being an NFT does is verify that it is the only file of its kind using blockchain. But it does nothing to verify the safety of the file. VIA has even created an open-source tool to scan NFTs to look for malicious code or software in the file.

So, the next time you spend thousands of dollars on an NFT, make sure, even if it comes from a reputable vendor, to scan it before opening it and hope there is a return policy if you find something unexpected. Otherwise, your crypto wallet might have a surprise for you once the internet apocalypse ends.

Guy is Chief Product Officer for Sangfor Technologies. He has over 20 years experience (though some say it is one year’s experience twenty times) in application and network security, kicking it off with 10 years in the U.S. Air Force, reaching rank of captain. After his time in the USAF building the first fiber to the desktop LAN and other things you would find in Tom Clancy novels, Guy worked at NGAF, SIEM, WAF and CASB startups as well as big-name brands like Imperva and Citrix. He has spoken at numerous conferences around the world and in people’s living rooms, written articles about the coming Internet Apocalypse, and even managed to occasionally lead teams that designed and built security stuff. Guy is thrilled to be in his current position at Sangfor — partly because he was promised there would always be Coke Zero in the breakroom. His favorite cake is German Chocolate.

Guy can be reached online at guy.rosefelt@sangfor.com or on Twitter at @otto38dd and at our company website www.sangfor.com.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

NFTS Are Cool but Dangerous

By Randy Reiter CEO of Don’t Be Breached April, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers' databases after bypassing authentication. "By exploiting

Hackers could have exploited a vulnerability in Microsoft’s databases, according to researchers.

Hackers hebben volgens onderzoekers misbruik kunnen maken van een kwetsbaarheid in de databases van Microsoft.

By Randy Reiter CEO of Don’t Be BreachedApril, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers’ databases after bypassing authentication. Microsoft said its analysis showed no evidence of attackers having exploited the vulnerabilities to access customer data. Wiz said Microsoft awarded its researchers a $40,000 bug bounty — the amount can be viewed as confirmation of the vulnerability’s severity.

Door Randy Reiter CEO van Don't Be BreachedIn april 2022 meldde Microsoft dat kwetsbaarheden in zijn Azure Database voor PostgreSQL hackers toegang konden verschaffen tot de databases van andere klanten nadat ze de authenticatie hadden omzeild. Volgens Microsoft heeft zijn analyse geen aanwijzingen opgeleverd dat aanvallers de kwetsbaarheden hebben misbruikt om toegang te krijgen tot klantengegevens. Wiz zei dat Microsoft zijn onderzoekers een bounty van 40.000 dollar heeft toegekend - het bedrag kan worden gezien als een bevestiging van de ernst van de kwetsbaarheid.

By Randy Reiter CEO of Don’t Be Breached

April, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers’ databases after bypassing authentication. “By exploiting an elevated permissions bug in the Flexible Server authentication process for a replication user, a malicious user could leverage an improperly anchored regular expression to bypass authentication to gain access to other customers’ databases” the Microsoft Security Response Center reported.

The cloud security firm Wiz’s research team discovered the security vulnerabilities. An attacker could create a full copy of a target database in Azure PostgreSQL [Flexible Server], essentially exfiltrating all the information stored in the database, says Ami Luttwak, co-founder and CTO at Wiz.

Microsoft said it mitigated the issue on Jan. 13, 2022, less than 48 hours after Wiz had notified it of the issue. Microsoft said its analysis showed no evidence of attackers having exploited the vulnerabilities to access customer data. Wiz said Microsoft awarded its researchers a $40,000 bug bounty — the amount can be viewed as confirmation of the vulnerability’s severity.

How to Have Exploited the Database Vulnerability

As explained by Microsoft, the Wiz researchers went through the following steps to gain elevated privileges and remote code execution, which allowed them to bypass cross-account authentication using a forged certificate and access other customers’ databases:
• Retrieve the target’s common name from the Certificate Transparency feed.
• Find the target’s Azure region by resolving the database domain name and matching it to one of Azure’s public IP ranges.
• Create an attacker-controlled database in the target’s Azure region.
• Exploit vulnerability #1 on the attacker-controlled instance to escalate privileges and gain code execution.
• Scan the subnet for the target instance and exploit vulnerability #2 to gain read access!

How to Prevent Data Exfiltration and Data Breaches in Todays Complex Environment

Multiple layers of data protection are required today to prevent Data Exfiltration and Data Breaches. In 2020 the DHS, Department of State, U.S. Marine Corps and the Missile Defense Agency recognized this and all issued requests for proposals (RFP) for network full packet data capture for Deep Packet Inspection analysis (DPI) of network traffic. This is an important step forward protecting confidential database data and organization information.

Zero-day vulnerabilities that allow hackers to gain system privileges are a major threat to all organizations encrypted and unencrypted confidential data. Confidential data includes: credit card, tax ID, medical, social media, corporate, manufacturing, trade secrets, law enforcement, defense, homeland security, power grid and public utility data. This confidential data is almost always stored in DB2, Informix, MariaDB, Microsoft SQL Server, MySQL, Oracle, PostgreSQL and SAP Sybase databases.

How to Stop Data Exfiltration and Data Breaches with Deep Packet Inspection

Protecting encrypted and unencrypted confidential database data is much more than securing databases, operating systems, applications and the network perimeter against Hackers, Rogue Insiders and Supply Chain Attacks.

Non-intrusive network sniffing technology can perform a real-time Deep Packet Inspection (DPI) of 100% the database activity from a network tap or proxy server with no impact on the database servers. The database SQL activity is very predictable. Database servers servicing 1,000 to 10,000 end-users typically process daily 2,000 to 10,000 unique queries or SQL commands that run millions of times a day. Deep Packet Analysis does not require logging into the monitored networks, servers or databases. This approach can provide CISOs with what they can rarely achieve. Total visibility into the database activity 24×7 and 100% protection of confidential database data.

Advanced SQL Behavioral Analysis of 100% of the real-time database SQL packets can learn what the normal database activity is. Now the database query and SQL activity can be non-intrusively monitored in real-time with DPI and non-normal SQL activity immediately pinpointed. This approach is inexpensive to setup and has a low cost of operation. Now non-normal database activity from Hackers, Rogue Insiders or and Supply Chain Attacks can be detected in a few milli seconds. The Security Team can be immediately notified and the Hacker session terminated so that confidential database data is not stolen, ransomed or sold on the Dark Web.

Reiter is the CEO of Don’t Be Breached a Sql Power Tools company. He is the architect of the Database Cyber Security Guard product, a database Data Breach prevention product for DB2, Informix, MariaDB, Microsoft SQL Server, MySQL, Oracle, PostgreSQL, and SAP Sybase databases. He has a Master’s Degree in Computer Science and has worked extensively over the past 25 years with real-time network sniffing and database security. Randy can be reached online at rreiter@DontBeBreached.com, www.DontBeBreached.com and www.SqlPower.com/Cyber-Attacks.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Azure PostgreSQL User Databases Were Exposed Due to Critical Vulnerabilities

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday. Spokeswoman Biliana Necheva says in

A Canadian manufacturing company says it has been forced to freeze its operations following a cyber attack.

Een Canadees productiebedrijf zegt dat het gedwongen is zijn activiteiten te bevriezen na een cyberaanval.

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday. Spokeswoman Biliana Necheva says in an email operations have not resumed more than 48 hours after they were halted as a cautionary measure. It comes at a tough time for BRP, as supply chain woes weighed on sales in its first quarter, with more input obstacles expected on the powersport vehicle maker’s path for the rest of the year.

Woordvoerster Biliana Necheva zegt in een e-mail dat de operaties meer dan 48 uur nadat ze uit voorzorg waren stopgezet, nog niet zijn hervat. Dit komt op een moeilijk moment voor BRP, aangezien de problemen met de toeleveringsketen de verkoop in het eerste kwartaal hebben gedrukt. Voor de rest van het jaar worden nog meer invoerbelemmeringen verwacht voor de fabrikant van motorvoertuigen.

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday.

Spokeswoman Biliana Necheva says in an email operations have not resumed more than 48 hours after they were halted as a cautionary measure.

The Quebec-based company, which manufactures Ski-Doos and off-road vehicles, announced Monday morning it was the target of “malicious cybersecurity activity” and took “immediate measures to contain the situation.”

Deploying its own information technology staff, BRP also said it hired cybersecurity experts to help secure its systems and support an internal investigation.

The company said its freeze on operations could delay some transactions with customers and suppliers.

It comes at a tough time for BRP, as supply chain woes weighed on sales in its first quarter, with more input obstacles expected on the powersport vehicle maker’s path for the rest of the year.

Spun off from Bombardier Inc. in 2003, BRP employs nearly 20,000 workers, mainly at manufacturing and distribution sites in Mexico, Canada, Austria, the United States, Finland and Australia. Its products are sold in more than 120 countries.

This report by The Canadian Press was first published Aug. 11, 2022.

BRP operations remain frozen more than two days after cyberattack

A 39-year-old Saskatchewan man accused of stabbing someone in a hospital is facing an elevated charge of second-degree murder. Police were called to

Two men have been charged with murder after a fatal stabbing in Saskatoon.

Twee mannen zijn aangeklaagd voor moord na een dodelijke steekpartij in Saskatoon.

Police were called to Saskatoon’s Royal University Hospital in June after a 55-year-old man was stabbed. The suspect was initially charged with attempted murder, but police say the charge was upgraded after the man recently succumbed to his injuries in hospital. Police did not identify the two men in the case.

De politie werd in juni opgeroepen naar het Royal University Hospital in Saskatoon nadat een 55-jarige man was neergestoken. De verdachte werd aanvankelijk poging tot moord ten laste gelegd, maar de politie zegt dat de aanklacht werd opgewaardeerd nadat de man onlangs in het ziekenhuis aan zijn verwondingen was bezweken. De politie heeft de twee mannen in de zaak niet geïdentificeerd.

A 39-year-old Saskatchewan man accused of stabbing someone in a hospital is facing an elevated charge of second-degree murder.

Police were called to Saskatoon’s Royal University Hospital in June after a 55-year-old man was stabbed.

The suspect was initially charged with attempted murder, but police say the charge was upgraded after the man recently succumbed to his injuries in hospital.

Police did not identify the two men in the case.

They say the accused is in custody and scheduled to appear in court today.

It’s the seventh homicide in Saskatoon so far this year.

This report by The Canadian Press was first published Aug. 11, 2022.

CVE-2021-24126: Wordpress plugin kwetsbaarheid

Vergelijkbare publicaties

Hoe netwerksegmentatie uw bedrijf kan beveiligen

Wie voert een SOC 2-audit uit? De rol van SOC 2 auditors | CSA

NFTS zijn cool maar gevaarlijk

Azure PostgreSQL gebruikersdatabases werden blootgesteld als gevolg van kritieke kwetsbaarheden

Verrichtingen BRP blijven meer dan twee dagen na cyberaanval bevroren

Aanklacht tegen man van steekpartij in ziekenhuis Saskatoon is verhoogd na overlijden slachtoffer

Gevonden topics

QNAP spoort gebruikers aan om te updaten na ontdekking van nieuwe Deadbolt ransomware-aanvallen

Sap aftappen: Wat het is, hoe het werkt, en hoe het te vermijden

Vermindering van de straal van diefstal van geloofsbrieven