Ukraine shakes up its security and prosecutorial services. Cyberattacks hit Albania. Advanced persistent threat actors prospect journalists. The GRU is said to be trolling researchers who look into Sandworm. Thomas Etheridge from CrowdStrike on identity management. Our guest is Robin Bell from Egress discussing their Human Activated Risk Report. And CISA opens a liaison office in London.

Ukraine's intelligence agency, the GRU, is believed to be behind a cyber attack on the country.

De inlichtingendienst van Oekraïne, de GRU, wordt geacht achter een cyberaanval op het land te zitten.

Advanced persistent threat actors prospect journalists. Thomas Etheridge from CrowdStrike on identity management. Our guest is Robin Bell from Egress discussing their Human Activated Risk Report.

Oekraïne schudt zijn veiligheids- en vervolgingsdiensten op. Onze gast is Robin Bell van Egress over hun Human Activated Risk Report. En CISA opent een verbindingskantoor in Londen.

Ukraine shakes up its security and prosecutorial services. Cyberattacks hit Albania. Advanced persistent threat actors prospect journalists. The GRU is said to be trolling researchers who look into Sandworm. Thomas Etheridge from CrowdStrike on identity management. Our guest is Robin Bell from Egress discussing their Human Activated Risk Report. And CISA opens a liaison office in London.

Information Systems Are Intact, Says Albanian Government after Cyber Attack (Exit - Explaining Albania)

Albania Shuts Down Digital Services and Government Websites after Cyber Attack (Exit - Explaining Albania)

Cybersecurity Firm: What US Journalists Need To Know About The Foreign Hackers Targeting Them Forbes)

Sandworm APT Trolls Researchers on Its Trail as It Targets Ukraine (Dark Reading)

Ukraine’s security chief and head prosecutor are out. Cyberattacks hit Albania. APTs prospect journalists. The GRU trolls researchers. CISA to open an attaché office in London.

Files from Tom Li Elizabeth Warren slams Intuit for misleading tax filers, a popular windows toolbox script is actually malware, and the U.S. military contracts a 3D printing company to build training facilities. That’s all the tech news that’s trending right now, welcome to Hashtag Trending. It’s Tuesday, April 19, and I’m your host,

The US senator has accused the parent company of the controversial Free File program of misleading taxpayers to pay for their services.

De Amerikaanse senator heeft de moedermaatschappij van het omstreden Free File-programma ervan beschuldigd belastingbetalers te misleiden om voor hun diensten te betalen.

Elizabeth Warren slams Intuit for misleading tax filers, a popular windows toolbox script is actually malware, and the U.S. military contracts a 3D printing company to build training facilities. Senator Elizabeth Warren is questioning Intuit, the parent company of the TurboTax software, on why Americans need to pay to file taxes. Warren stated that Intuit used extensive lobbying tactics to prevent Americans from filing taxes for free, misleading them to pay for services like TurboTax.

Elizabeth Warren bekritiseert Intuit voor het misleiden van belastinginvullers, een populair Windows toolbox script is eigenlijk malware, en het Amerikaanse leger huurt een 3D printing bedrijf in om trainingsfaciliteiten te bouwen. Senator Elizabeth Warren ondervraagt Intuit, het moederbedrijf van de TurboTax-software, over de vraag waarom Amerikanen moeten betalen om belastingen in te dienen. Warren verklaarde dat Intuit uitgebreide lobbytactieken gebruikte om te voorkomen dat Amerikanen gratis belastingaangifte konden doen, en hen misleidde om te betalen voor diensten als TurboTax.

Elizabeth Warren slams Intuit for misleading tax filers, a popular windows toolbox script is actually malware, and the U.S. military contracts a 3D printing company to build training facilities.

That’s all the tech news that’s trending right now, welcome to Hashtag Trending. It’s Tuesday, April 19, and I’m your host, Samira Balsara.

U.S. Senator Elizabeth Warren is questioning Intuit, the parent company of the TurboTax software, on why Americans need to pay to file taxes. Warren stated that Intuit used extensive lobbying tactics to prevent Americans from filing taxes for free, misleading them to pay for services like TurboTax. The controversy surrounds the Free File program, an initiative started by the IRS, through which Americans earning under $73,000 per year can file their taxes at no cost. In a letter, Warren accused the companies collaborating with the IRS on Free Filing of scamming taxpayers, misleading filers into paying for their services. Her statement follows up a recent lawsuit filed by the FTC against Intuit over the company’s deceptive marketing practices.

A popular Windows Toolbox script turned out to be a trojan in disguise. The script, simply called Windows Toolbox on Github, allowed users to crack Microsoft Office and Windows, as well as to install Google Play Store on Windows 11, a function that Microsoft doesn’t yet officially support. The prospect of unlocking the full breadth of Android Apps on Windows 11 generated a lot of hype, and the tool became very popular for a time. Unfortunately, the script also abused its popularity to install malware and unwanted browser extensions. The full extent of the attack isn’t clear, but the damage may extend beyond what’s already been discovered.

The U.S. military has contracted with a 3D printing company to “print” barracks for training its troops. In the next 10 months, the military will use Icon’s building printing tech to build three structures. Once completed, the buildings will span 5,700 square feet each, the largest printed building project ever in the U.S. According to the press release, using 3D printing technology will help the military cut down on labour cost and construction times. And to withstand the rigors of military use, the buildings will be made with lavacrete, a high-strength concrete.

And now for something a bit different. Although electric vehicles are increasingly becoming more powerful, their range remains a key issue. As countries ramp up efforts to build out its supporting infrastructure, battery technologies are also advancing at a rapid pace. One such example is a new battery tech Theion technology that makes a 900-mile range feasible for smaller cars. In addition to increased energy density, the battery is based on Sulfur, not Lithium, which is far more abundant. Having higher availability of source materials could also lower the price and better meet the demand of the booming EV market. Unfortunately, EVs won’t be Theion’s primary market. The company wants to target the aerospace industry first, and then consumer products like smartphones and laptops. With that said, the company says EV is definitely on its road map.

That’s all the tech news that’s trending right now. Hashtag Trending is a part of the ITWC Podcast network. Add us to your Alexa Flash briefings or your Google Home daily briefing. Make sure to sign up for our Daily IT Wire newsletter to get all the news that matters directly in your inbox every day. Also, catch the next episode of Hashtag Tendances, our weekly Hashtag Trending episode in French, which drops every Thursday morning. If you have a suggestion or a tip, drop us a line in the comments or via email. Thank you for listening, I’m Samira Balsara.

Hashtag Trending April 19 – Senator questions Intuit; Windows toolbox malware; and U.S. military prints barracks | IT Business

Examine CVE-2021-4122, the newly discovered vulnerability in LUKS encryption, and to discuss your options for mitigating it.

A new vulnerability in the encryption system has been discovered.

Er is een nieuwe kwetsbaarheid ontdekt in het encryptiesysteem.

Hier is een oplossing om u te helpen spoofing- en accountovername-aanvallen op te sporen en te stoppen.

Here is a solution to help you detect and stop spoofing and account takeover attacks.

Patching the CentOS 8 Encryption Bug is Urgent – What Are Your Plans?

Cyberattacks hit Ukrainian government sites. Iranian cyberespionage activity: attribution and TTPs. REvil members arrested in Russia.

In our series of letters from African journalists, the BBC's weekly The Boss series profiles different business leaders from around the world.

In onze serie brieven van Afrikaanse journalisten stelt de wekelijkse BBC-serie The Boss verschillende bedrijfsleiders uit de hele wereld aan het woord.

Websites operated by the Ukrainian Cabinet and at least seven ministries were affected. The attacks seem to be simple defacements, an influence operation, and not the data-destruction and doxing the message claims. Note the implicit attempt to suggest that Poland and Ukraine have a historical dispute over Ukraine's western territories.

Die discussie werd aangezwengeld door de onthulling in december van kwetsbaarheden in de Log4j-bibliotheek van de Apache Software Foundation, en kreeg deze week meer gewicht door de waarschuwingen van de Amerikaanse inlichtingendiensten dat er een risico bestond dat nationale staten aanvallen zouden plegen op die en andere open-sourceproducten. De bij de operatie gezochte Israëli's waren ook Joden van Iraanse afkomst, en de operatie lijkt dus een klassieke affiniteitszwendel te zijn van het soort dat reeds lang door inlichtingendiensten wordt gebruikt om menselijke middelen te werven.

Reuters reports that a "massive" cyberattack hit Ukrainian government websites yesterday. Websites operated by the Ukrainian Cabinet and at least seven ministries were affected. Some of the defacements told their Ukrainian audience to "be afraid and expect the worst." The message was posted in Ukrainian, Russian, and Polish. The attacks seem to be simple defacements, an influence operation, and not the data-destruction and doxing the message claims. Note the implicit attempt to suggest that Poland and Ukraine have a historical dispute over Ukraine's western territories. The Moscow Times reports that Ukraine's SBU said that services had been restored to normal within hours of the attacks. While it was initially impossible to rule out hacktivism or provocation by some third party, these seem unlikely. The Ukrainian Foreign Ministry points to the obvious suspect: Russian intelligence services: "It's too early to draw conclusions, but there is a long record of Russian (cyber) assaults against Ukraine in the past," a spokesman told Reuters. Russian officials haven't commented so far on yesterday's case, but they've denied involvement in other past incidents that have been widely attributed to Moscow's organs. Those include, in the AP's tally this morning, 2014 attacks on electoral systems, attacks on regional power grids in 2015 and 2016, and the NotPetya attack of 2017.

Bloomberg reports that the EU's member states are holding a series of cyber "stress tests" this week designed to check Europe's resilience to attacks on supply chains, and to give them the ability to redress any shortfalls they discover. "The exercise will be structured around a gradual escalation toward a major crisis that culminates in an attack that could qualify as an armed aggression under the United Nations Charter, according to one of the documents. In order to be as realistic as possible and better prepare the bloc for a real-world attack, it will be modeled on incidents that have taken place or could occur in the near future," Bloomberg writes. The exercises were proposed by France. US warns of "Russian state-sponsored cyber threats to US critical infrastructure." Tuesday afternoon the US Cybersecurity and Infrastructure Security Agency (CISA) issued a joint warning with the FBI and NSA, "Alert (AA22-011A) Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure." CISA Director Jen Easterly tweeted this brief commendation of the joint advisory her agency issued yesterday in conjunction with the FBI and NSA: "Russian state-sponsored malicious cyber activity is a continuing threat to our critical infrastructure—why we’re working closely w/public & private sector partners to reinforce the importance of vigilance against these threats; read our latest advisory." The Alert doesn't call out the threat of Russian military operations against Ukraine as the proximate cause of the warning, but its timing seems hardly coincidental. "This CSA provides an overview of Russian state-sponsored cyber operations; commonly observed tactics, techniques, and procedures (TTPs); detection actions; incident response guidance; and mitigations," the Summary says. "This overview is intended to help the cybersecurity community reduce the risk presented by these threats."

US Cyber Command has formally attributed the MuddyWater threat actor to Iran's Ministry of Intelligence and Security: "These actors, known as MuddyWater in industry, are part of groups conducting Iranian intelligence activities, and have been seen using a variety of techniques to maintain access to victim networks. "MuddyWater is an Iranian threat group; previously, industry has reported that MuddyWater has primarily targeted Middle Eastern nations, and has also targeted European and North American nations. "MuddyWater is a subordinate element within the Iranian Ministry of Intelligence and Security (MOIS). According to the Congressional Research Service, the MOIS 'conducts domestic surveillance to identify regime opponents. It also surveils anti-regime activists abroad through its network of agents placed in Iran’s embassies.'" US Cyber Command's attribution of MuddyWater to Iran's Ministry of Intelligence and Security is the second formal attribution of malicious activity in cyberspace the US has made this week, coming as it does shortly after the joint CISA/FBI/NSA warning of Russian activity against critical infrastructure. In the case of MuddyWater, US Cyber Command shared details of the tools MuddyWater is known to be using, and advises network operators that finding such tools in their systems "may indicate the presence of Iranian malicious cyber actors." Other Iranian threat actors also make use of open-source tools. Check Point describes how APT35 (also known as Charming Kitten) has been using Log4j vulnerabilities to distribute a new modular PowerShell toolkit. The tools both encrypt and exfiltrate data APT35 takes from its targets.

The University of Toronto's Citizen Lab reports that it's found NSO Group's Pegasus intercept tools in phones belonging to some thirty-five journalists, non-governmental organizations (NGOs), and "members of civil society" in El Salvador. Publications affected include El Faro, GatoEncerrado, La Prensa Gráfica, Revista Digital Disruptiva, Diario El Mundo, and El Diario de Hoy. Two independent journalists were also affected. Three NGOs were affected: Fundación DTJ, Cristosal, and a third, unnamed organization. Coincidentally, the US National Counterintelligence and Security Center (NCSC) has issued an advisory on commercial surveillance products. Those are unnamed, but they clearly include such tools as NSO Group's Pegasus. "Journalists, dissidents, and other persons around the world have been targeted and tracked using these tools, which allow malign actors to infect mobile and internet-connected devices with malware over both WiFi and cellular data connections." The advisory includes recommendations for digital hygiene that might make it less likely that a target's devices be compromised.

Malwarebytes reports that an advanced persistent threat (APT) seems to have infected itself with its own remote administration Trojan (RAT), specifically the BADNEWS (Ragnatela) RAT. The APT is PatchWork (also known as Dropping Elephant, Chinastrats, and Quilted Tiger). Patchwork is associated with the Indian Government, and has been observed collecting against targets in Pakistan. US Senators inquire about possible security risks in Yealink phones. Defense One writes that there's US Senatorial concern about the risk Chinese-made Yealink phones might present users. Senator Chris Van Hollen (Democrat of Maryland) wrote the Department of Commerce back in September, asking for an explanation of the Yealink software that could, at least in principle, monitor and report users’ calls and online activity. The Record reports that the FBI has warned that FIN7, the criminal gang well-known for operating DarkSide and BlackMatter ransomware, has undertaken a BadUSB campaign against US organizations in the transportation, insurance, and defense sectors The physical USBs, which carry malware, are being sent by the US Postal Service and United Parcel Service. Some represent themselves as packages arriving from the US Department of Health and Human Services that carry important COVID-19 information. Others pose as holiday packages from Amazon and include a thank-you note, a bogus gift card, and, of course, the malicious USB drive. The payloads observed include "Metasploit, Cobalt Strike, PowerShell scripts, Carbanak, GRIFFON, DICELOADER, and TIRION" as well as "BlackMatter and REvil" ransomware. Kaspersky reports on the activities of a group it calls "BlueNorhoff," and identifies as a subunit of North Korea's Lazarus Group. BlueNoroff 's current campaign, "SnatchCrypto, is aimed at various companies that, by the nature of their work, deal with cryptocurrencies and smart contracts, DeFi, Blockchain, and the FinTech industry." An NBC News report puts Pyongyang's take in cryptocurrency theft last year at almost $400 million, with Ethereum holdings particularly affected. The open source software supply chain may have a free-rider problem. BleepingComputer reported an infinite-loop a developer inserted into two widely used open-source libraries. It was a gesture of protest. The developer, whom BleepingComputer identified as Marak Squires, is thought to regard himself as having been exploited by the many organizations who've used his software without either adequate compensation or support. The Apache Foundation addressed this sentiment and its causes in a position paper. SecurityWeek headlines its account of the paper "Apache Foundation Calls Out Open-Source Leechers." That's a strong way of putting it (and we couldn't find any variant of "leech," still less "freeloader" or "parasite") in the Apache text, but it's not too far off the mark. Apache doesn't call organizational users "leechers" or “leeches,” but its position paper describes a free-rider problem. "We can't fix open source supply chain issues by focusing exclusively on the upstream producer," is how Apache puts it in their first "take-away." The downstream users of open source software should, Apache argues, "contribute back." That is, "Help fix bugs. Conduct security audits and feed back the results. Cash, while welcome and useful, isn't sufficient. We eagerly welcome audits and fixes from any source. We have a process defined for doing so..." This is not to say that the Apache Software Foundation endorses developers’ sabotaging their own code. Far from it. Their concern is with the security and safety of the open source products themselves. On Patch Tuesday Microsoft addressed ninety-seven vulnerabilities, nine rated Critical and eighty-eight rated Important. Adobe, Android, Cisco, SAP, and VMware have also recently patched. BleepingComputer has a useful overview. Russia's Federal Security Service (FSB) has arrested members of the REvil ransomware gang at the request of the US government, Reuters reports. The FSB said in a statement, "As a result of joint actions of the FSB and the Ministry of Internal Affairs of Russia, the organized criminal community ceased to exist, the information infrastructure used for criminal purposes was neutralized." The FSB said it had conducted the raids (which netted not only fourteen arrests, but $600,000 and €500,000 in cash, as well as computers, "crypto wallets used to commit crimes," and twenty luxury cars, all of which are said to be ill-gotten) at the "appeal of competent US authorities." Cooperation only goes so far, however. Interfax clarified in a follow-up that none of the Russian citizens arrested will be turned over to the US for prosecution, "The Basic Law of the Russian Federation prohibits the extradition of citizens of the Russian Federation to a foreign state," a source explained to Interfax. Lest one think that the FSB's raid on REvil means that the salad days of state-tolerated Russian cybercrime are over, consider KrebsOnSecurity's account of the work being done by the access broker known as Wazawaka, a numero in Russophone cybercrime fora. “Come, rob, and get dough!,” Wazawaka advertised in the Exploit forum back in 2020, inviting crooks to buy access to a Chinese company and "show them who is boss.” He's still going strong, and he says he adheres to the communitarian principle that data taken in double-extortion scams shouldn't be resold. Rather, it should simply be posted for general use in the criminal-to-criminal marketplace should the victim fail to pay the ransom. Israel has arrested five people on charges connected with alleged Iranian espionage, Bloomberg reports. Four women and one man were arrested; Yahoo News says they were persuaded to spy on behalf of Tehran through a catphishing operation that used the bogus identity "Rambod Namdar," which the phishers represented as a Jewish Iranian. The Israelis prospected in the operation were also Jews of Iranian origin, and so the operation appears to be a classic affinity scam of the kind long used by intelligence services seeking to recruit human assets. Ukrainian authorities have arrested five alleged members of a ransomware gang that operated internationally. The European Data Protection Supervisor (EDPS) ordered Europol to "delete data concerning individuals with no established link to a criminal activity." Bloomberg Law says NSO Group intends to go to the US Supreme Court in its bid to defeat a Meta lawsuit. The White House offered a preliminary "readout" of this week's Open Source Software Security Summit, during which Government and industry officials met to discuss ways of shoring up the security of widely used open-source software. That discussion was prompted by December's revelation of vulnerabilities in the Apache Software Foundation's Log4j library, and it was given salience by this week's warnings from the US Intelligence Community that there was a risk of nation-state attacks exploiting issues with that and other open-source products. The White House said, in part, "Participants had a substantive and constructive discussion on how to make a difference in the security of open source software, while effectively engaging with and supporting the open source community. The discussion focused on three topics: Preventing security defects and vulnerabilities in code and open source packages, improving the process for finding defects and fixing them, and shortening the response time for distributing and implementing fixes." Google, which was among the companies attending the summit, applauded the Government's initiative and called for further cooperation: "We need a public-private partnership to identify a list of critical open source projects — with criticality determined based on the influence and importance of a project — to help prioritize and allocate resources for the most essential security assessments and improvements. Longer term, we need new ways of identifying software that might pose a systemic risk — based on how it will be integrated into critical projects — so that we can anticipate the level of security required and provide appropriate resourcing." Red Hat also approved of the direction the summit set: “The core tenets of the Cyber EO remain fundamental to improving the security posture of all software—both proprietary and open source, including assuring that vendors of all stripes maintain greater visibility into their software, take responsibility for its life cycle, and make security data publicly available. A key theme of the meeting was the recognition that open source software has accelerated the pace of technological innovation, provides tremendous societal and economic benefits, and can contribute greatly to enhancing trust and cybersecurity." Many observers see work toward effective use of software bills of materials as among the most important initial goals of public-private cooperation. The US Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities Catalog now includes Log4shell, and that's consistent with the agency's aspiration, expressed clearly during Monday's media call, of serving as a single authoritative source for information on risk and remediation. And the US National Institute of Standards and Technology (NIST) has issued a revision to its cybersecurity guidance, Engineering Trustworthy Secure Systems. “With the continuing frequency, intensity, and adverse consequences of cyber-attacks,” NIST says in its introduction, “disruptions, hazards, and other threats to federal, state, and local governments, as well as private sector organizations, the need for trustworthy secure systems has never been more important to the long-term economic and national security interests of the United States.” The two-hundred-seven-page document builds upon earlier standards documents, and NIST has asked for comment. “The objective, NIST explains, “is to address security issues from a stakeholder protection needs, concerns, and requirements perspective and to use established engineering processes to help ensure that such needs, concerns, and requirements are addressed with appropriate fidelity and rigor throughout the system life cycle.”

Network segmentation is a best practice and when done correctly it improves network security and

The SolarWinds breach has been linked to a massive cyber-attack that has left more than 100 people dead.

De inbreuk bij SolarWinds is in verband gebracht met een grootschalige cyberaanval waarbij meer dan 100 mensen om het leven zijn gekomen.

Every organization is at risk for cyberattacks, and it’s unsettling that the attackers are so good at maximizing the damage to their victims. The time an attacker spends inside a network is referred to as ‘dwell time,’ and it’s measured from the point of intrusion to the point of detection. Long dwell times increase the damage of an attack, often in ways that can’t be measured.

Elke organisatie loopt het risico op cyberaanvallen, en het is verontrustend dat de aanvallers zo goed zijn in het maximaliseren van de schade aan hun slachtoffers. Aanvallers die de bedrijfsverdediging omzeilen, zullen zich zo lang mogelijk in het netwerk verbergen, zelfs als ze van plan zijn een ransomware-aanval uit te voeren. Lange verblijftijden verhogen de schade van een aanval, vaak op een manier die niet kan worden gemeten.

Every organization is at risk for cyberattacks, and it’s unsettling that the attackers are so good at maximizing the damage to their victims. Their tactics are increasingly sophisticated and often involve some type of email attack, bot attack, or even just old-school social engineering. Attackers who bypass company defenses will hide inside the network as long as possible, even if they’re planning to launch a ransomware attack. They use this time to explore the network, steal data and user credentials, destroy backups, and do anything else they can do to set themselves up for future attacks.

The time an attacker spends inside a network is referred to as ‘dwell time,’ and it’s measured from the point of intrusion to the point of detection. Long dwell times increase the damage of an attack, often in ways that can’t be measured. The SolarWinds breach is the perfect example of this. The intruders entered the network in early 2019 and were not discovered until December 2020. The exact number of victims and costs associated with the attack remain unknown.

Network segmentation is one of the easiest and most effective ways to reduce dwell time. For those of you not familiar with this practice, it’s just like it sounds: You divide your network into different sections (segments) and you ‘lock the doors’ between them.

You’ve seen this concept at work in high-security buildings that restrict access to certain parts of the facility to people who have been granted permission to enter that restricted section. This keeps people from wandering around and exploring areas that are critical to operations or contain sensitive information. Segmentation does something similar for your network.

There are immediate security benefits to separating your network into multiple contained segments:
• Segmentation creates a smaller attack surface within the network. An intruder will be limited to the segment that was breached. The attacker can go no further unless they successfully breach another segment. Isolating your mission-critical servers and data can prevent an intruder from gaining access to your resources through a neglected printer or rogue smart device.
• Segmentation makes it easier to detect and isolate security incidents. The division between the segments helps contain the spread of malware and viruses. It limits the areas where the intruder can hide, and it can improve the efficiency of security monitoring.

There are non-security benefits as well. For example, POS devices fall under strict compliance rules. Assigning POS devices their own segment helps companies by limiting the cardholder data environment (CDE) and reducing the scope of PCI DSS compliance.

Segmentation also improves network performance by separating traffic. A good example of improving both security and performance is the separation of a public network from private resources. A shopping center or school campus that offers free wireless access to guests would want that traffic separated from the line-of-business applications. This keeps the potential traffic congestion of public wireless access isolated to assigned segments.

Gartner analysts have warned against over-segmentation, which can complicate the management and use of the network. One Gartner study found that over 70% of segmentation projects had to be re-architected because the segmentation made it too difficult for authorized users to access what they needed to perform their work.

“A principle of network segmentation is to group like resources together, to minimize security overhead: Build a fence around the car park, not a fence and gate around every car. ~Gartner”

Barracuda can help you secure your network while making it easier to manage. Visit our website for more information on Barracuda CloudGen Firewall, secure SD-WAN, and other network security solutions.

How network segmentation can help secure your business

Pursuing a SOC 2 audit is a multi-step process. This blog clarifies the SOC 2 audit process and explains the role of SOC 2 auditors and compliance software.

When it comes to cybersecurity, companies need to demonstrate their ability to protect data and information.

Als het om cyberbeveiliging gaat, moeten bedrijven aantonen dat zij in staat zijn gegevens en informatie te beschermen.

Pursuing a SOC 2 audit is a multi-step process, which can seem confusing at first glance given the fact that there are vendors that provide compliance software, and other vendors who are themselves certified SOC 2 auditors. This blog will clarify the SOC 2 audit process, as well as explain the role of SOC 2 auditors and compliance software. When and How to Use SOC 2 Software ToolsThere are multiple steps to completing a SOC 2 audit.

Enter, SOC 2 (Service Organization Control 2), een populaire audit die getuigt van het vermogen van een bedrijf om gegevens en informatie te beschermen. Het nastreven van een SOC 2-audit is een proces dat uit verschillende stappen bestaat, wat op het eerste gezicht verwarrend kan lijken, gezien het feit dat er verkopers zijn die nalevingssoftware leveren, en andere verkopers die zelf gecertificeerde SOC 2-auditors zijn. Wanneer en hoe SOC 2-softwaretools gebruikenEr zijn verschillende stappen om een SOC 2-audit te voltooien.

Data breaches and ransomware attacks continue to dominate the news cycle. To protect data, and position themselves favorably among prospects and customers, companies need to demonstrate a commitment to cybersecurity.

Enter, SOC 2 (Service Organization Control 2), a popular audit that attests to a company’s ability to protect data and information. It’s a strong validator for any company looking to demonstrate its commitment to cybersecurity to partners and customers.

Pursuing a SOC 2 audit is a multi-step process, which can seem confusing at first glance given the fact that there are vendors that provide compliance software, and other vendors who are themselves certified SOC 2 auditors.

This blog will clarify the SOC 2 audit process, as well as explain the role of SOC 2 auditors and compliance software.

When and How to Use SOC 2 Software Tools

There are multiple steps to completing a SOC 2 audit. Many companies start with a readiness/gap assessment, which is the process of reviewing existing controls in place and identifying those that need to be improved or implemented. This process can be executed via an audit consultant, or through specialized software tools that help simplify this process (like A-SCEND).

Compliance software tools typically provide automated workflows and compliance templates, comparing your existing controls against the controls within a selected compliance framework — which, in this case, would be the SOC 2 framework.

Typically, this software allows you to visualize progress toward compliance goals, assign tasks related to evidence collection or policy updates, and collaborate all in one dashboard. Software tools provide a simple way to understand the framework requirements, assess them against your existing policies and procedures, and manage the process of updating policies. While these tools help to better prepare for an audit and streamline the assessment process, an experienced auditor is still a critical component of compliance.

When and How to Use SOC 2 Auditors

Software tools can only take you so far with SOC 2. They can help prepare a company for a SOC 2 audit, but not complete the audit itself. When the actual audit takes place, companies must turn to a SOC auditor.

SOC 2 audits are regulated by the American Institute of Certified Public Accountants (AICPA) and must be completed by an external auditor from a licensed CPA firm. This is the only way a company can receive an official SOC 2 report, whether it’s a Type 1 or Type 2 report.

An official SOC 2 report is valid for one year following the date the report was issued. Future annual audits must also be completed by an external auditor from a licensed CPA firm.

If your organization plans to use software to prepare for an audit, it’s helpful to work with a software partner who can also conduct the official audit (as a certified CPA) because it provides an added layer of convenience throughout the SOC 2 process and results in a reputable report. 



Organizations need to go beyond the data collection by their compliance software tool and conduct further due diligence, such as observations and walkthroughs (conversations) between the audit team and the client. SOC 2 auditors may also find that they need additional data or evidence necessary to validate the design and operating effectiveness of a complete control set. When you use the same company for a technology-enabled audit, and a SOC 2 report, the software is designed to request all audit materials needed, including manually operated controls and supporting evidence. In this convenient scenario, you can save time, resources, and money.

Stephanie Oyler is the Vice President of Attestation Services at A-LIGN focused on overseeing a variation of many assessments within the SOC practice. Stephanie’s responsibilities include managing key service delivery leadership teams, maintaining auditing standards and methodologies, and analyzing business unit metrics. Stephanie has spent several years at A-LIGN in service delivery roles from auditing and managing client engagements to overseeing audit teams and providing quality reviews of reports. Prior to joining A-LIGN, Stephanie worked for CBIZ, the tenth largest accounting firm in the U.S., providing auditing services in the financial accounting spectrum for various industries including automobile, hospitality, not-for-profit, real estate, and cloud architecture. Stephanie graduated from the University of South Florida with a bachelor’s degree of Science in Accounting. During her time at the University of South Florida, Stephanie was an active member of Beta Alpha Psi, an international honor society for Accounting, Finance, and Information Systems students and professionals.

Who Performs a SOC 2 Audit? The Role of SOC 2 Auditors | CSA

By Guy Rosefelt, CPO, Sangfor Technologies NFTs have become very popular with collectors and are more ubiquitous every day.  The idea of owning a one-of-a-kind object even in the digital world is very attractive.  The

In our series of letters from African journalists, novelist and writer Jonathan Marcus looks at how security issues affect crypto-wallets.

In onze reeks brieven van Afrikaanse journalisten bekijkt romanschrijver en schrijver Jonathan Marcus hoe veiligheidskwesties crypto-wallets beïnvloeden.

The idea of owning a one-of-a-kind object even in the digital world is very attractive. But artists and creatives of all types, be it painting and graphics, music, photography, and even video can now create and sell unique works that cannot be replicated. Besides security issues, they are being used by criminals for money laundering of cryptocurrency, and I do not see the value in something that will immediately become worthless when the internet apocalypse happens and your NFT wallet is no longer accessible.

Het idee is niet nieuw, aangezien het kopen van unieke voorwerpen in games al tientallen jaren bestaat. Maar kunstenaars en creatieven van alle soorten, of het nu gaat om schilderen en grafiek, muziek, fotografie, en zelfs video, kunnen nu unieke werken maken en verkopen die niet kunnen worden nagemaakt. Naast beveiligingsproblemen worden ze door criminelen gebruikt voor het witwassen van cryptocurrency, en ik zie de waarde niet in van iets dat onmiddellijk waardeloos wordt als de internetapocalyps gebeurt en je NFT wallet niet meer toegankelijk is.

NFTs have become very popular with collectors and are more ubiquitous every day. The idea of owning a one-of-a-kind object even in the digital world is very attractive. The idea is not new as buying unique items inside games has been around for decades. But artists and creatives of all types, be it painting and graphics, music, photography, and even video can now create and sell unique works that cannot be replicated.

First, I need to disclose I am not a huge fan of Non-Fungible Tokens (NFTs). Besides security issues, they are being used by criminals for money laundering of cryptocurrency, and I do not see the value in something that will immediately become worthless when the internet apocalypse happens and your NFT wallet is no longer accessible. But that is just me. Until that happens let’s talk about the security issues. Security issues include phishing scams to access crypto-wallets and steal NFTs, and selling counterfeit items, but the issue I want to discuss is using NFTs to distribute malware.

VIA, a company that specializes in solutions for infrastructure and government, reported that they discovered instances of malware being injected into NFTs and demonstrated how easy it is. It makes sense as NFTs are normally media files that have historically been used to inject code or embed malicious software that runs when open. All being an NFT does is verify that it is the only file of its kind using blockchain. But it does nothing to verify the safety of the file. VIA has even created an open-source tool to scan NFTs to look for malicious code or software in the file.

So, the next time you spend thousands of dollars on an NFT, make sure, even if it comes from a reputable vendor, to scan it before opening it and hope there is a return policy if you find something unexpected. Otherwise, your crypto wallet might have a surprise for you once the internet apocalypse ends.

Guy is Chief Product Officer for Sangfor Technologies. He has over 20 years experience (though some say it is one year’s experience twenty times) in application and network security, kicking it off with 10 years in the U.S. Air Force, reaching rank of captain. After his time in the USAF building the first fiber to the desktop LAN and other things you would find in Tom Clancy novels, Guy worked at NGAF, SIEM, WAF and CASB startups as well as big-name brands like Imperva and Citrix. He has spoken at numerous conferences around the world and in people’s living rooms, written articles about the coming Internet Apocalypse, and even managed to occasionally lead teams that designed and built security stuff. Guy is thrilled to be in his current position at Sangfor — partly because he was promised there would always be Coke Zero in the breakroom. His favorite cake is German Chocolate.

Guy can be reached online at guy.rosefelt@sangfor.com or on Twitter at @otto38dd and at our company website www.sangfor.com.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

NFTS Are Cool but Dangerous

By Randy Reiter CEO of Don’t Be Breached April, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers' databases after bypassing authentication. "By exploiting

Hackers could have exploited a vulnerability in Microsoft’s databases, according to researchers.

Hackers hebben volgens onderzoekers misbruik kunnen maken van een kwetsbaarheid in de databases van Microsoft.

By Randy Reiter CEO of Don’t Be BreachedApril, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers’ databases after bypassing authentication. Microsoft said its analysis showed no evidence of attackers having exploited the vulnerabilities to access customer data. Wiz said Microsoft awarded its researchers a $40,000 bug bounty — the amount can be viewed as confirmation of the vulnerability’s severity.

Door Randy Reiter CEO van Don't Be BreachedIn april 2022 meldde Microsoft dat kwetsbaarheden in zijn Azure Database voor PostgreSQL hackers toegang konden verschaffen tot de databases van andere klanten nadat ze de authenticatie hadden omzeild. Volgens Microsoft heeft zijn analyse geen aanwijzingen opgeleverd dat aanvallers de kwetsbaarheden hebben misbruikt om toegang te krijgen tot klantengegevens. Wiz zei dat Microsoft zijn onderzoekers een bounty van 40.000 dollar heeft toegekend - het bedrag kan worden gezien als een bevestiging van de ernst van de kwetsbaarheid.

By Randy Reiter CEO of Don’t Be Breached

April, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers’ databases after bypassing authentication. “By exploiting an elevated permissions bug in the Flexible Server authentication process for a replication user, a malicious user could leverage an improperly anchored regular expression to bypass authentication to gain access to other customers’ databases” the Microsoft Security Response Center reported.

The cloud security firm Wiz’s research team discovered the security vulnerabilities. An attacker could create a full copy of a target database in Azure PostgreSQL [Flexible Server], essentially exfiltrating all the information stored in the database, says Ami Luttwak, co-founder and CTO at Wiz.

Microsoft said it mitigated the issue on Jan. 13, 2022, less than 48 hours after Wiz had notified it of the issue. Microsoft said its analysis showed no evidence of attackers having exploited the vulnerabilities to access customer data. Wiz said Microsoft awarded its researchers a $40,000 bug bounty — the amount can be viewed as confirmation of the vulnerability’s severity.

How to Have Exploited the Database Vulnerability

As explained by Microsoft, the Wiz researchers went through the following steps to gain elevated privileges and remote code execution, which allowed them to bypass cross-account authentication using a forged certificate and access other customers’ databases:
• Retrieve the target’s common name from the Certificate Transparency feed.
• Find the target’s Azure region by resolving the database domain name and matching it to one of Azure’s public IP ranges.
• Create an attacker-controlled database in the target’s Azure region.
• Exploit vulnerability #1 on the attacker-controlled instance to escalate privileges and gain code execution.
• Scan the subnet for the target instance and exploit vulnerability #2 to gain read access!

How to Prevent Data Exfiltration and Data Breaches in Todays Complex Environment

Multiple layers of data protection are required today to prevent Data Exfiltration and Data Breaches. In 2020 the DHS, Department of State, U.S. Marine Corps and the Missile Defense Agency recognized this and all issued requests for proposals (RFP) for network full packet data capture for Deep Packet Inspection analysis (DPI) of network traffic. This is an important step forward protecting confidential database data and organization information.

Zero-day vulnerabilities that allow hackers to gain system privileges are a major threat to all organizations encrypted and unencrypted confidential data. Confidential data includes: credit card, tax ID, medical, social media, corporate, manufacturing, trade secrets, law enforcement, defense, homeland security, power grid and public utility data. This confidential data is almost always stored in DB2, Informix, MariaDB, Microsoft SQL Server, MySQL, Oracle, PostgreSQL and SAP Sybase databases.

How to Stop Data Exfiltration and Data Breaches with Deep Packet Inspection

Protecting encrypted and unencrypted confidential database data is much more than securing databases, operating systems, applications and the network perimeter against Hackers, Rogue Insiders and Supply Chain Attacks.

Non-intrusive network sniffing technology can perform a real-time Deep Packet Inspection (DPI) of 100% the database activity from a network tap or proxy server with no impact on the database servers. The database SQL activity is very predictable. Database servers servicing 1,000 to 10,000 end-users typically process daily 2,000 to 10,000 unique queries or SQL commands that run millions of times a day. Deep Packet Analysis does not require logging into the monitored networks, servers or databases. This approach can provide CISOs with what they can rarely achieve. Total visibility into the database activity 24×7 and 100% protection of confidential database data.

Advanced SQL Behavioral Analysis of 100% of the real-time database SQL packets can learn what the normal database activity is. Now the database query and SQL activity can be non-intrusively monitored in real-time with DPI and non-normal SQL activity immediately pinpointed. This approach is inexpensive to setup and has a low cost of operation. Now non-normal database activity from Hackers, Rogue Insiders or and Supply Chain Attacks can be detected in a few milli seconds. The Security Team can be immediately notified and the Hacker session terminated so that confidential database data is not stolen, ransomed or sold on the Dark Web.

Reiter is the CEO of Don’t Be Breached a Sql Power Tools company. He is the architect of the Database Cyber Security Guard product, a database Data Breach prevention product for DB2, Informix, MariaDB, Microsoft SQL Server, MySQL, Oracle, PostgreSQL, and SAP Sybase databases. He has a Master’s Degree in Computer Science and has worked extensively over the past 25 years with real-time network sniffing and database security. Randy can be reached online at rreiter@DontBeBreached.com, www.DontBeBreached.com and www.SqlPower.com/Cyber-Attacks.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Azure PostgreSQL User Databases Were Exposed Due to Critical Vulnerabilities

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday. Spokeswoman Biliana Necheva says in

A Canadian manufacturing company says it has been forced to freeze its operations following a cyber attack.

Een Canadees productiebedrijf zegt dat het gedwongen is zijn activiteiten te bevriezen na een cyberaanval.

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday. Spokeswoman Biliana Necheva says in an email operations have not resumed more than 48 hours after they were halted as a cautionary measure. It comes at a tough time for BRP, as supply chain woes weighed on sales in its first quarter, with more input obstacles expected on the powersport vehicle maker’s path for the rest of the year.

Woordvoerster Biliana Necheva zegt in een e-mail dat de operaties meer dan 48 uur nadat ze uit voorzorg waren stopgezet, nog niet zijn hervat. Dit komt op een moeilijk moment voor BRP, aangezien de problemen met de toeleveringsketen de verkoop in het eerste kwartaal hebben gedrukt. Voor de rest van het jaar worden nog meer invoerbelemmeringen verwacht voor de fabrikant van motorvoertuigen.

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday.

Spokeswoman Biliana Necheva says in an email operations have not resumed more than 48 hours after they were halted as a cautionary measure.

The Quebec-based company, which manufactures Ski-Doos and off-road vehicles, announced Monday morning it was the target of “malicious cybersecurity activity” and took “immediate measures to contain the situation.”

Deploying its own information technology staff, BRP also said it hired cybersecurity experts to help secure its systems and support an internal investigation.

The company said its freeze on operations could delay some transactions with customers and suppliers.

It comes at a tough time for BRP, as supply chain woes weighed on sales in its first quarter, with more input obstacles expected on the powersport vehicle maker’s path for the rest of the year.

Spun off from Bombardier Inc. in 2003, BRP employs nearly 20,000 workers, mainly at manufacturing and distribution sites in Mexico, Canada, Austria, the United States, Finland and Australia. Its products are sold in more than 120 countries.

This report by The Canadian Press was first published Aug. 11, 2022.

BRP operations remain frozen more than two days after cyberattack

A 39-year-old Saskatchewan man accused of stabbing someone in a hospital is facing an elevated charge of second-degree murder. Police were called to

Two men have been charged with murder after a fatal stabbing in Saskatoon.

Twee mannen zijn aangeklaagd voor moord na een dodelijke steekpartij in Saskatoon.

Police were called to Saskatoon’s Royal University Hospital in June after a 55-year-old man was stabbed. The suspect was initially charged with attempted murder, but police say the charge was upgraded after the man recently succumbed to his injuries in hospital. Police did not identify the two men in the case.

De politie werd in juni opgeroepen naar het Royal University Hospital in Saskatoon nadat een 55-jarige man was neergestoken. De verdachte werd aanvankelijk poging tot moord ten laste gelegd, maar de politie zegt dat de aanklacht werd opgewaardeerd nadat de man onlangs in het ziekenhuis aan zijn verwondingen was bezweken. De politie heeft de twee mannen in de zaak niet geïdentificeerd.

A 39-year-old Saskatchewan man accused of stabbing someone in a hospital is facing an elevated charge of second-degree murder.

Police were called to Saskatoon’s Royal University Hospital in June after a 55-year-old man was stabbed.

The suspect was initially charged with attempted murder, but police say the charge was upgraded after the man recently succumbed to his injuries in hospital.

Police did not identify the two men in the case.

They say the accused is in custody and scheduled to appear in court today.

It’s the seventh homicide in Saskatoon so far this year.

This report by The Canadian Press was first published Aug. 11, 2022.

Oekraïnes veiligheidschef en hoofd openbare aanklager liggen eruit. Cyberaanvallen treffen Albanië. APT's prospecteren journalisten. De GRU trollt onderzoekers. CISA opent een attaché kantoor in Londen.

Vergelijkbare publicaties

Hoe netwerksegmentatie uw bedrijf kan beveiligen

Wie voert een SOC 2-audit uit? De rol van SOC 2 auditors | CSA

NFTS zijn cool maar gevaarlijk

Azure PostgreSQL gebruikersdatabases werden blootgesteld als gevolg van kritieke kwetsbaarheden

Verrichtingen BRP blijven meer dan twee dagen na cyberaanval bevroren

Aanklacht tegen man van steekpartij in ziekenhuis Saskatoon is verhoogd na overlijden slachtoffer

Hashtag Trending April 19 - Senator stelt vragen over Intuit; Windows toolbox malware; en U.S. military prints barracks | IT Business

Het CentOS 8 versleutelingsprobleem is dringend - Wat zijn uw plannen?

Cyberaanvallen treffen Oekraïense overheidssites. Iraanse cyberspionageactiviteiten: toeschrijving en TTP's. Leden van REvil gearresteerd in Rusland.