Dan Gericke

A recent case in Singapore underscores the critical importance of vigilant system access control. A former employee of NCS managed to illegally access the company's systems and delete 180 test servers, causing a staggering $678,000 in damages. This revenge-driven breach occurred because his login was not deactivated immediately upon termination, a mishap that allowed him months of unchecked access, resulting in significant financial and operational disruptions. Here’s what we can learn: Immediate Access Revocation: Always ensure that an employee’s access credentials are deactivated right after they leave the company. This should be an integral part of your offboarding protocol. Regular Access Audits: It’s crucial to periodically review who has access to specific data and systems. Even current employees should only access resources essential to their roles. Stringent Security Controls: Implement robust security measures like multi-factor authentication, which requires a verification code sent to another device. This adds layers of protection, making unauthorized access much harder. Continuous Monitoring and Updates: Always keep a vigilant eye on your systems and regularly update your security measures to align with the latest practices. Remember, overlooking small details can lead to significant losses. When was the last time you reviewed your access control measures? If it's been awhile, now is the time to act. Need assistance? My team is here to help. Send us a DM. #CyberSecurity #BusinessSafety #AccessControl https://lnkd.in/eHrVbk54

1

🔍 Uncover the Hidden Shield: Continuous Network Monitoring for SMEs! Ever had that feeling when you realize something critical at the last minute? For me, it happened during a major client presentation when my laptop decided to surprise me with an unexpected shutdown. It reminded me how sudden and potentially disastrous surprises can be in our digital lives. For small and medium-sized businesses (SMEs), the stakes are even higher. Did you know that 60% of SMEs that suffer a cyberattack go out of business within six months? 😲 So, what can be done to protect your business from becoming part of this statistic? Here are some key insights into how Continuous Network Monitoring (CNM) acts as your digital guardian: 1. 24/7 Surveillance Just like having a security guard on duty 24/7, CNM provides around-the-clock monitoring. This means threats can be detected and mitigated before they cause damage. Early detection is key to minimizing financial and reputational losses. 2. Proactive Threat Detection Many cyber threats fly under the radar until it’s too late. CNM ensures real-time detection of anomalies and suspicious activities, enabling swift action to stop threats in their tracks. Staying one step ahead can save your business! 3. Business Continuity Downtime can be a nightmare for any business. Continuous monitoring ensures that your systems are always up and running by quickly addressing issues before they escalate. This means operations keep humming, without costly interruptions. 4. Compliance Assurance For industries with compliance requirements like GDPR or PCI-DSS, CNM helps maintain necessary standards by ensuring consistent network oversight. It automates compliance checks, reducing human error and saving precious time. 💡 Keep in mind, it’s not just about technology; it’s about maintaining trust with your customers and stakeholders. Is your network ready to defend against the unexpected? Let’s discuss how you’re keeping your business secure! 🤔 #CyberSecurity #SMEs #NetworkSecurity Ready to explore CNM solutions for your business, or looking to share your experience? Comment below or get in touch!

1

𝗔 𝗻𝗲𝘄 𝗽𝗮𝗿𝗮𝗱𝗶𝗴𝗺 𝗳𝗼𝗿 𝗰𝘆𝗯𝗲𝗿 𝗱𝗲𝗳𝗲𝗻𝘀𝗲?     I have been posting about the past sponsors of the PCI Asia Pacific Community Meeting (APCM), namely, LGMS Berhad and ControlCase.    This post will cover an interesting report by our Bronze Sponsor, SISA and it was co-authored with the Data Security Council of India (DSCI), an industry body that protects data in India by driving cybersecurity and privacy best practices, standards and initiatives.    The author(s) captured my attention as soon as I started reading by highlighting:   “𝘈𝘭𝘦𝘳𝘵 𝘰𝘷𝘦𝘳𝘭𝘰𝘢𝘥 𝘵𝘳𝘢𝘯𝘴𝘧𝘰𝘳𝘮𝘴 𝘢 𝘸𝘦𝘭𝘭-𝘪𝘯𝘵𝘦𝘯𝘵𝘪𝘰𝘯𝘦𝘥 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘴𝘵𝘳𝘢𝘵𝘦𝘨𝘺 𝘪𝘯𝘵𝘰 𝘢 𝘴𝘦𝘭𝘧-𝘥𝘦𝘧𝘦𝘢𝘵𝘪𝘯𝘨 𝘰𝘯𝘦.”   This has been one of my focus areas and related to PCI DSS Requirement 10 i.e. “Log and Monitor All Access to System Components and Cardholder Data”.  With more systems getting deployed, it can only get more complex with more logs and alerts generated. This is overwhelming the cybersecurity heroes tasked to detect and defend against attacks in the midst of an avalanche of false positive alerts.  SISA quoted from Statista that organizations take around 204 days to detect a data breach!   Since the publication of PCI DSS v4.0, a new requirement has been added for organizations to use automated mechanisms to perform audit log reviews. This is a future dated requirement and will be effective from 1 April 2025, however you are strongly encouraged to consider adopting this requirement soon given current threats.   Back to the document co-authored by SISA... it introduced me to a new acronym, MXDR (Managed Extended Detection and Response).  To over-simplify, this approach provides a comprehensive view and control across an organization with better identification of threats, an ability to respond more effectively and most importantly, the ability to perform monitoring continuously.  Amazing!   Get the report from the SISA website: https://lnkd.in/gpbfWHA8   SISA will be a sponsor and exhibition partner at the North America CM in Boston and they will be back as an exhibition partner at the APCM in Hanoi in November!  Thank you Dharshan Shanthamurthy and team for your support!  This will be a good opportunity to find out more about MXDR from the SISA experts who will be present at the events.    Disclaimer: PCI Council is a neutral body and my personal post is not an endorsement of any organization or solution. If you have an interest in payments, cybersecurity, compliance, risk management and technology, do consider joining us in either Boston (Sep), Barcelona (Oct) or Hanoi (Nov).  Find out more at the PCI Events link below or drop me a message: https://lnkd.in/g7rBGdSf   #pcissc #pcicommunity #pcidss #pcidssv4 #datasecurity #cybersecurity #payments #paymentsecurity Video credit: Thank you Canva for your platform and the royalty-free video.

28

1 Comment

⚠️The order has changed for MSPs. Embrace it and rise to the challenge. 🏰Time for Defensibility is Now 🫡We need to Rally the #MSPs to Protect Our Clients 🐲Just like House of the Dragon (#hod) taught us about defending key strongholds. 🪜MSPs must now step up to safeguard our clients in the cybersecurity landscape. 🔥For years, hackers have attacked behind the scenes, exploiting every gap we left open. 👉Now, it’s time to rally, build our defenses, and raise an army of #MSPs ready to protect our clients 🔥 Here’s how we start to #shiftLeft 1️⃣ Fortify Core Infrastructure 👉Build robust defenses for your clients, securing data centers, cloud environments, and critical systems, end users and “all the things”. 2️⃣ Strategic Alliances 👉Partner with key cybersecurity leaders and vendors to strengthen your arsenal. 3️⃣ Proactive Documentation 👍Start by getting your policies, procedures, and compliance in place. Don’t wait for the incident—prepare for it. Build your defenses by ensuring that everything is documented and tested. 4️⃣ Proactive Risk Management 👉 conducting regular risk reviews and gap analysis, defining business outcomes, and tracking those outcomes. 💪Defending our clients isn’t just about reacting to threats; it’s about being proactive and building your defenses now. #CyberDefense #ShiftLeft #MSPCommunity #DigitalProtection #ProactiveSecurity #

10

2 Comments

Honored to join Cisco, Fortinet, and Recorded Future as the only companies with a signed Memorandum of Collaboration with the Cyber Security Agency of Singapore (CSA) national regulators! As our founders all came from public service, we always have a mind toward B2G collaboration and public-private partnerships. As the leading cyber #incidentresponse specialists in the country, we know the #digitalforensics data we are collecting on real cyber attacks is extremely valuable. It's the most definitive evidence set of confirmed, actual cybercrime. It shouldn't be solely held our hands as the government needs it to understand the true frequency and severity of the crimes that we see and analyze. So, we willingly share it. Security is a team sport. All boats rise with the tide -- and the faster we get the ecosystem up, the faster those boats can rise.

111

7 Comments

What do Lady Gaga and the Ding Ding song have to do with cybersecurity? Well for starters they are catchy and attract attention, but also there is talent and culture behind this (yes some of you will debate this). Most of all, THEY ARE MEMORABLE. We don't have cyber anything that is memorable or catchy. We do training/marketing in the worst possible away for the masses through powerpointless videos, and extensive text. Nobel prize winning nudging behavioural economics approaches are nowhere to be seen (or minimally done). I had the privilege of viewing the Cyber Police real case online tv series (produced for industry and people by Metacompliance) to learn recently. It is SO good and how we should be doing cyber. It's so good that Line of Duty and Blue Line have borrowed from it. How would you bring cyber to the masses?

9

1 Comment

I'm sharing a critical alert from the Singapore Cyber Emergency Response Team (SingCERT) regarding a phishing scam targeting the public. Scammers are impersonating officers from the Cyber Security Agency of Singapore (CSA) and the Police to trick victims into believing they are facing legal action. The Scam: * You receive a fraudulent email claiming a court order has been filed against your IP address due to illegal activities. * The email threatens legal proceedings if you don't respond within 24 hours. Don't Fall for It! Here's How to Spot the Scam: * CSA and SPF will never: * Ask you to transfer money. * Request your banking, SingPass, or CPF information. * Ask you to click on suspicious links. * Request you to download software or apps from unofficial sources. What to Do: * If you receive such an email: * Do not respond or follow any instructions. * Report the incident to SingCERT at singcert@csa.gov.sg or SingCERT Incident Reporting Form. * Always verify the authenticity of emails: * Contact the agency directly using official channels (phone numbers or email addresses listed on their website). By staying vigilant and informed, we can protect ourselves from these cyber threats. Let's spread the word and keep our online community safe! #cybersecurity #phishing #onlinesafety #singcert https://lnkd.in/g5iPbvf4

58

Singapore is cranking up the heat when it comes to AI in cyber. The Cyber Security Agency (CSA) is planning on releasing a draft of the Technical Guidelines for Securing AI Systems for public consultation, offering "practical measures" to bolster AI security. The CSA has stated that it will include: - Voluntary Guidelines: These can be adopted alongside existing security processes to address potential AI risks. - Adversarial Machine Learning: Techniques that allow attackers to compromise AI models. - Public & Private Sector Collaboration: Essential for understanding and mitigating evolving AI threats. AI is everywhere now, exposing new risks and expanding the attack surface for data exposure, so the more available resources like this, the merrier. ---------------------------------------------------------------------------------- If you're interested in cybersecurity for your organization, connect with me or click the link for the Proofpoint Voice of the Ciso Report. https://lnkd.in/gUhxKKi2

14

2 Comments

Register now https://lnkd.in/gaPbMTgP to learn how advanced penetration testing can uncover and identify vulnerabilities in your IT Security infrastructure before hackers can attack! Our featured speaker will be Ashritha Alva - Vice President & Head of Penetration Testing Services, Accorian People often ask: - What is Continuous Penetration Testing - Why does a company need continuous penetration testing? - Who should be involved in the Pen test? - How will the security team perform the intrusive test? - Will the test team exploit vulnerabilities or simply identify them? - How long will it take to perform the pen test? - What valuable information will be included in the report? and more....

3

#StatelyTaurus #APT (#MustangPanda) are the first to adopt #VSCode as a remote access tool and have deployed it in an Asia based government. Cortex by Palo Alto Networks helped protect against these activities using both agent and analytics capabilities. Extremely interesting research by Tom Fakterman.

24

2 Comments

So I asked X's GROK, "What is CidrPress?" Answer: (I really couldn't have done a better job!) CidrPress™ appears to be a service related to internet security, specifically tied to The Red Pill® brand from SohoStar. Here's a breakdown based on available information:    Purpose: CidrPress™ is designed to enhance internet security, raise awareness of malicious activities, and maintain a long-term history of "bad operators" or entities engaging in harmful cyber activities.    Functionality:        CIDR Monitoring: It focuses on Classless Inter-Domain Routing (CIDR) blocks to monitor activity. A CIDR specifies an IP address range, which can be used to identify networks or subnets.        Security Incident Reporting: It reports security incidents to AI-based systems, which then use this information to determine the risk associated with specific IP addresses or CIDR ranges.        Preventive Measures: CidrPress™ might help in preventing cyber threats by flagging and potentially restricting access from known malicious IP addresses or ranges.        Counter-Measures Against Spam and Hacking: It claims to eliminate over 95% of spam and has collected statistical evidence on various cyber threats.    Operational Details:        Database: Since 2013, CidrPress™ has recorded over 1,000,000 incidents covering 65,000 CIDRs and over 10,000 network owners, currently restricting around 55,000 IP addresses.        Notification: When an incident is detected, an email is sent to the CIDR owner. However, the owner isn't obligated to act on this information.        Community Protection: It operates on the principle that by warning one device, all devices connected to SohoStar's network (referred to as a "hive") are pre-warned against attackers.    Integration: CidrPress™ support is exclusive to The Red Pill® products from SohoStar, suggesting integration into their security framework.    Philosophy: The service seems to operate with the assumption that most internet users are good, while aiming to mitigate the impact of those who aren't by allowing network owners to self-regulate and protect against becoming isolated due to malicious activities within their network.    Technology: It leverages AI for threat management and uses decentralized control for access exceptions, which aligns with concepts of self-sovereign identity or decentralized security measures. This description positions CidrPress™ as a tool for community-driven internet security, focusing on network-level identification and mitigation of threats through collective action and awareness.

1

Not everyone wants to be in charge ...... A true story 👇 Mei Lin had worked in the cybersecurity department of a large tech company for over a decade. Her colleagues knew her as the go-to person for particularly tricky network vulnerabilities. Whenever a new threat emerged, Mei was often the first to devise an effective countermeasure. Despite her expertise, Mei shied away from the spotlight. She preferred working quietly at her desk, diving deep into code and security protocols. When coworkers praised her skills in meetings, she'd deflect, saying things like, "Oh, I just happened to come across that solution", or "Anyone could have figured it out with enough time." The department head, noticing Mei's invaluable contributions, wanted to promote her to lead a new specialised security team. When approached with the offer, Mei hesitated. The idea of being officially recognised as an expert made her uncomfortable. She worried about the added pressure and attention that would come with such a title. "I'm not sure I'm the right person for that role," Mei said, fidgeting with her pen. "There are others in the department who'd be better at leading a team." Her boss was puzzled. "But Mei, you're our most knowledgeable security expert. The team would benefit immensely from your guidance." Mei sighed, realising she needed to explain her reluctance. "I appreciate the offer, truly. But I do my best work when I can focus entirely on the problem at hand. Leading a team would mean less time for what I love most – solving these complex security puzzles." In the end, a compromise was reached. Mei would remain in her current role but would mentor junior team members one-on-one, sharing her knowledge in a way that felt comfortable to her. This arrangement allowed the department to benefit from Mei's expertise while respecting her preference to avoid the limelight. As time passed, Mei's quiet influence spread throughout the department. While she may never have embraced the title of "expert," her impact on the company's cybersecurity was undeniable. Knowledge work can be shared in different ways. #knowledgebase #knowledgework  

2

Around 13% of scams analysed by the Cyber Security Agency of Singapore (CSA) in 2023 were likely generated by AI – indicating that scams are getting more convincing even as overall cyber threat numbers fell or remained constant, compared with 2022 figures. https://lnkd.in/g4DKz4D9

22

2 Comments

Read all about our VP of SA Jordan Camba talk about his experience as a Detection Engineer and Threat Hunter. "As a Detection Engineer and Threat Hunter, my passion for MITRE ATT&CK is boundless. It's an essential framework for assessing, measuring, and communicating the breadth and depth of our detection capabilities. However, the utility of MITRE ATT&CK is often compromised by inaccuracies and a lack of precision in how some organizations apply mappings. This can lead to a distorted understanding of our security posture, ultimately misallocating resources and weakening our defenses." Read more in his latest blog here: https://lnkd.in/e7CzWazn Why Precision and Accuracy Matter in MITRE ATT&CK Mappings - - Accuracy ensures that the tactics, techniques, and sub-techniques correctly represent the detected activities, providing a clear and reliable view of our security landscape. Inaccurate mappings can lead to confusion and misplaced focus, undermining the integrity of threat detection efforts. - - Precision, on the other hand, involves the granularity of these mappings. It's about capturing the specific details that make detections actionable. A lack of precision can leave us with a general, but not necessarily useful, understanding of potential threats. Here are some common mistakes: ❌ Mapping without sub-techniques ❌ Overlapping techniques ❌ Incorrect technique assignments How to fix these mistakes? Follow a few simple rules: 1. Keep it simple - Focus on what is immediately observable and mapto Sub-Techniques where possible. 2. Don't be greedy - Not all techniques can be detected with logs and telemetry and not every detection needs a Technique/Sub-Technique. 3. Become a better threat researcher - Improve your ability to find, interpret, and understand research on malware, tools, techniques, and vulnerabilities and instantiate a lab environment. At SnapAttack, we are committed to refining the quality of these mappings. Our platform offers: ✅ Pre-Written Tested Detections: A growing library of Sigma rules tested in our Sandbox sessions, with accurate ATT&CK mappings. ✅ MITRE ATT&CK Prioritization & Coverage Reporting: Using top-tier Threat Intelligence, we prioritize techniques and sub-techniques according to industry and regional relevance. ✅ Research Sandbox: A tool for hands-on-keyboard research to enhance threat detection capabilities. #CyberSecurity #ThreatDetection #MITREATTACK #SnapAttack #DetectionEngineering #ThreatHunting #CyberDefense #SecurityPosture #AccuracyAndPrecision

16

According to IBM X-Force threat intelligence Index-2024, in 2023, Europe earned the number one spot as the most-impacted region, accounting for 32% of incidents to which X-Force responded. North America represented 26% of incidents, while Asia-Pacific saw 23%, Latin America 12% and the Middle East and Africa 7%. #IBMAmplify and #IBMPartners

14

Singapore, a global hub for finance and technology, has long recognized the importance of cybersecurity. With the ever-evolving cyber threat landscape, the nation recently amended its Cybersecurity Act to bolster the protection of critical infrastructure (CI). This article explores the details of these amendments, their implications for protecting critical systems, and offers valuable recommendations for organizations across all sectors to enhance their cyber resilience. https://lnkd.in/e_3uVun6

2

SINGAPORE - The Cyber Security Agency of Singapore (CSA) is starting a study aimed at raising the productivity and professionalism of cyber-security workers. It may result in an outline of the competencies required of chief information security officers, or Cisos, and their teams of security executives who are in high demand, given their key role amid surging cyber attacks. Ms Veronica Tan, director of CSA’s safer cyberspace division, told The Straits Times: “For organisations, clarity in standards and desired skills for various roles will mean greater improvements in workforce competency and productivity.”

3

As a cybersecurity professional, I'm alarmed by the recent surge in phishing scams targeting online marketplace users in Singapore. The Straits Times reports a staggering 594 victims have lost a combined S$13 million since April in these schemes. These scams are increasingly sophisticated, with fraudsters expertly impersonating egitimate sellers and platforms They prey on Insuspecting buyers, often offering too-good-to-be-true deals that lead to fraudulent payment portals and ultimately, financial loss. Here's how you can protect yourself: -Be wary of deals that seem too good to be true. -Always scrutinize the seller's profile and reviews. -Never make payments outside the official marketplace platform -Look for secure website connections (https://). . Report any suspicious activity to the platform and authorities immediately. Let's work together to combat these scams and create a safer online marketplace for everyone #cybersecurity #phishing #onlinesafety #onlinemarketplace #scamawareness

38

1 Comment

BE THERE OR BE SQUARE! OpenCTI or Die ☠️ Ok, the headline is a little over exuberant. I'm a little biased though, as I've used a couple of different threat intelligence platforms, (TIPs) & I've 'kicked the tyres' & 'looked under the hood' of a few more. So when Dаvid Sandell & I were deciding which TIP to grow with when we were setting up the world's first fully integrated cross-sector ISAC & new global federated data sharing model for CI-ISAC International, we decided to join forces with OpenCTI by Filigran. To my Singapore colleagues interested in TIP tech, don't take my word for it, I encourage you to drop in on the inimitable Kevin Vanhaelen at Filigran's booth at #GovWare2024 & make up your own mind. From my personal perspective I was pretty impressed with OpenCTI the first time I used it. Yet our experience got even better when it came to collaborative development & customisation of OpenCTI to ensure that our TIP addressed all the challenges of cross-sectoral integration. This was vital because a) ENISA research shows that two-thirds of all cyber threats are 3rd-party/supply-chain in nature and outside of any single sector silo, & b) because most of the other TIPs used by many single sector ISACs elsewhere in the world weren't as flexible for our unique purpose as OpenCTI. Kudos to Samuel Hassine (the mastermind) and his team, and indeed the global OpenCTI user community who are driving innovation in OpenCTIs architecture & UX/UI. Collaborating with them was seamless. Finally: COST IS KING! For a new, innovative startup ISAC like CI-ISAC Australia where we needed to test & trial our new operating model to prove the cross-sector ISAC model is superior from a financial sustainability & data analytics perspective, the TIP functionality was important, but the fundamental decision factor for choosing OpenCTI boiled down to having real financial economies of scale that make the cost of TIP access as low as possible. Not because 'cheap is good,' but because a lower cost TIP enables maximum 'inclusivity' whereby more CI-ISAC members can afford to have their own organisations TIP and more users with access in each member organisation. That's how we can build a network to leverage greatest network effects from shared CTI. Solve the economic problem, deliver the best analytical solution. At a time when cybersecurity costs are increasing at what feels like a faster rate than the cyber threats, OpenCTI was not only the best platform for aggregation & analysis, it was the most cost-effective. #Trustedlocal (sovereignty) = #Trustedglobal #Strongertogether #Leavenoonebehind Hague Security Delta (HSD), European Union Agency for Cybersecurity (ENISA), Cyber and Infrastructure Security Centre, Australian Signals Directorate, Cybersecurity and Infrastructure Security Agency, Nationaal Cyber Security Centrum (NCSC-NL), National Cyber Security Centre. World Economic Forum. Global Forum on Cyber Expertise (GFCE).

39

6 Comments