Blue Cross Blue Shield of Illinois allegedly failed to protect the information of current and former members that was exposed in a June data breach, a proposed federal class action said.

Blue Cross Blue Shield of Illinois Sued Over June Data Breach

Space Force is looking at broadening national security launches late in this decade to a wider ... such as the New Glenn rockets being designed by Jeff Bezos’ Blue Origin, and specialized small-satellite launch startups to compete for missions.

Space Force picks Centennial-based ULA for slate of national security launches

The phenomenon, in which the second full moon of the calendar month reaches full moon at its closest point to Earth, is set to arrive Wednesday night.

How to see the big, gleaming super blue moon in the US on Wednesday night

To qualify, Blue Origin must have a credible plan to achieve certification ... Elon Musk’s SpaceX had to sue the Air Force to break ULA’s monopoly on national security launch and has since become a dominant provider of reusable launch for the Space ...

Op-ed | Space Force launch strategy a step in the right direction

MEMPHIS, Tenn., Nov. 1, 2023 /CNW/ - Ting Internet, a division of Tucows (NASDAQ: TCX) (TSX: TC), announced that it has been selected to provide fiber internet service to Memphis residents, businesses, and institutions in partnership with Blue Suede Networks.

TING SELECTED AS BLUE SUEDE NETWORKS' FIBER INTERNET SERVICE PROVIDER

Warrants are essentially a type of derivative security that gives the holder the right, but not the obligation, to buy the underlying stock at a predetermined price within a specified time frame. In the early days, Blue Ocean Acquisition Corp warrants were ...

The History of Blue Ocean Acquisition Corp Warrants

People on Social Security will receive a much smaller bump of 3.2% in their benefits checks next year as their cost-of-living adjustment, or COLA, after government data on Thursday showed ...

Will 3.2% Social Security 2024 COLA be enough to help seniors recover from inflation?

Juniper Networks has expanded its security portfolio with an architecture design that includes AI-based predictive threat support and a new family of firewalls, all designed to protect distributed ...

Juniper delivers distributed data-center security protection, firewalls

Blue Origin's senior vice president of operations is leaving "for personal reasons," according to an internal email seen by Reuters, the third executive departure to be disclosed in less than a month at Jeff Bezos' space company as it aims to sharpen its competitive footing with Elon Musk's SpaceX.

Bezos' Blue Origin sees third executive departure amid restructuring

Get the most recent info and news about Blue Security on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

Get protected by the the Security Company in Durban doing the most to fight crime. Get secured now.

Blue Security

Introducing the InfoSec colour wheel — blending developers with red and blue security teams.

Presentamos la rueda de colores de InfoSec — que combina desarrolladores con equipos de seguridad rojos y azules.

As time goes by, we become more and more aware of the importance of cybersecurity, especially when talking about an organization. More professionals are entering the sector and developing tools to fight hackers every day. Among these tools are some frameworks and knowledge collections that are total game changers. In this article, we’re going to study one such fantastic framework that can help us secure our applications and how we can implement it using a free tool that gives us many extra benefits. If you want to improve the cybersecurity of your organization using an open-source tool in 3 simple steps and gain some badges to boost your credibility in front of clients, this article is for you. **What is the MITRE ATT&CK Framework? \ is an open framework that collects knowledge about adversary tactics and malicious techniques based on real-world observations. It’s totally free and provides different tools which could be really useful for protecting one’s data or organization. MITRE ATT&CK This framework allows us to use a common taxonomy to communicate using the same language with our entire cybersecurity team, including the red team, blue team, security solution providers, SecOps, etc. In addition, it mimics the behavior and tactics of real-life attackers giving us a great tool to identify risks and prepare defenses against possible attacks. Without a doubt, it’s an invaluable resource for IT security teams. Using it to defend our organization could give us many benefits. For example, it can help us learn how to defend our operations against an adversary, scan our current organization's behavior to detect suspicious actions or evaluate the different parts of our company to see where a security breach is occurring. But it’s a tool, and for that reason, it’s not perfect. This framework has some drawbacks because not all techniques are always malicious, so it can detect a technique that in reality isn’t a risk for our organization. Also, if we check deeply the information of this tool, we can realize that some techniques are listed under multiple tactics, so they can be used for multiple use cases. Nevertheless, its pros outweigh its cons. Thus, I think you should give it a try and find out how it can help improve your organization’s security. The framework can be used in multiple ways. For example, it can be expressed using a Matrix for Enterprise as we can see in the below image: How Can We Use It? In reality, this framework is only a way to describe and classify malicious behavior, so we need a tool to apply all the information that it provides us. Implementing it could generate manual mapping or continuous integration using different cybersecurity tools. The most usual method is to use tools such as Security Information and Event Management ( ) or Cloud Acess Security Broker ( ). SIEM CASB Additionally, we can implement it in our CI/CD environments using tools like GitLab or Jenkins. Using MITRE Framework with Kubescape Cloud Searching on the Internet, you can find many tools to scan and defend our systems. In this tutorial, I am using the open-source tool, which I have found most handy for the task. Kubescape Kubescape is an open-source tool that provides Kubernetes with a security tool to scan K8s clusters and YAML files, check for software vulnerabilities using an RBAC visualizer and risk analysis, and detect misconfiguration according to multiple frameworks, including the MITRE ATT&CK Framework. The free SaaS solution offers some additional benefits compared to other similar tools: a really user-friendly interface for test management, an easy way to access our history of scans for quickly reviewing the scans we did in the past, and the possibility to change between frameworks to configure our scans, and more. A really simple demo using Linux The use of this framework is very simple. In just 3 simple steps, we can start using it: Get Kubescape You can download Kubescape to a machine with Kubectl access with one command. Therefore, you need to have installed and a cluster running. Then you only have to open a console and use the proper command: Kubectl curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash If you have downloaded it successfully, you will get an output notifying you of it. Run a scan Once you get Kubescape, you can run a scan with another simple command: kubescape scan --submit Get results Then, we get our results: But this output is not the only one. We can use some flags to manipulate the scanning process. It’s possible to convert the scan result to PDF, to use different frameworks such as the NSA framework, to scan specified containers that have escalated and privilege rights, and more. Additionally, if your environment passes the scan with a 0%, your cluster will be compliant with the MITRE ATT&CK Framework and you could apply for different compliance badges. These trophies will boost your brand because they will certify the high security of your organization. Conclusion Manually scanning a wide area in our organization to find vulnerabilities or risks could be really productive. However, as humans, we are prone to committing mistakes during this process. Therefore, it is better to delegate these processes to a tool or framework. In this article, we’ve discussed Kubescape as a solution for this. It is a really useful tool for those who care about the security of their Kubernetes. With one of its latest updates, we can scan our Kubernetes using the MITRE ATT&CK framework, a really powerful tool for protecting our software based on real-world observations.

What is the MITRE ATT&CK Framework and How You Can Use It

In this article, I’ll show you how to create with Python3.7 + Serverless lambda Assets Monitor My name is Uria Franko and I’m a free-lancer developer Here is the plan Setup Serverless framework Get AWS credentials Write backend of the with python3.7 Assets Monitor Deploy backend to Lambda Schedule running Before we start In order to go through this tutorial, make sure you have: Installed Python 3.7 Installed Node.js v6.5.0 or later AWS account with admin rights (You can create one for free ) right here Step 1: Serverless framework Let’s start from the beginning. In order to easily write and deploy our lambda we will use this awesome framework called . It’s written on NodeJS so we need npm to install it. Let’s go: Serverless npm -g serverless install After this, let’s create a new project from template: serverless create --template aws-python3 --path my-assets-monitor It will create a new folder with two files: my-assets-monitor — a template for your Python code handler.py — configuration file serverless.yml Step 2: AWS Credentials This is the best part of this process, because once you’ve got credentials, you’ll never deal with AWS again. It’s super easy: Log in to your AWS Console, go to and click on “Add User” blue button. My Security Credentials > User Specify username (something like “serverless-admin”) and choose only “Programmatic access” checkbox. On the second page, choose “Attach existing policies directly” and look for “Administrator Access”. Once you created the user, copy your “Access key ID” and “Secret access key”. This is what you actually need to continue. (Tip: save them where you can find them ;) ) Congrats. You’ve got your keys. Open your terminal in and execute: serverless config credentials --provider aws --key xxxxxxxxxxxxxx --secret xxxxxxxxxxxxxx Step 3: Write Assets Monitor Code I’m not going to teach you how to write in Python, so just copy this code and paste to your `handler.py` file: json os sys concurrent.futures ThreadPoolExecutor urllib.parse urlparse

here = os.path.dirname(os.path.realpath(__file__))
sys.path.append(os.path.join(here, )) requests bs4 BeautifulSoup mailer Mailer

mailer = Mailer(os.environ[ ], os.environ[ ], os.environ[ ],)
internal_urls = set()
external_urls = set() ThreadPoolExecutor(workers) ex:
        res = ex.map(func, args) list(res) parsed = urlparse(url) bool(parsed.netloc) bool(parsed.scheme) mailer
    resp = requests.get(url) resp.status_code > :
        mailer.assets.append(url) :
        response = requests.get(url, timeout= )
        response.raise_for_status()
        soup = BeautifulSoup(response.content, ) requests.exceptions.ConnectTimeout err:
        errors = [ ]
        mailer.send_errors(errors) requests.exceptions.ConnectionError err:
        errors = [err]
        mailer.send_errors(errors) requests.exceptions.HTTPError err:
        errors = [ ]
        mailer.send_errors(errors) soup urls = set()
    url_parsed = urlparse(url)
    domain_name = url_parsed.netloc
    soup = request_url(url) soup : a_tag soup.findAll([ , , , ]):
        source = a_tag.name == a_tag.name == :
            source = href = a_tag.attrs.get(source) href == href href: parsed_href = urlparse(href) parsed_href.netloc == : href[ ] == :
                href = url_parsed.scheme + + domain_name + href :
                href = url_parsed.scheme + + domain_name + + href is_valid(href): href internal_urls: domain_name href: href external_urls:
                external_urls.add(href) urls.add(href)
        internal_urls.add(href) urls crawled_links = get_all_website_links(os.environ[ ]) crawled_links :
        response = { : , : } response
    multi_threading(check_status, crawled_links, )
    mailer.send_mail()
    response = { : ,
    } response import import import from import from import "./vendored" import from import from import 'TARGET_URL' 'SOURCE_EMAIL' 'DESTINATION_URL' : def multi_threading (func, args, workers) with as return : def is_valid (url) return and : def check_status (url) global if 399 : def request_url (url) try 5 "html.parser" except as 'Connection timed out to your target' return False except as return False except as f'Your target raised <strong> </strong> status code' {response.status_code} return False return : def get_all_website_links (url) if is False return False for in "a" "link" "img" "script" 'src' if "a" or "link" 'href' if "" or is None or '#' in continue if "" if 0 "/" "://" else "://" "/" if not continue if in continue if not in if not in continue return : def main (event, context) 'TARGET_URL' if is False "statusCode" 500 "body" "Error raised trying to get the target" return 20 "statusCode" 200 return Now create new file in the same directory and call it mailer.py, now copy this code and paste it in: boto3 os aws_access_key_id = os.environ[ ]
        aws_secret_access_key = os.environ[ ]
        self.client = boto3.client( , aws_access_key_id = aws_access_key_id,
                                   aws_secret_access_key = aws_secret_access_key,
                                   region_name = )

        self.target_email = source_email target_email :
            self.target_email = target_email
        self.base_url = base_url
        self.source_email = source_email
        self.assets = [] subject = body = link self.assets:
            body += self.send(subject, body) subject = body = err errors:
            body += self.send(subject, body) self.client.send_email(
            Source = self.source_email,
            Destination = { : [
                    self.target_email,
                ],
            },
            Message = { : { : subject, : }, : { : { : body, : }
                }
            },
            ReplyToAddresses = [
                self.source_email,
            ],
        ) import import : class Mailer : def __init__ (self, base_url, source_email, target_email = None) 'AWS_KEY' 'AWS_SECRET' 'ses' 'us-east-1' if is not None : def send_mail (self) "Assets Monitor Asset Failure" f"""
        <h2>There's a problem with one of your assets!</h2>
        <h4>Base URL: <a href= > </a></h4>
        """ {self.base_url} {self.base_url} for in f'<a href=" "><p> </p></a><br>' {link} {link} : def send_errors (self, errors) "Assets Monitor Website Failure" f"""
        <h3>There's a problem with your monitored website:</h3>
        <h4> </h4>
        """ {self.base_url} for in f"<p> </p><br>" {err} : def send (self, subject, body) 'ToAddresses' 'Subject' 'Data' 'Charset' 'UTF-8' 'Body' 'Html' 'Data' 'Charset' 'UTF-8' If you are lazy enough, just fork or clone it from my GitHub . repo Also, you will need to create requirements.txt file and write: requests
bs4 and execute this command to install it locally: pip install -r requirements -t vendored .txt Step 4: Deploy to AWS Lambda Pretty much like on Heroku, all you need is one configuration file “serverless.yml”. Go ahead and edit yours to make it look like this: service: my-asset-monitor

provider:
  name: aws
  runtime: python3 stage: dev
  region: us-east environment:
    AWS_KEY: AWS_SECRET: TARGET_URL: SOURCE_EMAIL: DESTINATION_EMAIL: functions:
  post:
    handler: handler.main
    events:
      - schedule:
          name: asset-checker-schedule
          description: rate: rate( minutes) .7 -1 "" "" "" "" "" 'Schedule asset checking every 30 minutes' 30 Notice that you need to change AWS_KEY -> Your AWS key that we created AWS_SECRET -> Your AWS key that we created TARGET_URL -> The website that you want to monitor (Ex: 'https://google.com') SOURCE_EMAIL -> Your verified email that you can get/verify here DESTINATION_URL -> The email that the notifications will be sent to You can also change the rate(30 minutes) to what ever you want... you can find the rates syntax here And the magic happens once you execute this in your terminal: serverless deploy It will pack all your files into .zip archive and upload to AWS, then it will create AWS CloudEvent to schedule and run the monitor automatically The serverless backend of your monitor is now live and running. Now if any asset or link in your website will be broken (Not found/ Server error / etc) you will get an email that's looks like that: Also if there's any error accessing your target you will get an email like that: Keep in mind At the beginning it will cost you nothing, because The AWS Lambda free usage tier includes 400,000 GB-seconds of compute time per month. But if you have any other lambda function or you multiply the monitors it can get to a point where they charge you... Our current usage is 60/30 * 60 * 24 * 30 = 86,400 calls each calls is between 1-5 seconds depends on the assets amount and a usage of 256MB So 86,400 * 3 (Average)  / 4 (GB-sec / 256MB = 3.9xxx) = 66,355 seconds of usage per month Serverless approach is very convenient in some cases because it allows you to build very scalable solution. It also change your thinking paradigm about managing and paying for servers. Serverless framework gives you very simple tool to deploy your function with no needing to know AWS or any other cloud provider. AWS gives you nice free tier period for services so you can build your MVPs totally for free, go live and start paying only if you reach a certain amount of users.

Assets Monitor as a Function

Demons in Digital Gold, Part 3 when it comes to standing the test of time, technology and security make strange bedfellows If you have not already done so, please read to this series. the introduction A store of value is the function of an asset that can be saved, retrieved and exchanged at a later time, and be predictably useful when retrieved. — Wikipedia Store of value is the function of money that enables goods and services to be paid for a considerable time after they have been acquired. — Collins English Dictionary If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology. — Bruce Schneier, preeminent cyber-security expert There are known unknowns. That is to say, there are things that we know we don’t know. But there are also unknown unknowns. There are things we don’t know we don’t know. — Donald Rumsfeld, no introduction required We will set aside all of the vigorous debate — strong points made for and against — and declare a (et al) are a store of value (SoV). Great news! For the duration of this post we accept that crypto-currencies ARE a store of value. fait accompli: Bitcoin “The motivation for this series is to provoke BALANCED thinking,” as stated in the introductory post. So what is left to discuss vis-à-vis SoV, given the “green check mark” status bestowed in the previous paragraph? Cryptocurrencies are enabled by innovative technology that we justifiably celebrate, and ALL innovative technology carry security ramifications. This post discusses the security attributes of a store of value, specifically, “security over a considerable time.” A remarkable track record First, big-league kudos are in order for the entirety of “Team Bitcoin” from Satoshi to present day contributors. (I am talking about a heist against the BACKBONE — miners, full nodes, peer-to-peer network, blocks, transactions, etcetera — NOT against exchanges and wallet apps.) Billions of dollars in a completely public protocol and database — the blockchain — and no successful hacks against the bitcoin system. That is f — ing amazing! The bitcoin system has had the biggest target on its back for the better part of five years (the point of $1B circulating supply), painted by ne’er do wells pining for the combination of ginormous sums of money and the distinct possibility of getting away with a heist. A remarkable state of affairs from a cyber-security perspective. The most gifted hackers worldwide have studied and probed from every angle, to no avail. This post is NOT about “everyday” implementation (i.e. code) vulnerabilities. This post tackles the potential of “unkown unknown” PROTOCOL vulnerabilities. And yet — yeah, you just KNEW this was coming — five years is not very long in terms of new and innovative technology. While the former can be dangerous, the latter can be dinosaur killers. “FUD!” I hear the complaints, “You’re talking hypotheticals!” Well, granted, that is the nature of unknown unknowns: things we don’t know that we don’t know. To best frame the potential of protocol vulnerabilities, let’s examine two long-lived and incredibly prevalent technologies that made the wrong kind of headlines in just the past three months. PLEASE bear with me while I explain these vulnerabilities. These examples build solid common ground before we circle back to “security over a considerable time for a store of value,” and tackle hypotheticals. KRACK vulnerability in Wi-Fi Protected Access (WPA2) The earliest Wi-Fi networks were “protected” by a foolhardy veneer that compounded its negligent lack of rigor with a confidence-inspiring name: wired equivalency protocol (WEP). WEP’s security flat-out SUCKED. People wondered if enterprise-grade Wi-Fi security was an intractable problem. Published in 2004, the protocol employed the very contemporary advanced encryption standard (AES) still in use everywhere today. Showing great foresight, WPA2 utilized 256-bit AES (most applications stuck with 128-bit AES through 2014). To remedy the situation with a sledgehammer — in order to put security doubts to bed — the Wi-Fi Alliance recruited credentialed cyber-security experts to craft a rock-solid security protocol in the form of WPA2. Yes, there were hacks against individuals and enterprises that failed to follow good security hygiene (for example, not changing a router’s default password). Yes, there were hacks against specific routers from careless vendors (for example, using out-of-date open source firmware). The WPA2 protocol — defined in the public specification—was never compromised. WPA2 delivered strong security. IEEE 802.11i-2004 After all, Wi-Fi opened the door to hacking a company’s internal network from their parking lot. And while some of those hacks succeeded, the vulnerabilities were NEVER in the WPA2 protocol. As Wi-Fi proliferated, hackers painted a big target on it back. Truly impressive: a completely public protocol accessible from completely public spaces, stood the test of time against gifted adversaries. The news in October 2017 was a bolt from out of the blue. This week security researchers announced a newfound, serious weakness in WPA2— the security standard that protects all modern Wi-Fi networks. This is a bad vulnerability in that it likely affects billions of devices, many of which are hard to patch and will remain vulnerable for a long time. — Electronic Frontier Foundation, 19 October 2017 This was KRACK — an acronym wrestled from the phrase “key reinstallation attacks” — and as vulnerabilities go, it was F — ING BAD. Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites. — (yes, major vulnerabilities get their own website) KRACK website And while KRACK did impact Wi-Fi routers, the more damaging consequence was that it impacted EVERY device with Wi-Fi. Computers, tablets, mobiles, and the growing plethora of IoT and smart home devices … all vulnerable. It was so f — ing bad because the flaw was in the WPA2 protocol itself. The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected. Note that if your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected. —KRACK website The only good news: KRACK was discovered by extraordinarily talented researchers at (KU Leuven), who followed established conventions and quietly informed Wi-Fi vendors before any public announcement was made. There was no indication that the vulnerability had been exploited by hackers in the wild. Katholieke Universiteit Leuven The bad news: EVERY DEVICE with Wi-Fi needed to be patched. Mainstream vendors did a great job, for example, Apple and Microsoft patched the vulnerability in their respective operating systems BEFORE the October announcement. Many smart home devices remain unpatched to this day. Other vendors lagged and infuriated users, as a SINGLE unpatched device could leave AN ENTIRE network exposed. Key takeaways from KRACK vulnerability: Public protocol, extensively vetted by cyber-security experts Hundreds of implementations, most including yet more security testing Used in billions of devices 13 years as an “unknown unknown” before protocol flaw discovered Spectre vulnerability in processor hardware In the first days of 2018, published research revealed that nearly every processor manufactured in the last 20 years contains fundamental security flaws, arising from features built into chips that help them run faster. There is as of yet no evidence that these flaws have been exploited in the wild, but such exploits would be difficult to detect, and the flaws are so fundamental and widespread that security researchers are calling them catastrophic. — CSO Online, 8 January 2018 Last week saw the announcement of a heretofore unseen type of vulnerability impacting billions of computing devices manufactured in the past 15 years. The dramatically named Meltdown and Spectre vulnerabilities were discovered by a handful of insanely clever researchers, independently and yet simultaneously (a fascinating story in its own right, . check it out here ) As was the case with KRACK, the researchers quietly released information on these vulnerabilities to hardware and operating system companies, to give them time to develop and deliver mitigations before going public. Given the number of people “in the know” around the globe, it is astounding that the embargo held for a full six months. Here, I am going to focus on Spectre. While Meltdown impacts virtually every processor (a.k.a. CPU) manufactured in the past 15 years by Intel, Intel and AMD processors in everything from Macs to PCs to servers. ARM processors in tablets and mobiles. Even SPARC processors (if any readers remember those). Spectre impacts virtually every processor manufactured in the past 15 years by nearly EVERY manufacturer. Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre. — (did you think I was kidding earlier?) Meltdown and Spectre website Spectre is a DEFCON-1 level vulnerability (technically, it is a pair of very closely related vulnerabilities): The flaw is in the aforementioned processor HARDWARE, so every operating system is affected. Mac OS, iOS, Android, Windows, Linux, you name it. Oh yeah, also every virtual machine hypervisor: the cornerstone of all cloud computing datacenters. The flaw enables a malicious program to read data from memory it should NEVER be able to access, including the operating system kernel. Therefore , Malware exploiting Spectre can “steal” the most sensitive information in a device’s memory, for example, passwords and cryptographic private keys. While all major operating systems were quickly patched against Meltdown, protecting against Spectre is far, FAR more involved. For one thing, operating system kernels AND applications must be recompiled with yet-to-be-determined defensive countermeasures. For another thing, the processor microcode must be updated. Few of you know what “microcode” means, and those few likely didn’t know that modern processors STILL have microcode. The only way to deliver said microcode update is via a new UEFI/BIOS … and when was the last time ANYONE updated that on their computer? Anyone? Bueller? Anyone? Some processors cannot be patched as described in the previous bullet. In such cases, the only full-and-proper fix is replacing the hardware. Yikes. Paraphrasing Nigel Tufnel in “This is Spinal Tap”: There’s something about this that’s so bad, it’s like how much more bad could this be? And the answer is none. None more bad. Processors spend a lot of time WAITING for data to arrive from memory (including cache memory). Imagine a processor reaches a conditional branch (if … then .. else) and does not yet have the data to resolve the condition. Back in the old days, the processor would twiddle its thumbs waiting for the necessary data before it could determine which fork of the branch to execute. Waiting equals poor processor performance. Strictly speaking, Spectre is not exactly a protocol vulnerability. It is more accurate to call it a TECHNIQUE vulnerability. The processor picks the RIGHT path most of the time. Yippee, no waiting and improved performance! Should the processor end up discovering that it selected the WRONG path, it discards all the speculatively executed work, “rewinds” to the branch, and continues along the right path. A processor employing speculative execution makes an educated guess on the conditional branch and plows ahead along the most likely path. Speculative execution is so effective that processor performance is greatly improved. Hence, no surprise that this technique is almost universally employed. The intrepid researchers discovered a FUNDAMENTAL flaw in speculative execution. They developed a method to trick the processor into speculatively executing a malicious code snippit that is discarded, while fooling the processor into exposing data in memory. Not a flaw in a particular implementation, rather, a flaw in the TECHNIQUE of speculative execution. This is a completely new class of through-the-looking-glass hardware flaw. Processors have multiple (formally) rock-solid mechanisms that prevent applications from reading data that belongs to other applications and ESPECIALLY data that belongs to the operating system. Spectre breaks ALL of those security mechanisms by speculatively executing a “magic” code snippit designed to be discarded. Open f — ing sesame, Spectre malware can read the most sensitive data in memory. Key takeaways from Spectre vulnerability: Public technique, extensively examined and refined and tested Hundreds of implementations, every one including more security testing Used in billions of devices 15+ years as an “unknown unknown” before technique flaw discovered Security over a considerable time for a store of value Yes, finally we circle back to the question of security vis-à-vis SoV. And for those few of you that are still reading this post [ed: thanks!], the information is neatly laid out on our freshly built solid common ground. An SoV, by definition, remains secure over a considerable time. Cryptocurrencies are built atop innovative technology of the . blockchain Cryptocurrencies are a prime target of hackers worldwide. Everyone recognizes that ALL technology has bugs. Most of these are discovered and mitigated with minimal “bad stuff” by way of damage. History illustrates that fundamental flaws at the PROTCOL and even TECHNIQUE level can exist for over a decade before discovery. KRACK and Spectre are examples of such latent vulnerabilities with the potential to inflict immense damage. Lucky for all of us, in both instances the flaws were discovered by The Good Guys. So what if KRACK had been discovered by The Bad Guys? There is a thriving underground ecosystem for the sale of exploits. A zero-day flaw with the pervasive impact of KRACK would be worth millions of dollars. Think about it: Stuxnet and its cousins stayed under the radar for years. Carbanak (below) was only found after the $1B heist. KRACK exploits would be much more difficult to detect in the wild. The exploit would be sold to a small number of the highest bidders — governments and well-to-do criminal enterprises — and would remain under the radar for quite some time. And what if Meltdown and Spectre had been discovered by The Bad Guys? An honest-to-goodness dinosaur killer exploit, worth tens of millions of dollars. “Clearly the highest bidders would be governments,” you say with plenty of recent historical precedent to back you up. Maybe not. Malware designed with these exploits might be more valuable to a criminal enterprise targeting financial institutions. Crazy talk? Hardly! Check out the extraordinary 2015 Carbanak attack on financial institutions . The take? ONE. BILLION. DOLLARS. Now there is a LOT of risk with an attack against financial institutions, regulated corporations with the full hell-and-fury of the best law enforcement agencies working to take down perpetrators. Anyone? Bueller? Anyone? in this article Perhaps a criminal enterprise with high-caliber hacking talent would be better served targeting an equally rich target, in a less regulated space, with a cleaner getaway? The above little corner of my imagination painted a threat against cryptocurrencies that leverages a Spectre-like vulnerability. That’s old school hacking (needing a delivery mechanism) against a contemporary target. The bitcoin system has had the biggest target on its back … The most gifted hackers worldwide have studied and probed from every angle, to no avail. An unknown unknown, present today, lying latent. How might such a protocol vulnerability manifest itself? Beats the hell out of me! There are things we don’t know we don’t know. Now imagine hackers do eventually avail, [ed: ] and discover a protocol vulnerability in one of the major cryptocurrency blockchains. ¿que? Maybe the flaw enables tilts the table of winning the block mining challenge, greatly reducing the barrier to a 51% attack. Maybe the flaw facilitates double spends. Maybe the flaw enables rogue transactions that flat-out steal Bitcoin (et al). I am NOT suggesting that such a vulnerability exists with ANY probability. What I am suggesting is that the possibility CANNOT be ruled out. EVER. Such a possibility is inherent in every technology. The probabilities are higher in newer, innovative technology solutions. This is at odds with security over a considerable time for a store of value. I am NOT suggesting that cryptocurrencies CANNOT be an SoV. What I am suggesting is that the dreadful, dinosaur killer possibilities outlined in this post need to be incorporated into your decision making process. I’m here to lay out facts that you may have overlooked. You’re here to reach your own conclusions. Your turn. Next in the series … Your private wallet, SoV, future-proofed Follow me @ Pressed250 on Twitter Copyright © 2018 Bruce Kleinman. All Rights Reserved.

Store of value / Vulnerabilities in store

Take advantage of the energy at the show and come home with a new cloud credential proving what you know! This year’s re:Invent is going to be bigger and better than ever. With 40,000 builders descending on for a week jam-packed with hackathons, bootcamps, breakout sessions, and great social events. You can’t ask for much more from the best conference in cloud. AWS Las Vegas But budgets are tight, and it may have taken some convincing to get the approval needed to make the trip. AWS tried to make it a bit easier this year by providing a starting point for a justification letter. Hopefully that worked, and you’re on your way to Las Vegas at the end of November. What better way to go beyond expectations than to come back to the office with a shiny new AWS certification? It’s a great way to provide your cloud chops and to show just how much you learned at the show. This year, there’s a certification for anyone and everyone. Learning Tree The AWS certifications fall into three categories; associate, professional, and speciality. These levels provide a learning path that shows growth at a specific discipline in the cloud. The official AWS learning tree is available on , and it looks like this; their site AWS certification roadmap But even the official learning tree is missing a step! Recently AWS announced the beta period of an entirely new certification, . AWS Certified Cloud Practitioner This new certification is the place to start for AWS newcomers. perfect AWS Certified Cloud Practitioner This brand new beta certification is all about the basics…the very basics.The target audience? “…any role, including technical, managerial, sales, purchasing, or financial (or equivalent training)”. The goal here is to get everyone on the team speaking the same language. This way when you’re discussing a new project, there are no blank stares around the table. It’s a way to ensure that everyone is familiar with the basic AWS services, terminology, and principles. Accordingly, this is the exam with the least technical depth. The recommended reading is; Overview of Amazon Web Services Architecting for the Cloud: Best Practices How AWS Pricing Works AWS also recommends that you review . Also any or training from AWS will help make sure this exam is a slam dunk. the available support plans technical business This exam is relatively short (70 questions over 110 minutes) and is currently priced at $50 USD. The only restriction here is that if you’ve attempted or passed another AWS exam, you cannot take this one. It’s a great way to dip your toe in the waters of AWS certification. Associate Level With the practitioner certification under your belt, it’s time to move up to the associate level certifications. There are three choices here; , , and . All three are similar in difficult but tailored to the specific tasks relevant to the job role. solutions architect developer sysops administrator The following whitepapers are recommended for each of the associate’s exams: Overview of Security Processes Storage Options in the Cloud Building Fault-Tolerant Applications on AWS Overview of Amazon Web Services AWS Risk and Compliance Overview Architecting for the Cloud Also, I recommend you review the following: AWS Well-Architected Framework An Overview of the AWS Cloud Adoption Framework There are some additional certification specific requirements as well. Make sure you review the exam guide, candidate overview, and exam blueprint as you start to study for the test. Professional Level The professional level exams take things to the next level. These exams primarily cover situational-based decision making. They’re designed to make sure that you can the knowledge you’ve gained. apply You need to have the relevant associate level exam before attempting these multiple choice exams. You’ve got a 170-minute window which may sound like a lot, but if you aren’t well prepared, you might find yourself hitting that wall hard. Review all of the associate material as well as some key, in-depth whitepapers. Whether you’re taking the or , make sure to read: AWS Certified DevOps Engineer AWS Certified Solutions Architect AWS Well-Architected Framework — Security Pillar AWS Well-Architected Framework — Reliability Pillar AWS Well-Architected Framework — Performance Efficiency Pillar AWS Well-Architected Framework — Cost Optimization Pillar AWS Cloud Adoption Framework: Security Perspective Blue/Green Deployments on AWS Infrastructure as Code Operational Checklists for AWS Backup and Recovery Approaches Using AWS At this level, you’ll also want to invest in some additional training. AWS is offering specialized at AWS re:Invent again this year and they are well worth the investment. If that’s not your speed, there are some excellent third party training providers that may be perfect for your learning style. bootcamps Practice exams are also available online from AWS and it’s testing provider. In my experience, the practice exams are quite similar to the actual exam. They are a good gauge to see if you’re ready to sit the exam or not. It’s a smart investment for around $40 USD. Speciality Exams , there were three exams in beta; AWS Certified Advanced Networking, AWS Certified Security, AWS Certified Big Data. Last year at AWS re:Invent Of those, advanced networking and big data passed the beta stage and are not standard exams. The security exam was pulled and is being re-worked…no word yet on when it’ll reappear. I won’t mince words, these speciality exams . are tough Take some time and read through the first-hand accounts of people who have passed the exams (either in beta or ). Start with post on the and then this one on the from . live Adrian Cantrill’s AWS Certified Advanced Networking Specialty AWS Certified Big Data exam Hwai-Siang Khor Now for the bad part, prepping for these exams can be hit or miss. They are 3 hour multiple choice exams that require extensive knowledge on the subject at hand. AWS provides minimal guidance, and there are no official practice exams available. You’re 100% reliant on third parties here. My recommendation from last year of reviewing relevant talks from AWS re:Invent still stands. The and are available online. Look for talks presented by AWS in the big data, architecture, enterprise, and DevOps tracks to be especially helpful. 2016 breakout sessions 2015 breakout sessions I called out some of these talks in ,and they are still top of my review now that the exams are live. my beta exam post from last year Book Now during the show. This is a great opportunity to build off of the energy and excitement of being surrounded by 40,000 other builders. AWS has a testing facility on-site I strongly recommend writing an exam early in the morning, early in the week. It’s best to approach the challenge after a good breakfast and with a fresh mind. The show can be overwhelming, make sure you set yourself up for success! Good Luck! Remember, I’ll be at AWS re:Invent again this year and am looking to help you get the most from the show. If you have a question you want to be answered, let me know in the responses down below or on Twitter ( ) and I’ll write it up, record it, or share some code with the solution. I’m @marknca

Get Certified At AWS re:Invent 2017

headlines are often dominated by ethical hackers, also known as red teamers. There's an inherent appeal in breaking things as opposed to protecting them from being broken. Cybersecurity The education system seems to be pointing in the same direction, probably because the founders of many cybersecurity training companies (at least those I consider good) are all ethical hackers themselves. Iconic roles in the community, like Kevin Mitnick (who tragically passed away this year) the person for whom the word 'Hacker' was practically invented, ended up working as an ethical hacker. Even the depiction of cybersecurity professionals at work in movies is all about attackers: think of (a classic), , and in my humble opinion, even Neo in the first movie was a pentester in training. Hackers Mr. Robot Matrix So, with these among many other reasons making red-teaming more glamorous, if you look at the list of roles that are mostly sought after by employers, it’s easy to see that the real opportunities in cybersecurity (and your higher chance to find a job) are all about becoming proficient in one of the many essential and still underrated defensive roles, also known as blue team. Cybersecurity Defense: The Art of Critical Thinking I truly understood the critical importance of blue teamers in 2016 during a conversation with the IT director of a Fortune 500 company. As we discussed training and hiring needs, he shared a revealing insight: 'For every pentester we hire, we need to bring on 10 SOC analysts, and it's incredibly hard to find them. We seek fresh graduates with the right mindset, looking specifically for critical thinkers.' This conversation was a pivotal moment for me, revealing the often overlooked but immense value of the blue team in cybersecurity. While the red team's successes often grab the limelight, it is the intricate artistry and critical thinking within the blue team's defense where the real battle is waged. Unlike the straightforward objective of a red teamer finding vulnerabilities, the blue team's role involves anticipating and protecting against a myriad of potential threats. In this nuanced world, a defensive cybersecurity professional must be proficient in technology and also master the art of prediction and strategy. It's a continuous game of mental chess, where each move requires careful consideration and foresight. Their work is less about the adrenaline rush of the attack and more about the calculated, ongoing process of safeguarding. The blue team's role is about constructing an impenetrable fortress, constantly evolving and adapting to new challenges. Blue Teams roles and job descriptions The realm of blue team roles is diverse and requires skill sets that are different and equally challenging. With the help of , a tool that provides data on the cybersecurity job market, we can review a breakdown of the most sought-after blue team role and the correspondent area of the . CyberSeek NICE framework Job Role NICE Area Cybersecurity Analyst/SOC Analyst Protect and Defend (PR) Cybersecurity Manager Oversee and Govern (OV) Cybersecurity Engineer Securely Provision (SP) IT Auditor Oversee and Govern (OV) Cybersecurity Specialist Operate and Maintain (OM) Cybersecurity Consultant Oversee and Govern (OV) Incident & Intrusion Analyst Protect and Defend (PR) Cybersecurity Architect Securely Provision (SP) Cyber Crime Analyst Investigate (IN) Cybersecurity Analyst/SOC Analyst Cybersecurity Analysts and SOC Analysts are responsible for monitoring organizational networks for security breaches and investigating when a breach occurs. They implement and maintain security measures to protect systems from cyber threats. Cybersecurity Manager Cybersecurity Managers develop and oversee the implementation of policies and procedures to ensure that an organization's data and infrastructure are protected. They manage a team of cybersecurity professionals and coordinate security initiatives across departments. Cybersecurity Engineer Cybersecurity Engineers focus on designing and building secure systems. They are responsible for the technical implementation of security systems that prevent attacks and ensure the integrity and confidentiality of sensitive data. IT Auditor IT Auditors evaluate the effectiveness of an organization’s IT controls, policies, and procedures. They ensure compliance with laws and regulations, safeguarding against inefficiencies and ensuring the security of IT systems and business operations. Cybersecurity Specialist Cybersecurity Specialists are hands-on professionals who address various aspects of information security, from configuring networks and patching vulnerabilities to running risk assessment and response protocols. Cybersecurity Consultant Cybersecurity Consultants assess cybersecurity risks, problems, and solutions for different organizations and advise on best security practices. They may also design and implement security solutions. Incident & Intrusion Analyst These analysts detect and respond to cyber incidents and intrusions. They analyze security breaches to understand the root cause, mitigate damage, and develop strategies to prevent future incidents. Cybersecurity Architect Cybersecurity Architects are responsible for creating, maintaining, and updating an organization's security architecture. They plan and design security systems that address the organization's needs against cyber threats. Cyber Crime Analyst Cyber Crime Analysts focus on investigating cybercrimes. They collect evidence, analyze data breaches, and work with other cybersecurity professionals to prevent future cybercrimes. To complete the overview, always with the help of Cyberseek data, we can see how 6 out of 7 of the highest-paying cybersecurity job titles in the US are for blue team roles: ●      Security Architect: $151,547 ●      Cybersecurity Manager: $128,665 ●      Cybersecurity Engineer: $127,094 ●      Security Analyst: $107,517 ●      Cybersecurity Specialist: $106,265 ●      IT Security Auditor: $105,692 This analysis highlights the significance and the highly rewarding nature of blue team roles in the cybersecurity field. The Role of Blue Teams in Shaping the Use of AI in Cybersecurity During my tenure at a top-tier cybersecurity training company, I observed a curious paradox. The market was flooded with AI-based platforms, marketed as the next big thing in bolstering organizational cyber defenses. Yet, as these platforms proliferated, so did cyber attacks. The core of the issue lay not in the technology itself but in its users. Many blue team professionals, responsible for operating these platforms, lacked the necessary skills to leverage these advanced technologies effectively. It became clear that while AI could offer cutting-edge solutions, its true potential was only unlocked through the expertise of well-trained individuals. In the cybersecurity arena, the allure of AI as a silver bullet for automated defense is a myth that blue teams know all too well. As discussed earlier, the pressing demand for "critical thinkers" underscores a truth in the cybersecurity field: the human element is irreplaceable. AI platforms, while revolutionary, fall short without the discerning judgment and analytical prowess of skilled professionals. Blue teams, the guardians of company infrastructures, are critical in shaping the role of AI in cybersecurity. AI can process and analyze data at a speed and scale unattainable by humans alone, yet it lacks the nuanced understanding that comes from years of experience in the field. For AI to be truly effective, it requires the oversight of those who can interpret its data and understand its implications—roles that blue teams are perfectly suited to fill. Incorporating AI into cybersecurity strategies enhances capabilities, but it does not negate the need for blue teams. Instead, it amplifies their importance. Teams composed of adept individuals can utilize AI to sift through noise, pinpoint anomalies, and prioritize threats. This synergy between human insight and machine efficiency is where the true power lies. Blue teams' ability to employ critical thinking enables them to fine-tune AI tools, tailor them to specific organizational needs, and, importantly, question their output. This is crucial because AI, for all its advancements, can still be misled or manipulated. It is the role of the blue team to detect when AI is being deceived and to step in before any damage is done. By embracing AI as a tool—not a replacement—blue teams can elevate their defense mechanisms to outmaneuver threat actors. The future of cybersecurity hinges on this partnership, where AI extends the reach of human capabilities, and blue teams provide the strategic context and ethical framework that AI alone cannot achieve. As we continue to embrace AI, it's the blue teams, with their critical thinking and analytical skills, who will lead the charge in securing our digital frontiers. Training Resources to Explore a Blue Team Career For students eager to start a career in blue team cybersecurity, there are numerous free resources available that provide a solid grounding in the field without the need for significant financial investment. These resources are not only accessible but also offer high-quality information and training to help kickstart a successful career in cybersecurity defense. The following are some notable resources: Online Blogs and Tutorials: offers an array of blue team tutorials. HackerSploit YouTube Channels Covering Various Aspects of Blue Team Cybersecurity: For a general overview, including malware analysis and Capture The Flag (CTF) challenges, is highly recommended. John Hammond's channel To learn about blue team career paths, skills, and certifications, channels like and are excellent. DayCyberwox Cyberwox Academy also provides valuable insights into blue team careers. Gerald Auger's channel For those interested in forensics, the offers in-depth content. Check it out at 13Cubed YouTube Channel. 13Cubed channel Channels like , and are exceptional for learning about malware analysis. Malware Analysis For Hedgehogs OALabs These resources are not only easily accessible but also provide high-quality training and information, setting the foundation for a successful career in cybersecurity defense. Flipping the narrative The cybersecurity industry, traditionally driven by exceptional individuals and ethical hackers at heart, has shaped newcomers' perceptions of careers in this field. However, we are now entering a phase of maturity that calls for the adoption of a new perspective. This shift is vital not only to steer new talents in the right direction but also to assist employers in addressing their evolving needs. This evolution in perspective reflects a deeper understanding of the industry's dynamics and the importance of aligning talent development with the changing demands of cybersecurity, ensuring a more strategic and inclusive approach to both career development and recruitment.

The Most Neglected Roles in Cybersecurity are Your Best Bet for Employment

Picture from http://blog.linguistica-international.com/4-ways-translation-can-send-your-roi-through-the-roof/ Having worked on both sides of the fence, I want to share my biggest lessons learnt during my career that entailed: being a penetration tester and red teamer being an accomplished bug bounty hunter working as an internal QA engineer, Security Engineer and Security Architect a’ka blue teamer running and maintaining bug bounty program for a handful of companies worked as a head of security reporting to the board of directors for maximum ROI of security initiatives, including penetration tests and bug bounties Here is a list of action items I recommend you to take during and after penetration test/bug bounty cycle. This list is based on the most common gaps I’ve noticed at the companies I’ve worked with and the things that to me made a huge impact ROI-wise. By implementing these steps, you’ll be able to get much higher return of investment from penetration tests. If you’ve already spend your money, let’s make sure you’ve spent it well and squeezed max out of it. Provide all information to pentesters as beforehand. You want to make sure that pentesters don’t waste too much of their time on reconnaissance. Provide them with documentation on the product, video recording how your product works, and a list of APIs and endpoints you want them to test. In general, penetration testers will know what to go after, however if you have hidden APIs, or want to speed up the process, it’s better if you provide them the information beforehand. 2. Don’t play games and don’t block pentesters as they do their job. You’re all in the same team and should share the common goal to make your organization safer The mindset shift is a huge thing. I’ve met number of security teams, that were literally fighting with external pentesters, because they were afraid of their position and ego. You hire pentesters to do the work for you and to provide maximum value to your business, so it’s not smart to waste your money while you argue with pentesters and block their testing environments. Depending on corporate culture, it may be a good idea to have a separate — such as compliance/audit — team to coordinate external testing, to avoid conflict of interest. 3. Be humble and thoroughly follow pentesters recommendations in terms of issues remediation Don’t fight it, when pentesters provide you information about the issue severity and its guidance. It may sometimes happen that with internal business knowledge, you can perform better risk analysis and assess that the issue has different severity for you. However, keep in mind that most often than not, pentesters know what they’re doing and it’s not their first assessment(I hope!) so when they provide you an information about the issue, it’s likely to be legitimate. It’s generally good idea to follow their remediation guidance, to make sure you’ve addressed the issue in-depth and then request re-tests. 4. Find the root cause of every single issue and learn what you can do better next time. Stay focused on the big picture and think about other places where the same issue may exist but wasn’t found by pentesters. As opposed to simply fixing individual bugs, dig deeper into your codebase to find out if the same issue doesn’t happen in other applications. Then review your software engineering practices to see what could be done better to stop those bugs from appearing in the first place. 5. Have your engineering teams learn from pentesters and study pentest report Don’t keep it all for yourself and have everyone learn from the report. Use it as an interesting exercise and learning experience. Pentests at most companies happen once or twice per year, so why not maximize the outcome. Thanks to that software and QA engineers can learn how to apply that knowledge in their day to day work such as to add it to existing test cases. 6. Ensure developers have complete understanding of all issues You need to take ownership over the reports and don’t just throw it at employees. You want to make sure everyone has good grasp of security awareness, so they can address them well as well as use that knowledge in the future to build more robust apps. If something is complicated it won’t get easily remembered and put into action. 7. Cover identified bugs with solid regression test cases You don’t want pentesters to find the same bugs over and over again. Not only it’s a waste of money, but that’s an additional exposure, because if regression pops up, attackers may abuse it before your next pentesting engagement. We’re performing penetration tests to improve our products and company, so if you’re not going that extra mile, you’re leaving a lot on the table. 8. Once in a while check changes made by pentesters, visit their profiles used for testing to catch unexpected regressions. It makes a lot of sense to clone the activities that were performed by pentesters, and build standalone testing scenarios out of it. When you login to the pentesters’ account in the testing environment, you may notice much more bugs than they reported. Security testers, focus on reporting security issues, and most often don’t waste their time on reporting UI/UX issues, that may have been identified during security tests. So just checking their environment to see if e.g. not expected encoding didn’t break the UI, will be beneficial, and again will be something to share with internal QAs so they can improve their test cases. 9. Review logs to catch unidentified bugs Some things aren’t exposed to the user, which means that security testers may have touched some fragile system and maybe had even broken it, but they weren’t aware of it. If you review the logs, you may be able to find some unhandled exceptions, Internal Server Errors, and other indicators that may allow you to improve robustness of your code and systems. Thanks to making yourself comfortable with the logs generated by penetration testers, you’ll be also able to create security monitoring around your access/application logs, to detect potentially malicious hacking attempts. If some keywords happened to appear in logs only during pentesting engagement and never before, then attackers may perform tests in the same fashion. If you create alerting around that, you may be able to spot the attackers and allow yourself to respond to the threat. In my career I’ve met only a handful of companies that taken such wide range of activities during penetration tests. If you follow this guidance, you’ll optimize your spendings and should be more satisfied with general return of investment in security tests.

TOP 9 Rules To Maximize ROI Of Bug Bounties And Penetration Tests

Apparently, Abraham Maslow said: “ I am sure you have heard this saying elsewhere. I suppose it is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail.” And I think it is a valuable quote about expanding your knowledge, toolset, and horizon and everyone should try to fully understand it. But over my time working in (offensive) cybersecurity, I kind of came up with a different statement: “If the only tool you have is a hammer, you have to bang everyone.” (okay, you can get mad at me right away, for my poor choice of words). Please continue reading before you get mad at me Quick disclaimer: I am NOT advocating any form of violence. My own story I feel like my own background matters a little bit to explain this way of thinking. When I first googled , I was instantly hooked by the amazing world of cybersecurity. I watched every hacker movie, all the cool videos, and documentaries about Anonymous and I installed Kali Linux on e-v-e-r-y-t-h-i-n-g. “How to hack WiFi.” YouTube Later on, I also learned more about different kinds of attacks and how to defend against them. When I had my first IT internship, my boss kind of said something like the hammer and nail quote (she also stated that there are probably not many people paying someone to hack stuff in a legal way, oh boi). Nevertheless, it was a valuable lesson and I started learning more about other aspects of security, and IT. But deep in my heart I always remained a hacker. I eventually ended up getting a student job at a big IT company, where I worked in some security roles before ending up as a full-time . penetration tester In this company, I truly had to learn what it meant to not only employ a hammer for every task. Security requires the collaboration of many teams, skills, and people. And I can not stress the collaboration aspect enough. So it is without doubt important, valuable, and extremely eye-opening to learn how others are approaching cybersecurity. Incident Response, Cyber Threat Intelligence, Compliance, Audits, Executives, Security Researchers, and so many others all do different things but have one common goal: Securing your organization. Talking to them, learning from them, and helping each other is crucial to ensure your organization does not approach every security problem like a nail. In today’s world, it is the only way to succeed. Why I still think you should do a lot of banging Sorry, I kind of committed to this wordplay, but be sure, I am cringing too. As I said, in the end deep down I am a hacker and I want to break stuff. And I suspect it is the same for others. They were hired for that one job so that they can bring their unique expertise to solve problems. So what do I mean, when I say “banging”? Essentially you are a kind of a hammer because there are certain things you are good at. Sure, maybe you are a hammer with a little, extendable screwdriver (I am so sorry), and that is great. And that is the point of this rant: You have expert knowledge in a very specific area and you have a very specific set of skills. I think you should apply those skills to as many problems as possible. From my experience that helps a lot. We have a Physical Security organization that employs many former military and law enforcement professionals and they have a very deep understanding of physical security but — like all of us — they are wired a certain way. Their focus is to make things safer by preventing, detecting, and investigating incidents. Of course, they know about all the other ways to approach security, but they think differently about some things. So for both of us, it is great to try to apply our tools and knowledge to each other’s problems. I can talk to them about how I would break their security measures and they can share how they would prevent me from getting in. Both of us will grow from this exchange. And eventually, it helps us to stop treating every problem like a nail. Only because I thought like a hammer about their problems and they thought like a big roll of duct tape about mine. For example: What to do after banging? Don’t forget to verify and prioritize your ideas. This is probably the least fun part, but your organization probably works with limited resources like time and money (if not, let me know, I would love to send my CV). So it might be a great idea when the Red Team (a team that legally attacks an organization, to test defenses) and Cyber Threat Intelligence (CTI) teams talk about how cool threat intelligence-based Red Teaming would be. But consider your organization’s security posture. Imagine the Blue Team (the team defending an organization) is just working on implementing defenses against the most common (common techniques used by attackers) and users just had their very first phishing training. Of course, you can let two CTI analysts spend 2 weeks to find the most relevant (Advanced Persistent Threats, large, government-funded attacker groups) and afterwards, the Red Team owns the entire network with a highly targeted spear phishing campaign followed by amazing evasion and lateral movement techniques. TTPs APTs Your Blue Team has not really learned new stuff, because they already knew these gaps existed and therefore no defenses really improved. So it would have been better to run a Purple Team to see how the newly implemented defenses are holding up. The CTI analysts could have worked on prioritizing the TTPs the Blue Team should work on mitigating in the next cycle. So yeah, great ideas always need at least a decent timing to be real great ideas. Conclusion What I am NOT saying: Everyone should only do their stuff and not care about others. You should force your ideas and perspectives on others. You know the only right way to do stuff. What I am saying: You should share your expertise with others. You should try to apply your knowledge to a wide range of problems. You should learn from others and help others grow. What if I am wrong? Well, I had fun writing this article, if you think it was really bad and stupid, I have only one thing to say: “Sucks to be you.”. In all seriousness tho, this is only my perspective, informed by my own biases and experience. So by all means, if you think I got stuff wrong, let me know. I would love to hear other people’s take on this. You can tell me how wrong I am in the comments or on Twitter (sorry X) @Secbyaccident (or follow me, if you like my stuff). Also published . here

BLUE SECURITY

bluesecurity.co.za

51-200 employees

Since 2004

COMPANY RANKING

BLUE SECURITY

EVERGREEN INDEX #2489

Representing this company? Click here to claim and customize this page!

Blue Security WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

BLUE SECURITY

bluesecurity.co.za

51-200 employees

Since 2004

COMPANY RANKING

BLUE SECURITY

EVERGREEN INDEX #2489

RELATED COMPANIESRANK

STORIES ABOUT BLUE SECURITY

Representing this company? Click here to claim and customize this page!

Blue Security WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!