Author: Jamez

Sherlock Holmes

Windows Security Events For SOC – Part 2

Here is the continuation of the list of Windows Security Events for SOC.

Windows Security Events for SOC
Windows Security Events for SOC

 

 

 

 

 

 

Note that event ID 1116 is one of the most critical events and is logged by Microsoft Defender Antivirus/compatible antivirus whenever a malware or other potentially unwanted software is detected on a system.

Key Details:
Source: Microsoft-Windows-Defender and Other Antivirus products as well
Event ID: 1116
Task Category: Malware Protection
Level: Information

What it Means: The antimalware platform has successfully identified a potential malware or other malicious content.
Potential Threat: The detected software poses a risk to your system’s security.

The SOC team and Security Operations team can initiate the investigation to dive deeper and validate cleaning, source of infection and other corrective measures needed.

What is PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is a widely accepted set of policies and procedures designed to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information. PCI DSS was created in 2004 by five major credit card companies: Visa, Mastercard, Discover, JCB and American Express.

The primary goal of PCI DSS is to safeguard and optimize the security of sensitive cardholder data, such as credit card numbers, expiration dates and security codes. The standard’s security controls help businesses minimize the risk of data breaches, fraud and identity theft.

The 12 Requirements of PCI DSS

The PCI Security Standards Council (PCI SSC) has established 12 specific requirements that organizations must meet to be PCI DSS-compliant:

1. Install and maintain a firewall configuration to protect cardholder data.
2. Do not use vendor-supplied defaults for system passwords and other security parameters.
3. Protect stored cardholder data.
4. Encrypt transmission of cardholder data across open, public networks.
5. Protect all systems against malware and regularly update anti-virus software or programs.
6. Develop and maintain secure systems and applications.
7. Restrict access to cardholder data by business need-to-know.
8. Identify and authenticate access to system components.
9. Restrict physical access to cardholder data.
10. Track and monitor all access to network resources and cardholder data.
11. Regularly test security systems and processes.
12. Maintain a policy that addresses information security for all personnel.

NIST Cybersecurity Framework

National Institute of Standards and Technology Cybersecurity Framework, also commonly called as NIST Cybersecurity Framework or NIST CSF, is a comprehensive set of cybersecurity guidelines designed to help organizations manage and reduce their cyber risks. Originally released in 2014, the framework has recently undergone a significant update, with the introduction of CSF 2.0 on February 26, 2024. This update reflects the evolving cyber threat landscape and incorporates feedback from hundreds of cyber specialists, enhancing its applicability across various sectors and organizational sizes.

NIST CSF 2.0 includes 107 controls organized into 22 categories, the earlier version NIST CSF 1.1, had 108 controls across 23 categories. The restructuring in CSF 2.0 involved the removal and realignment of several controls to better address contemporary cybersecurity landscape, including the introduction of new categories such as supply chain risk management.

Importance of the Framework

The NIST CSF is particularly valuable for organizations looking to establish a robust cybersecurity posture. It offers a flexible approach, allowing organizations to adapt the framework to their unique circumstances without prescribing specific outcomes or methods. This adaptability makes it a widely accepted standard across various industries, from small businesses to large corporations and government entities.

Key Components of NIST CSF 2.0

The CSF is structured around three main components:

1. Core:

This is the foundational element of the framework, outlining desired cybersecurity outcomes through five key functions:
Identify: Understand and manage the assets and risks.
Protect: Implement safeguards to ensure critical infrastructure security.
Detect: Establish activities to identify cybersecurity events.
Respond: Outline actions to take when a cybersecurity event occurs.
Recover: Develop plans to restore services after an incident.

2. Profiles:

These are predefined framework sets tailored to an organization’s specific needs, helping to align cybersecurity activities with business objectives and risk tolerance. The profiling process involves scoping, gathering information, creating a summary of the current cybersecurity posture, and identifying gaps.

3. Implementation Tiers:

This component provides a qualitative measure of an organization’s cybersecurity risk management maturity, helping to assess the effectiveness of current practices and guide improvements. The four tiers, ranging from Partial (Tier 1) to Adaptive (Tier 4), evaluate the effectiveness and integration of cybersecurity risk management within the organization. Note that these tiers do not necessarily indicate maturity levels, but rather the degree of alignment with the framework’s principles.

#NIST

#NIST CSF 2.0

OWASP Top 10 Web Application Vulnerabilities: A Deep Dive

The Open Web Application Security Project (OWASP) is a non-profit foundation that focuses on improving the security of software applications. Every few years, OWASP releases a list of the top ten web application security risks. These vulnerabilities are commonly exploited by attackers to compromise web applications and steal sensitive data.

Let’s explore each of the OWASP Top 10 vulnerabilities in detail:

1. Injection:
Description: This occurs when untrusted data is inserted into a query, command, or expression.
Examples: SQL injection, command injection, and XPath injection.
Prevention: Input validation, parameterized queries, and prepared statements.

2. Broken Authentication:
Description: Weak authentication mechanisms can allow attackers to bypass authentication measures and gain unauthorized access.
Examples: Insecure direct object references, password storage vulnerabilities, and missing CSRF protection.
Prevention: Strong password hashing, multi-factor authentication, and proper session management.

3. Sensitive Data Exposure:
Description: Sensitive data, such as credit card numbers, passwords, or personal information, is exposed without proper protection.
Examples: Storing data in plain text, insecure transmission, and lack of encryption.
Prevention: Encryption, tokenization, and secure data storage.

4. XML External Entities (XXE):
Description: This occurs when a web application processes XML documents from untrusted sources, potentially leading to code execution or data disclosure.
Prevention: Disable external entity processing, validate XML input, and use a web application firewall (WAF).

5. Broken Access Control:
Description: This vulnerability occurs when an application fails to properly enforce access controls, allowing unauthorized users to access restricted resources.
Examples: Insecure direct object references, missing function-level authorization, and insufficient authorization checks.
Prevention: Proper role-based access control (RBAC), input validation, and authorization checks.

6. Security Misconfiguration:
Description: This occurs when an application or its components are not configured securely.
Examples: Default configurations, weak passwords, and outdated software.
Prevention: Regular security audits, configuration hardening, and timely updates.

7. Cross-Site Scripting (XSS):
Description: This occurs when malicious script is injected into a web application, allowing attackers to execute arbitrary code in the user’s browser.
Examples: Reflected XSS, stored XSS, and DOM-based XSS.
Prevention: Input validation, output encoding, and using a WAF.

8. Insecure Deserialization:
Description: This occurs when an application deserializes untrusted data, potentially leading to code execution or data theft.
Prevention: Input validation, secure deserialization libraries, and blacklisting unsafe classes.

9. Using Components with Known Vulnerabilities:
Description: This occurs when an application uses components with known security vulnerabilities.
Prevention: Regular vulnerability scanning, component updates, and secure software supply chain management.

10. Insufficient Logging & Monitoring:
Description: This occurs when an application lacks adequate logging and monitoring to detect and respond to security incidents.
Prevention: Comprehensive logging, security monitoring tools, and incident response plans.

As part of the cybersecurity roadmap, addressing these OWASP Top 10 vulnerabilities, can significantly improve the security posture of the organization and its web applications.

Most Common Cyber Attacks

Since the days of the launch of the first virus “Creeper” developed by Bob Thomas in 1971, the digital world has never been at rest. Cyber attacks have become increasingly sophisticated, utilizing advanced techniques such as artificial intelligence and machine learning to bypass traditional security measures, and the motives have evolved from fun to financial extortion and in extreme cases, can even put human lives in danger.
Here is a brief summary of the 15 most common cyber attacks that were prevalent in last two years:

  • Ransomware Attacks
  • Phishing attacks
  • Business Email Compromise (BEC)
  • Man-in-the-middle attacks
  • Denial of Service attacks
  • SQL injection attacks
  • Zero-day exploits
  • Session hijacking
  • Password attacks
  • Drive-by download attacks
  • Cross-site scripting (XSS) attacks
  • DNS spoofing
  • URL manipulation
  • Cryptojacking
  • Internet of Things (IoT) attacks

ISO27001 Standard

ISO/IEC 27001 is an internationally recognized standard for information security management systems (ISMS), created by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The standard was first published in 2005 and has undergone several revisions, with the latest version being ISO/IEC 27001:2022.

Purpose and Importance

The primary purpose of ISO 27001 is to provide a framework for organizations to establish, implement, maintain, and continually improve their information security management systems. It aims to help organizations protect their information assets, manage risks effectively, and comply with legal and regulatory requirements. By adhering to this standard, organizations can demonstrate their commitment to information security and enhance their resilience against cyber threats.

Key Features

  • Risk Management: ISO 27001 emphasizes a risk-based approach, requiring organizations to identify, assess, and treat information security risks tailored to their specific context.
  • Comprehensive Framework: The standard outlines requirements for documentation, management responsibility, internal audits, and continual improvement, ensuring a systematic approach to information security.
  • Certification: Organizations can seek third-party certification to verify compliance with ISO 27001, which is recognized globally as a mark of effective information security management.

ISO 27001 was developed in response to the growing need for organizations to manage information security risks in a structured manner with management ownership an increasingly digital world, making it a critical tool for businesses of all sizes and sectors.

Encryption – PCI DSS Requirements

Encryption helps keep our secrets safe offline and online. When you log in to a website or send an email, the browser or the email application uses encryption to protect information being sent out of your system. In simplest terms encryption converts every character in the information to a different character via employing some mathematical formula and converts the information into a non-readable format during transmission. The information can be read or converted back only by a person who knows the original formula. For example, the formula shift every character of the information into third character and replace x, y and z with a, b and c respectively. With this the word “Key” becomes “NHB” and NHB can only be read by a person who knows that each character needs to be moved back by 2 places.
Coming back, the PCI DSS standard mandates encryption for data at rest and data in motion to prevent disclosure of information to unauthorized parties and malicious actors who might be tapping into the communications. PCI Security Standards Council (PCI SSC) mandates strong cryptography to fulfill PCI DSS encryption requirements as per industry-tested algorithms, together with key lengths that offer a minimum of 112 bits of effective key strength along with key management best practices.

PCI SSC considers the following algorithms and standards as acceptable for fulfilling PCI DSS encryption requirements:

1. Advanced Encryption Standard (AES): AES with key lengths of 128, 192, and 256 bits is widely accepted and recommended for encrypting stored cardholder data. Considered the gold standard for symmetric-key encryption, AES offers robust security and is widely used industry wide as a de facto standard.

2. RSA: An acronym based on the names of its inventors – Ron Rivest, Adi Shamir, and Leonard Adleman, is a significant public-key encryption algorithm. It uses a pair of keys: a public key for encryption and a private key for decryption. The security of RSA relies on the difficulty of factoring large numbers. It’s widely used for secure communications, many cybersecurity systems, antivirus products and digital signatures. Common key sizes used in RSA encryption are 2048 bits and 4096 bits. These key lengths are generally considered secure for most applications, providing a high level of protection against brute force attacks.

3. TDES (Triple Data Encryption Algorithm): A symmetric-key encryption algorithm TDES, is a symmetric-key encryption algorithm that provides a higher level of security than its predecessor, DES. DES has 56bits key length but TDES uses three 56-bit DES keys and hence TDES with a key length of 168bits is significantly more resistant to brute force attacks compared to DES. TDES it is being gradually replaced by the more efficient AES algorithm. TDES is commonly used in legacy systems and applications that require a high level of security but cannot be easily upgraded to AES.

4. Transport Layer Security (TLS): TLS uses both symmetric and asymmetric keys and lengths of the keys varies depending on the specific algorithms and implementations used.

Asymmetric keys are used to establish the initial secure connection and exchange session keys. These keys are public and private key pairs, allowing for authentication and secure communication. 2048 bits or 4096 bits are recommended for asymmetric key algorithms like RSA or ECC.

Symmetric keys are used to encrypt and decrypt the actual data being transmitted. 128 bits or 256 bits are commonly used for symmetric key algorithms like AES. These keys are shorter and faster to use compared to asymmetric keys, making them more efficient for large amounts of data.

This combination of symmetric and asymmetric encryption provides a strong and efficient security mechanism for TLS.

5. Elliptic Curve Cryptography (ECC): ECC is a public-key cryptography system that offers similar security to RSA but with smaller key sizes, 192 bits, 256 bits, 384 bits, and 521 bits, making it more efficient for certain applications. ECC is widely used in various cryptographic applications, including digital signatures, key exchange, and encryption. It is particularly suitable for devices with limited computing power, such as smartphones and embedded systems.

6. Diffie-Hellman (D-H) is a key exchange protocol that allows two parties to establish a shared secret key over an insecure channel. D-H enables secure communication by allowing the parties to derive the shared key without exchanging it directly. The derived key can then be used for encryption and decryption of message. D-H uses 2048bits or longer keys and is widely used in various cryptographic protocols, including TLS and SSH, to provide secure communication over networks.

7. Digital Signature Algorithm (DSA) is a public-key cryptographic standard and is widely used digital signature algorithm used to verify the authenticity of a message or document. It uses a public-key cryptography system to generate a digital signature that is mathematically linked to the message. This signature can be verified using the corresponding public key, ensuring that the message has not been altered or tampered with – that is for message authentication, integrity, and non-repudiation. The signer’s private key is used to create the signature, while the corresponding public key is used for verification.

Additionally, PCI DSS emphasizes the importance of robust key management practices to ensure that encryption keys are securely generated, stored, and managed throughout their lifecycle. Without proper key management practices, even the strongest encryption mechanisms would fail.

Understanding Security Standards: A Comprehensive Guide

In today’s ever evolving cyber world, security standards are more critical than ever. They provide a framework for protecting sensitive information and ensuring the integrity of enterprise systems. This article delves into the key security standards you should be aware of and how they can benefit organizations across the world.

What Are Security Standards?

Security standards are established guidelines and specifications designed to ensure the safety and security of information systems. They help organizations protect data, manage risks, and comply with legal and regulatory requirements.

Key Security Standards

1. ISO/IEC 27001: This international standard provides a framework for an Information Security Management System (ISMS). It helps organizations manage the security of assets such as financial information, intellectual property, employee details, and information entrusted by third parties.

2. NIST Cybersecurity Framework: Developed by the National Institute of Standards and Technology, this framework provides a policy framework of computer security guidance for how private sector organizations in the US can assess and improve their ability to prevent, detect, and respond to cyber-attacks.

3. Payment Card Industry Data Security Standard (PCI DSS): The Payment Card Industry Data Security Standard is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment.

4. GDPR: The General Data Protection Regulation is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area. It also addresses the transfer of personal data outside the EU and EEA areas.

5. Committee of Sponsoring Organizations of the Treadway Commission (COSO): COSO Framework is a widely recognized framework for designing, implementing, and evaluating internal controls and guidelines for businesses to evaluate internal controls, risk management, and fraud deterrence. While the original aim was to contain the financial frauds, it has since evolved to cover broader aspects of organizational governance and risk management.

6. NERC CIP
North American Electric Reliability Corporation Critical Infrastructure Protection is a framework of 14 ratified and proposed standards that applies to utility companies within the bulk power system. The standards outline recommended controls and policies to monitor, regulate, manage and maintain the security of critical infrastructure systems.

CIP standards include the following:

CIP-004-6 Cyber Security — Personnel and Training.
CIP-008-6 Cyber Security — Incident Reporting and Response Planning.
CIP-013-1 Cyber Security — Supply Chain Risk Management.
CIP-014-1 Physical Security.
Bulk power system owners, operators and users must comply with the NERC CIP framework.

Benefits of Implementing Security Standards

  • Enhanced Security: Implementing security standards helps protect against data breaches and cyber attacks.
  • Compliance: Adhering to standards ensures compliance with legal and regulatory requirements.
  • Customer Trust: Demonstrating a commitment to security can enhance customer trust and confidence.
  • Risk Management: Standards provide a structured approach to identifying and managing risks.