Category: Uncategorized

10 Essential Tips for Securing Your Devices: A Practical Guide

In our Cyper-connected world, safeguarding laptops, smartphones, and other devices is no longer optional—it’s a necessity. Whether you’re an individual or part of an organization, these best practices will help fortify your digital defenses against cyber threats. Let’s dive in!

1. Strong Authentication: The First Line of Defense

  • Multi-Factor Authentication (MFA): This is one of the best layers to ward off hackers looking for easy preys. MFA are now a days free for most of your public email ID’s, banking accounts, and even your social media accounts and your mobile phone. Don’t leave any account without MFA enablement.
  • Rock-Solid Passwords: Mix it up! Use complex passwords with a blend of letters, numbers, and symbols. And please, no more “123456” or “password” or your pets name like “Blackie07” or your bike number PB10A3478

2. Keep Your Software Updated : its like your annual flu vaccine

  • Regular Updates: Treat your software like a houseplant—water it regularly (with updates) to keep it healthy. Updates fix most of the vulnerabilities and add extra layers of security.
  • Automate Updates: Set your software to auto-update. It’s like having a personal assistant who ensures your digital life stays bug-free.

3. Antivirus and Anti-Malware: Your Digital Security Guards 

  • Choose Reputed ones: Install reputable security software. These security guards are the ones that will scan for threats before they actually cause any ruckus with your systems and kick out any unwelcome viruses.
  • Scan and Rescan: Schedule regular scans jobs in your antivirus solutions. It’s like a health checkup for your device—catch any lurking malware before they really mess up your machine.

4. Encryption Is Your Shield

  • Full Disk Encryption: Full disk encryption will jumble up the files to an unrecognizable pattern when you switch off your system or your system is in lock state/sleep mode. Even if your system is stolen , it will be very very hard for the thief to suck the data out of your system.
  • Secure Communication: When chatting with your device, use encrypted channels (like VPNs). It’s like whispering secrets in a soundproof room.

5. Device Management: Keeping Tabs on Your Digital Fleet

  • Mobile Device Management (MDM): Think of it as a digital leash for your phone. MDM lets you track, manage, and even wipe your device remotely.
  • Endpoint Detection and Response (EDR): It’s like having a security guard who never sleeps. EDR monitors your device 24/7, ready to pounce on any threats.

6. Educate, Educate, Educate: You’re the First Line of Defense

  • Training Matters: Teach your team (and yourself) to spot phishing emails, dodge social engineering tricks, and stay one step ahead of cyber crooks.
  • Safe Habits: Remind everyone to avoid suspicious links, think twice before clicking, and report anything fishy. It’s like teaching your grandma to cross the digital street safely.

7. User Privileges: Less Is More

  • Principle of Least Privilege: Imagine your device as a VIP party. Only invite the necessary guests (users) and keep the velvet rope tight.
  • Permission Check: Regularly review who’s on the guest list. Adjust permissions as roles change. No freeloaders allowed!

8. Backup Like Your Digital Life Depends on It (Because It Does)

  • Automated Backups: Set it and forget it. Regular backups ensure your data survives even if disaster strikes.
  • Offsite Storage: Store backups offsite (like a digital Swiss bank). Cloud backups are your safety deposit box.

9. Log Everything: The Sherlock Holmes Approach

  • Log Monitoring: Think of logs as your digital detective’s notebook. Regularly check for suspicious activity—it’s like catching cyber culprits red-handed.
  • Security Audits: Conduct periodic audits. It’s like spring cleaning for your security measures—toss out the dust bunnies and tighten the bolts.

 

Event ID 4697 – Ransomware Related Event

As you know, Ransomware often attempts to gain persistence on a compromised system by modifying or creating system services. This allows the malware to automatically run on system startup or at regular intervals to encrypt files. The addition of the service will obviously trigger the Event ID 4697 and hence it is important for SOC team to set SIEM rules for this event. Microsoft also has specific recommendations for security monitoring (Read Here) which makes this event an important monitoring target.

Below are some ways ransomware can trigger Event ID 4697:

  • Creating a new malicious service to execute the ransomware payload
  • Modifying an existing legitimate service to run the ransomware instead of its normal functionality
  • Changing the binary path of a service to point to the ransomware executable

Detecting Ransomware via Event ID 4697

Mentioned below is the list of actions that Security analysts can take while reviewing the Event ID 4697 logs for any potential ransomware activity:

  • Look for service installations with unusual binary paths, like those in the %APPDATA% folder, ransomware groups typically add new services under %APPDATA% folder as no admin rights are needed.
  • Monitor for services with suspicious names or descriptions that don’t match legitimate Windows services.
  • Check if the service is configured to automatically start, which is common for ransomware persistence
  • Identify services running under user accounts rather than the standard LocalSystem, LocalService or NetworkService accounts

Analysts can use free tools like

Note that Event ID 4697 alone does not pinpoint towards a ransomware attack, SOC team needs to correlate this with other suspicious events like process creations, network connections, and file changes to arrive at a conclusion.

Windows Security Events For SOC – Part 2

Here is the continuation of the list of Windows Security Events for SOC.

Windows Security Events for SOC
Windows Security Events for SOC

 

 

 

 

 

 

Note that event ID 1116 is one of the most critical events and is logged by Microsoft Defender Antivirus/compatible antivirus whenever a malware or other potentially unwanted software is detected on a system.

Key Details:
Source: Microsoft-Windows-Defender and Other Antivirus products as well
Event ID: 1116
Task Category: Malware Protection
Level: Information

What it Means: The antimalware platform has successfully identified a potential malware or other malicious content.
Potential Threat: The detected software poses a risk to your system’s security.

The SOC team and Security Operations team can initiate the investigation to dive deeper and validate cleaning, source of infection and other corrective measures needed.

What is PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is a widely accepted set of policies and procedures designed to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information. PCI DSS was created in 2004 by five major credit card companies: Visa, Mastercard, Discover, JCB and American Express.

The primary goal of PCI DSS is to safeguard and optimize the security of sensitive cardholder data, such as credit card numbers, expiration dates and security codes. The standard’s security controls help businesses minimize the risk of data breaches, fraud and identity theft.

The 12 Requirements of PCI DSS

The PCI Security Standards Council (PCI SSC) has established 12 specific requirements that organizations must meet to be PCI DSS-compliant:

1. Install and maintain a firewall configuration to protect cardholder data.
2. Do not use vendor-supplied defaults for system passwords and other security parameters.
3. Protect stored cardholder data.
4. Encrypt transmission of cardholder data across open, public networks.
5. Protect all systems against malware and regularly update anti-virus software or programs.
6. Develop and maintain secure systems and applications.
7. Restrict access to cardholder data by business need-to-know.
8. Identify and authenticate access to system components.
9. Restrict physical access to cardholder data.
10. Track and monitor all access to network resources and cardholder data.
11. Regularly test security systems and processes.
12. Maintain a policy that addresses information security for all personnel.

NIST Cybersecurity Framework

National Institute of Standards and Technology Cybersecurity Framework, also commonly called as NIST Cybersecurity Framework or NIST CSF, is a comprehensive set of cybersecurity guidelines designed to help organizations manage and reduce their cyber risks. Originally released in 2014, the framework has recently undergone a significant update, with the introduction of CSF 2.0 on February 26, 2024. This update reflects the evolving cyber threat landscape and incorporates feedback from hundreds of cyber specialists, enhancing its applicability across various sectors and organizational sizes.

NIST CSF 2.0 includes 107 controls organized into 22 categories, the earlier version NIST CSF 1.1, had 108 controls across 23 categories. The restructuring in CSF 2.0 involved the removal and realignment of several controls to better address contemporary cybersecurity landscape, including the introduction of new categories such as supply chain risk management.

Importance of the Framework

The NIST CSF is particularly valuable for organizations looking to establish a robust cybersecurity posture. It offers a flexible approach, allowing organizations to adapt the framework to their unique circumstances without prescribing specific outcomes or methods. This adaptability makes it a widely accepted standard across various industries, from small businesses to large corporations and government entities.

Key Components of NIST CSF 2.0

The CSF is structured around three main components:

1. Core:

This is the foundational element of the framework, outlining desired cybersecurity outcomes through five key functions:
Identify: Understand and manage the assets and risks.
Protect: Implement safeguards to ensure critical infrastructure security.
Detect: Establish activities to identify cybersecurity events.
Respond: Outline actions to take when a cybersecurity event occurs.
Recover: Develop plans to restore services after an incident.

2. Profiles:

These are predefined framework sets tailored to an organization’s specific needs, helping to align cybersecurity activities with business objectives and risk tolerance. The profiling process involves scoping, gathering information, creating a summary of the current cybersecurity posture, and identifying gaps.

3. Implementation Tiers:

This component provides a qualitative measure of an organization’s cybersecurity risk management maturity, helping to assess the effectiveness of current practices and guide improvements. The four tiers, ranging from Partial (Tier 1) to Adaptive (Tier 4), evaluate the effectiveness and integration of cybersecurity risk management within the organization. Note that these tiers do not necessarily indicate maturity levels, but rather the degree of alignment with the framework’s principles.

#NIST

#NIST CSF 2.0

Windows Security Events For SOC – Part 3

Event monitoring plays a crucial role in determining whether the 5 pillars of Cybersecurity – confidentiality, integrity, availability, authenticity, and non-repudiation are intact or not. Events enablement, capturing and safe storage is another aspect which we will discuss later however in any enterprise and particularly for the ones that have regulatory requirements, feeding the events to a SIEM solution and setting the rules basis deviation would only provide useful actionable information. If rules are not defined properly, finding a relevant and actionable security event is like finding a needle in haystack. Continuing from the previous two articles in this series, this is the third one in line to help the Blue Teams and SOC to determine how they want to set the rules in their log monitoring environments.

Windows Security Events For SOC and Blue Teams
Windows Security Events For SOC and Blue Teams

Event ID 4697 is commonly triggered in Ransomware Attacks, and I have written another dedicated blog here <Click to Read>.

 

#Ransomware Attacks

#SOC Monitoring

New Security Controls in ISO 27001:2022

The latest version of ISO 27001 was released on October 25, 2022, superseding the nine-year-old ISO 27001:2013. Designated as ISO 27001:2022, it has introduced 11 new security controls within its revised framework. However, the total number of controls has decreased from 114 to 93 due to the consolidation of some controls. Additionally, the former 14 control categories have been reorganized into four principal themes: Organizational, People, Physical, and Technological, offering greater alignment with the NIST CSF.

From a high-level understanding, below is the summary of the controls available under each theme of the new standard:

1. Organizational Controls
Number of controls: 37
Control numbers: ISO 27001 Annex A 5.1 to 5.37
Focus: These controls address the overall governance and management of information security within an organization, including policies, processes, and procedures that dictate the organization’s approach to regulations and data protection.

2. People Controls
Number of controls: 8
Control numbers: ISO 27001 Annex A 6.1 to 6.8
Focus: This theme encompasses controls related to human resources and personnel security, defining how employees interact with information and each other to maintain security.

3. Physical Controls
Number of controls: 14
Control numbers: ISO 27001 Annex A 7.1 to 7.13
Focus: Physical controls are designed to protect tangible assets and ensure the security of facilities, including access controls, environmental safeguards, and asset disposal processes. Such safeguards are essential for the preservation of confidential information.

4. Technological Controls
Number of controls: 34
Control numbers: ISO 27001 Annex A 8.1 to 8.34
Focus: This theme includes controls related to the technological aspects of information security, such as data protection measures, secure coding practices, and incident response protocols. Technological constraints help organizations establish a secure, compliant IT infrastructure, encompassing everything from authentication methods to configurations, backup and disaster recovery (BUDR) strategies, and information logging.

OWASP Top 10 Web Application Vulnerabilities: A Deep Dive

The Open Web Application Security Project (OWASP) is a non-profit foundation that focuses on improving the security of software applications. Every few years, OWASP releases a list of the top ten web application security risks. These vulnerabilities are commonly exploited by attackers to compromise web applications and steal sensitive data.

Let’s explore each of the OWASP Top 10 vulnerabilities in detail:

1. Injection:
Description: This occurs when untrusted data is inserted into a query, command, or expression.
Examples: SQL injection, command injection, and XPath injection.
Prevention: Input validation, parameterized queries, and prepared statements.

2. Broken Authentication:
Description: Weak authentication mechanisms can allow attackers to bypass authentication measures and gain unauthorized access.
Examples: Insecure direct object references, password storage vulnerabilities, and missing CSRF protection.
Prevention: Strong password hashing, multi-factor authentication, and proper session management.

3. Sensitive Data Exposure:
Description: Sensitive data, such as credit card numbers, passwords, or personal information, is exposed without proper protection.
Examples: Storing data in plain text, insecure transmission, and lack of encryption.
Prevention: Encryption, tokenization, and secure data storage.

4. XML External Entities (XXE):
Description: This occurs when a web application processes XML documents from untrusted sources, potentially leading to code execution or data disclosure.
Prevention: Disable external entity processing, validate XML input, and use a web application firewall (WAF).

5. Broken Access Control:
Description: This vulnerability occurs when an application fails to properly enforce access controls, allowing unauthorized users to access restricted resources.
Examples: Insecure direct object references, missing function-level authorization, and insufficient authorization checks.
Prevention: Proper role-based access control (RBAC), input validation, and authorization checks.

6. Security Misconfiguration:
Description: This occurs when an application or its components are not configured securely.
Examples: Default configurations, weak passwords, and outdated software.
Prevention: Regular security audits, configuration hardening, and timely updates.

7. Cross-Site Scripting (XSS):
Description: This occurs when malicious script is injected into a web application, allowing attackers to execute arbitrary code in the user’s browser.
Examples: Reflected XSS, stored XSS, and DOM-based XSS.
Prevention: Input validation, output encoding, and using a WAF.

8. Insecure Deserialization:
Description: This occurs when an application deserializes untrusted data, potentially leading to code execution or data theft.
Prevention: Input validation, secure deserialization libraries, and blacklisting unsafe classes.

9. Using Components with Known Vulnerabilities:
Description: This occurs when an application uses components with known security vulnerabilities.
Prevention: Regular vulnerability scanning, component updates, and secure software supply chain management.

10. Insufficient Logging & Monitoring:
Description: This occurs when an application lacks adequate logging and monitoring to detect and respond to security incidents.
Prevention: Comprehensive logging, security monitoring tools, and incident response plans.

As part of the cybersecurity roadmap, addressing these OWASP Top 10 vulnerabilities, can significantly improve the security posture of the organization and its web applications.

Most Common Cyber Attacks

Since the days of the launch of the first virus “Creeper” developed by Bob Thomas in 1971, the digital world has never been at rest. Cyber attacks have become increasingly sophisticated, utilizing advanced techniques such as artificial intelligence and machine learning to bypass traditional security measures, and the motives have evolved from fun to financial extortion and in extreme cases, can even put human lives in danger.
Here is a brief summary of the 15 most common cyber attacks that were prevalent in last two years:

  • Ransomware Attacks
  • Phishing attacks
  • Business Email Compromise (BEC)
  • Man-in-the-middle attacks
  • Denial of Service attacks
  • SQL injection attacks
  • Zero-day exploits
  • Session hijacking
  • Password attacks
  • Drive-by download attacks
  • Cross-site scripting (XSS) attacks
  • DNS spoofing
  • URL manipulation
  • Cryptojacking
  • Internet of Things (IoT) attacks