What are the key takeaways from recent security breaches?

Know your critical systems or business functions and their systems. One time I worked at an SMB-sized insurance organization where we had a dedicate Business Continuity Professional. She asked the entire company who thought their department was the #1 most crucial function to the organization. Finance raised their hands, IT support, even Information Security. We were all wrong. She said if we got hit with a natural disaster or breach tomorrow her first job is to bring Claims back online, because if people can't get paid we're not doing our jobs. Suddenly, the claims system and its vulnerabilities, of all things, became my department's priority to secure.

If you don't know your assets and risks, a Red Team will definititely discover them for you. Things that we often see that lead to breaches or make them worse * forgotten subdomains, running web apps that are not maintained/pentested * dependencies that are not updated for years * poor security architecture, critical business applications running on the same server with non-critical business apps The discussion of "identifying your assets" is nothing new, it's been going in the industry for at least 2 decades, maybe more and with Cloud setups becoming more popular in the past few years it only got more complicated. The so called "attack surface management tools" became popular recently but it's hard to say what is hype and what it's not.

Destaco a crescente sofisticação dos ataques cibernéticos, evidenciando a importância da preparação e resiliência organizacional. Aumentou a ênfase na proteção de dados sensíveis, exigindo abordagens proativas para identificação e mitigação de vulnerabilidades. A colaboração entre setores público e privado torna-se crucial para enfrentar ameaças complexas. Além disso, a conscientização sobre a segurança cibernética e a implementação rigorosa de boas práticas são essenciais para fortalecer as defesas contra ameaças persistentes.

It has become common knowledge that we encounter reports of massive cyber attacks almost on a daily basis. The escalating sophistication of these cyber attacks not only makes them more widespread but also leads to their proliferation. At this juncture, the crucial question arises: What steps should be taken if an attack occurs? In simpler terms, the significance of institutional preparedness and resilience is on the rise. It is imperative to be aware of the attack surface, monitor digital assets, and understand their behavior. Furthermore, assessing our preparedness in the event of an attack or data breach emerges as the most critical concern for us. How swiftly can we respond? Are our logs prepared for intervention in case of an attack?

Key is to cover your basics first. The biggest breach in 2023 was a sql injection! Patch your systems. Take vendor recommendations seriously! Restrict your attack surface. Don't expose IOT Systems to public unless there is a necessity!

It's true we say information security will always have jobs because people don't want to do the basics. In this line of work I bring forth the Center for Internet Security (CIS) first 20 controls. The first 6 include Software and Hardware Assets, Identity and Access Management, Change Management, Patch Management, and Asset Management. If a basic assessment proves those things aren't being done well and documented, then I don't care how good your MFA or encryption levels are- you are vulnerable to something I can exploit with tools as easy to use as Metasploit. Baseline and benchmarks first, then look at more graduated solutions and defense-in-depth layers.

We have an exquisite list of organizations temporarily losing control over their X (Twitter) Accounts in January. Main reason? Not implementing MFA authentication. What can we learn from this? 1. We need clarity on who is responsible for making sure the social media accounts are secured (Social Media managers? Infosec teams?) 2. We need to make sure the basics are in place. We tend to focus on sophisticated security measures but lose sight of the basics.

Recent cybersecurity breaches teach a critical lesson: Never underestimate the basics. Strong passwords and multi-factor authentication (MFA) are more than just IT protocols; they're shields against the most common cyber threats. Timely software updates are equally crucial. They're not just routine maintenance; they're critical defenses against known vulnerabilities. Network security, encompassing firewalls and regular monitoring, forms another fundamental layer of defense. It's not just about technology; it’s about vigilance. Lastly, educating employees on recognizing phishing attempts and practicing safe internet habits is key. In today's digital landscape, informed staff are your first line of defense.

Ensure that fundamental security measures are in place, such as strong authentication mechanisms, regular software updates, and secure configurations. Follow best practices for network security, including firewalls, intrusion detection systems, and encryption. Train employees on security awareness and enforce policies related to data protection.

Recent security breaches underscore the importance of implementing fundamental security best practices. Strong passwords, encryption, regular patching, multi-factor authentication, data backups, and user education are crucial. The Colonial Pipeline ransomware attack exposed vulnerabilities in remote access due to a weak password and lack of multi-factor authentication, leading to data encryption and a ransom demand. Emphasizing these basics enhances overall security and mitigates potential breaches.

Plans are nothing, planning is everything. That quote encapsulates the importance of the act of planning over just having a plan. Having a well defined incident response team, process, and set of playbooks is the key to minimizing the damage and ensuring success when a real incident occurs. In addition to having these items well thought out, they must be regularly practiced. This helps to build the internal muscle memory and gives your team the ability to work through challenges together, in a safe space. Having all this in place could reduce the impact of a cybersecurity incident by several orders of magnitude!

1. Learning from last mistake 2. Continuous assessment & improvement of security posture 3. Attacks Surface Management 4. Thinking beyond just compliance 5. Employee security awareness 6. Enabling thought processes across organisation 7.Setting up Security incident response Task Force ( & readiness) 8. Time to time Review of readiness ( BAS) 9. Monitoring of last 3-6 months tends to attack attempts & future planning 10. Strategic discussions and implementation of Future sophisticated attacks preparation 11. AI based security solutions review & testing 12. Supply chain attack reviews 13. Cloud security assessment 14. Endpoint security reviews 15. Firewalls reviews , upgrade 16. Zero day attacks readiness 17. Vulnerability assessment & more

I always go back to Dr. Eric Cole quote: Prevention is ideal but detection is a must. Have a plan - IR plan. Have processes. Enable monitoring and have it feed to somewhere that's monitored continuously. Use automation. Feed to systems and shared mailboxes as people sleep and don't scale well. As you have a plan, test it. Update it as things never go as planned. Test it again. Update it again. Repeat this process. Your team will get better as will the plans. Then when something happens your execs will appreciate what you did as they realize why you did it. Bring in skilled red teamers. See if your tools & people catch their activity. If not, find out why. Fix it. Try again. Repeat until you detect & respond quickly. Keep learning.

There is an article at https://www.wired.com/story/the-untold-story-of-solarwinds-the-boldest-supply-chain-hack-ever/ that presents the forensic analysis and incident response timeline of the SolarWinds hack. This article includes lessons in terms of Detect and Respond processes. This cyber attack had far-reaching consequences, impacting multiple federal agencies and tech/security firms. At this point, I am quoting a few excerpts from the article: 'She looked closely at the phone's activity logs and saw another strange detail.' Additionally, below are two quotes from the OWASP Top 10 Risks: "Without logging and monitoring, breaches cannot be detected." "Logging and monitoring give us an opportunity to stop the attacker in their tracks

Communication is vital. Preventing an incident is very difficult, especially when you are up against a determined threat actor. There are so many things that are out of your control. But what you can control is how you respond to your employees, customers, regulators, and the public. You can diffuse much of the potential reputational damage and avoid panic. Prepare and practice your response so that when the time comes, you can put your plan into action swiftly.

It starts with people, fostering an open culture that embraces acknowledging mistakes has a significant impact on whether we can enhance the overall security of our environment. Admitting errors may not always be easy, but it not only enhances IT security but also contributes to personal growth. Ultimately, at the end of the day, the difference lies in whether or not you clicked on that link.

We will learn and improve from cyber incidents like the SolarWinds breach, the Stuxnet Worm Attack, the 2017 Verizon Communications Data Breach, and the 2019 Dominion National Data Breach. These incidents serve as stark reminders of the risks that materialize in the absence of stringent cybersecurity practices. To further emphasize the importance of these practices, we have expanded our scope by referencing established risk lists from reputable sources such as OWASP and MITRE. Aligning with industry-recognized risks lends credibility to our approach and underscores the universality of the challenges we address.

Cybersecurity breaches are not just challenges; they are opportunities for growth. The incidents we've seen highlight the necessity of a mindset focused on continuous learning and improvement. The key is in thorough analysis. Each breach offers unique insights into system vulnerabilities and attacker tactics. By understanding the specifics of each incident, organizations can tailor their defenses more effectively. Improvement follows analysis. It's about adapting strategies, upgrading technologies, and refining protocols. Also, Sharing insights and strategies with the broader cybersecurity community is essential. Collective wisdom not only fortifies individual organizations but also strengthens the overall cybersecurity landscape.

Recent security breaches highlight the importance of learning and improving. Conduct root cause analysis and lessons learned reviews after incidents to identify gaps, weaknesses, and improvement opportunities. Implement recommendations and corrective actions, measuring their effectiveness. In the Equifax breach, a failure to patch a known vulnerability had severe consequences. The incident necessitated a revamp of security culture and practices. Embracing a continuous improvement mindset is crucial to enhancing security posture and preventing future breaches.

For individuals, the human element remains a key vulnerability. Phishing attacks and social engineering tactics continue to be successful, emphasizing the need for vigilant skepticism and robust password hygiene. Organizations, meanwhile, must prioritize a layered defense. Modernizing outdated systems, implementing zero-trust security models, and investing in employee security awareness training are crucial. Proactive monitoring and incident response are paramount. Swift detection and containment minimize damage and prevent further breaches. Finally, transparency and communication are essential. Openly acknowledging breaches and communicating effectively with impacted individuals rebuilds trust and demonstrates commitment to improvement

Effective testing should not be an afterthought; it's a critical part of the security posture. You don't want a breach to be the first real test of your incident response plan. Similarly, critical systems, including those used by top executives like the CEO, should not be off-limits for testing. Often, there's a hesitation to test high-impact systems, but if these areas are potential targets in a breach, they must be included in regular testing. Empower red teamers to test all people, processes, and technology. If it's a potential target for attackers, it should be within the scope of your security testing. Allowing comprehensive testing across all systems ensures vulnerabilities are found and fixed before they're exploited.

This includes ongoing training, awareness programs and strategies to adapt to evolving cyber threats. Enforcing cybersecurity policies and implementing testing procedures are critical steps in strengthening online security. It is essential to adhere to good practices defined by recognized systems such as MITRE or SANS. Furthermore, it is important to emphasize that cybersecurity is a transformative process, not just a tool. It's important to stay current on emerging threats, changing technologies, and industry best practices.

Gerade kleinere Unternehmen haben in der Regel nicht die Ressourcen die Informationssicherheit selbst aufzubauen und entsprechende Stellen zu besetzen. Daher lohnt es sich für solche Unternehmen immer das Herbeiziehen von externen Spezialisten die massgeschneidert auf die Bedürfnisse des Unternehmens einen Plan entwickeln und bei Bedarf auch mit dem Unternehmen zusammen umsetzen. Die Unternehmen werden dabei befähigt die Themen selbst umzusetzen und anschliessend auch zu verwalten. Misstritte oder Fehlüberlegungen werden dabei vermieden und das Unternehmen kommt viel schneller ans Ziel. Falsch gespart, kostet im Nachhinein immer mehr.

Relative to your threat... 4Ds DETER as much of your attackers as possible. Good configuration, sensible use of social media etc. will make an attacker skip right passed you. DETECT as many attacks as you can, as early as you can. Push that detection threshold right to your perimeter. DELAY the attack as much as possible to buy you time. Harden everything, don't just rely on a strong perimeter. Make the attacker fight for every device, and every packet of information. DESTROY every trace of the attack, every tool, every file, every reference. Collect everything, and preserve forensic records. Prosecute where you can. Make sure that once they are gone, they can't come back.

Enforce the post-mortem analysis on all incidents detected, regardless of the classification or priority. This way, you will be able to assess all gaps based on the incidents and implement the improvements necessary. Once changes are performed in your plan, test it but do not use known incidents for that. Try to use variances and work with scenarios that would possibly cover additional gaps that were not explored yet.