12 Threat Modelling Techniques

https://insights.sei.cmu.edu/sei_blog/2018/12/threat-modeling-12-available-methods.html

Zero Trust

https://www.ncsc.gov.uk/blog-post/zero-trust-architecture-design-principles

We the Sales Engineers

Interesting website / podcast etc. aimed specifically at sales engineers.

https://wethesalesengineers.com

OWASP Cyber Defence Matrix

https://www.owasp.org/index.php/OWASP_Cyber_Defense_Matrix

Open Source SOC Tools

https://information.rapid7.com/rs/411-NAK-970/images/building-powerful-security-arsenal.pdf

Tools to Implement SANS Top 20

A few years out of date, but very cool paper.

https://www.alienvault.com/blogs/security-essentials/free-and-commercial-tools-to-implement-the-sans-top-20-security-controls-part-1/

NIST standards

800-30 - Guide for Conducing Risk Assessments
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf

800-37: Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final


800-39 - Managing Information Security Risk: Organization, Mission, and Information System View
https://csrc.nist.gov/publications/detail/sp/800-39/final

800-53 - Security and Privacy Controls for Information Systems and Organizations
https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/draft


800-154 - Guide to Data-Centric System Threat Modeling

https://csrc.nist.gov/publications/detail/sp/800-154/draft

800-115 - Penetration Testing

800-60: Volume 1: Guide for Mapping Types of Information and Information Systems to Security Categories

https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v1r1.pdf

NIST SP 800-53A,Guide for Assessing the Security

Controls in Federal Information Systems

MITRE ATT&CK Framework

Good overview by Varonis:
https://www.varonis.com/blog/mitre-attck-framework-complete-guide/

Information Commissioner's Office (ICO) Guide to GDPR

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/security/

NIST Cyber Threat Modelling

https://www.mitre.org/sites/default/files/publications/pr_18-1174-ngci-cyber-threat-modeling.pdf

ISACA State of Cybersecurity 2019 report

https://www.isaca.org/info/state-of-cybersecurity-2019/index.html

Microsoft STRIDE

This is a useful blog post for threat modelling.

https://www.microsoft.com/security/blog/2007/09/11/stride-chart/

IBM Buyer's Guide to MSSP

https://www.ibm.com/downloads/cas/KPEG6J8Q?cm_mc_uid=25953344701415679350681&cm_mc_sid_50200000=46230891567935068106

NIST 800-82 Industrial Control Systems

NIST 800-82:

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf

NIST Cyber Security Framework

Good 2019 paper on the NIST CSF:

https://www.oas.org/en/sms/cicte/docs/OAS-AWS-NIST-Cybersecurity-Framework(CSF)-ENG.pdf

The US identified 16 critical infrastructure sectors: Chemical; Commercial Facilities; Communications; Critical Manufacturing; Dams; Defense Industrial Base; Emergency Services; Energy; Financial Services; Food and Agriculture; Government Facilities; Healthcare and Public Health; Information Technology; Nuclear Reactors, Materials, and Waste; Transportation Systems; and Water and Wastewater Systems.

MITRE ATT&CK

High level overview of the MITRE ATT&CK model by Exabeam.
https://www.exabeam.com/information-security/what-is-mitre-attck-an-explainer/

SSL Inspection

The following gives a very good overview of the pros and cons of SSL inspection. Some I hadn't thought about.

https://www.helpnetsecurity.com/2017/03/08/https-interception-dilemma/


Good document from Symantec describing certificate pinning:

https://www.symantec.com/content/dam/symantec/docs/white-papers/certificate-pinning-en.pdf

Colbalt Strike Vulnerability used against the Hackers

https://hackercombat.com/vulnerability-helps-researchers-expose-malware-cc-servers/

Malware impersonates Google reCAPTCHA and undermines SMS 2FA

https://hackercombat.com/malicious-recaptcha-pretending-to-be-from-google-creates-chaos/

About Azure AD

Brief overview of Azure AD by JumpCloud:

https://jumpcloud.com/blog/breakdown-azure-ad/

Russia prepares to disconnect its Internet

In December 2018, Russia passed a law mandating that ISPs must be able to disconnect the Russian Internet space (Runet) from the rest of the Internet, in case of foreign aggression. They also mandated that ISPs forward traffic to the Russia's telecoms watchdog for inspection.

The apparent preparations by countries such as Russia and China for cyberwar are concerning. Russia, China, Iran and North Korea, amongst others, can easily cut themselves from the rest of the global Internet to protect themselves. Western countries, such as the US and UK, are far less able to do this.

https://www.zdnet.com/article/russia-to-disconnect-from-the-internet-as-part-of-a-planned-test/

Compromising DNS to perform man-in-the-middle attack

https://securityboulevard.com/2019/01/cyber-hijacking-campaign-sets-off-global-government-alarm-bells/

Japan passes law to hack citizen's IoT devices

An interesting development, Japan has passed a law so government employees can attempt to hack citizen's IoT devices, with a view to preventing attacks prior to the 2020 olympics.

https://www.zdnet.com/article/japanese-government-plans-to-hack-into-citizens-iot-devices

Vulnerable Cisco routers

A recent The Register article describes some security flaws in the Cisco RV320 WAN routers.

https://www.theregister.co.uk/2019/01/26/security_roundup_250119/

Recently I've been asked, by customers, about running devices in their network that are now end of life and no longer supported by the vendor. Although these RV320 routers are not obsolete and security patches are therefore available, this is the sort of vulnerability that could cause a major problem if security patches are not available. I would therefore recommend that only vendor supportable infrastructure is deployed in a network, even if the devices only appear to be basic devices, such as a switch.

Do SIM Swap Attacks make 2FA useless?

Interesting Wired article on SIM swaps. Allegedly, an attacker convinced AT&T to forward a cryptocurrency victim's calls to the attacker's SIM. They're now seeking over $200 million in damaged.

https://www.wired.com/story/sim-swap-attack-defend-phone/

However, my interest in SIM swaps was due to some of the recent discussions about why 2FA using SMS messages is pointless, as a SIM swap attack allows an attacker to circumvent the control. Although this is obviously possible, it still takes considerable effort on the part of the attacker and it's therefore only likely to be used in a targeted attack. For protecting accounts from opportunistic attacks, I think this still remains a very viable option. An authentication app, like Google or Microsoft Authenticator, would obviously be much better.

Sizing a Next-Gen Firewall

Good article by Andres Herrera of Fortinet. Applies to all vendors.

https://securityboulevard.com/2019/01/next-gen-firewall-sizing-5-things-to-look-for/

Cyber Sackings, Demotions and Fines at SingHealth

Further to my earlier post, employees sacked and fined at SingHealth:

https://www.zdnet.com/article/employees-sacked-ceo-fined-in-singhealth-security-breach/#ftag=RSSbaffb68

Thales Data Threat Report 2018

Makes some interesting reading, Need to provide some details to download the report.

https://dtr.thalesesecurity.com

Applying Cyber Kill Chain Methology

Good document from Lockheed Martin discussing how to apply their Kill Chain methodology to network defence.

https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/Gaining_the_Advantage_Cyber_Kill_Chain.pdf

Simple 2FA may have prevented theft of 1.5 million Singapore patient records

https://www.theregister.co.uk/2019/01/11/singapore_health_hack/

Full report is here:

https://www.mci.gov.sg/pressroom/news-and-stories/pressroom/2019/1/public-report-of-the-coi

Boston Children's Hospital DDoS attacker gets 10 years in jail

The Anonymous culprit who performed a DDoS attack against the Boston Children's Hospital in 2014 gets 10 years in jail. I remember this attack as it was one of the examples in my MSc. dissertation.

https://www.securityweek.com/hacktivist-gets-10-year-prison-sentence-ddos-attack-hospitals

Particularly like the fact that he tried to flee the US in a small boat, but was returned to the US when he was rescued by a Disney cruise ship off the coast of Cuba.

Email security SPF, DKIM and DMARC

I was looking for a description DKIM and DMARC, came across the following blog post by Liquid Galaxy.

https://www.endpoint.com/blog/2014/04/15/spf-dkim-and-dmarc-brief-explanation

Directly from the article:

SPF (Sender Policy Framework) is a DNS text entry which shows a list of servers that should be considered allowed to send mail for a specific domain. Incidentally the fact that SPF is a DNS entry can also considered a way to enforce the fact that the list is authoritative for the domain, since the owners/administrators are the only people allowed to add/change that main domain zone.

DKIM (DomainKeys Identified Mail) should be instead considered a method to verify that the messages’ content are trustworthy, meaning that they weren’t changed from the moment the message left the initial mail server. This additional layer of trustability is achieved by an implementation of the standard public/private key signing process. Once again the owners of the domain add a DNS entry with the public DKIM key which will be used by receivers to verify that the message DKIM signature is correct, while on the sender side the server will sign the entitled mail messages with the corresponding private key.

DMARC (Domain-based Message Authentication, Reporting and Conformance) empowers SPF and DKIM by stating a clear policy which should be used about both the aforementioned tools and allows to set an address which can be used to send reports about the mail messages statistics gathered by receivers against the specific domain [1].

Marriott leaks 5.25 million passport numbers

The latest information from Marriott breach is that 5.25 million passport numbers were lost in their recent hack.

https://www.darkreading.com/attacks-breaches/marriott-sheds-new-light-on-massive-breach-/d/d-id/1333592

The Cathay Pacific hack recently affected 9.4 million customers, including passport numbers.

https://www.independent.co.uk/life-style/gadgets-and-tech/news/cathay-pacific-hack-customers-credit-card-passport-details-credit-card-numbers-a8599851.html

These are indeed worrying times. I understand that passport numbers are an extremely hot target and so hard to obtain that they're not even available on the dark web.

Companies are not adequately securing this information and customers have no choice but to provide these details to use everyday services. I wrote in an earlier blog post about my reticence to provide the TV licensing agency with my details in future. The problem is, once these details about someone have leaked, they're impossible to get back. I suspect most people would be shocked if they realised just how much personal information about them has already been stolen and probably available on the dark web.

Unfortunately, my prediction is that medical records will be one of the next pieces of sensitive data to be hacked en masse.

UPDATE! TV Licensing agency - Lack of security?

Noticed the following story on the BBC website about 5,000+ complaints to Action Fraud about this scam. However, still nobody putting two and two together that TV licensing are probably leaking these email addresses in the first place.

https://www.bbc.co.uk/news/uk-46745298



I recently provided my new address details to the UK's TV licensing agency website . I don't actually need a TV licence, as I only watch some on-demand programmes from Netflix that make me exempt from needing one, so I dutifully made them aware. However, the following day, and every few days after that, I received a phishing email from ''TV licensing''.

Now, it is possible that these two events were completely unconnected, but I think the chances are very to extremely low. My guess is that cyber intruders have installed malware inside the TV licensing network and are siphoning customer details in near real time.

Being a good Internet citizen, I raised a ticket to make them aware. About a week later I had a standard response, saying they knew about these phishing emails and to just delete them. I responded to them again, making them aware I work in the information security business and providing further detail on my suspicions. I even offered to speak to their information security analyst. A few days later, I had a further email from them, telling me to delete the phishing emails, as it was nothing to do with them and effectively telling me I was stupid.

After doing a bit of digging, guess how surprised I was to find they'd already had security issues towards the end of 2018:

https://www.theregister.co.uk/2018/09/18/tv_licensing_encryption/

Until companies take cybersecurity a bit more seriously, it's the consumers and customers that are at risk. Denying that it is anything to do with them (TV licensing), they're just innocent victims as well, doesn't cut it. I won't make TV licensing aware next time that I don't need a licence from them, as I don't trust that they can keep my details safe. If I needed one, then I'd have no choice but to sign up and put my details at risk of compromise. Companies need to take cybersecurity more seriously, rethink how they respond to reported security incidents and make sure that there are proper reporting mechanism in place. If I see that they report a breach in the future, I'll be sending my emails to the Information Commissioner's Office to prove that they were made aware. It's sad, but fines and bad publicity seem to be the only way to get these companies to take security more seriously.

First Round of MITRE ATT&CK Vendor Evaluations

MITRE have been doing some interesting work with a number of vendors to evaluate capabilities for detecting and protecting against known, real-world adversarial techniques.

The initial evaluations are for the APT3 / GOTHIC PANDA threat actor. The seven vendors include Carbon Black, Cylance, RSA and Sentinel One.

https://medium.com/mitre-attack/first-round-of-mitre-att-ck-evaluations-released-15db64ea970d