Network Security

Latest News From Blog

Network Security

Ransom Ops vs. Extended Detection and Response

With nearly four out of ten global organizations admitting to being victims of a ransomware attack in 2021 alone, it’s apparent that complex ransomware operations–or RansomOps–are only going to become a bigger part of the cybersecurity dialogue than they already are. Gartner noted that the threat of new ransomware models was a top concern among executives last year, and when you look at the stakes, the evolving landscape, and the publicized RansomOps attacks this far, you can see why.RansomOps describes the entire multi-stage ransomware operation with an ensemble of players who contribute to these highly targeted attacks from initial ingress to lateral movement in the network to delivery of the final encryption payload. RansomOps take a “low and slow” approach, infiltrating the network and often remaining undetected for weeks as the attackers pivot through the targeted ecosystem, often exfiltrating sensitive data that is leveraged in double extortion schemes to assure payment of the ransom, even if the victim is able to regain access to their systems and data.Understanding how RansomOps attacks work is the first step in knowing how to defend against them.UNDERSTANDING THE RANSOMS ATTACK CHAINAccording to NIST, ransomware “is a type of malicious attack where attackers encrypt an organization’s data and demand payment to restore access,” and it is a multi-phase process. Rodney Joffe, Forbes Councils Member, explains, “Security teams need to be able to recognize the initial attack long before any information is stolen and encrypted.” This means early detection, so understanding the RansomOps attack chain is necessary. While once the domain of simple “spray and pray” email spam campaigns, ransomware operations today are “much more sophisticated and are more akin to stealthy APT-like operations,” which means that every stage must be understood in order to defend against them. To do so requires an understanding of the MalOp, or the entirety of the process malicious actors take “from the minute of network penetration until achieving their operational goals.” Once you understand that, you can spot opportunities to intercept a ransomware attack at initial ingress, lateral movement, command, and control, etc. so you can automate response actions earlier in the kill chain as opposed to focusing solely on the ransomware payload, the tail-end of a RansomOps attack.ISACA lists the ransomware kill chain steps as infection/ingress, privilege escalation and persistence, credential abuse, and eventually data encryption. Using these as a general guide, we’ll explore what security measures can be implemented at each stage to secure at the speed of attack – and hopefully faster. 

Network Security

Security Risk Assessment

Companies are increasingly spending money on cyber security. However, attackers are launching more sophisticated cyber attacks that are hard to detect, and businesses often suffer severe consequences from them. IN the first half of 2019 alone, data breaches exposed nearly 4.1 billion records. This is why it is imperative for businesses to empower themselves with the knowledge of how strong their cyber security is, what potential vulnerabilities exist, and how those risks can be mitigated. Performing a cyber security risk assessment helps organizations strengthen their overall security. The primary goal of a risk assessment is to determine what the critical assets are and if a threat exploits those assets, how much it would cost to mitigate those risks and to protect your assets from a breach.How can you perform a cyber risk assessment?In order to perform a cyber security risk assessment, you need consider three factors:• Importance of the assets at risk• Severity of the threat• Vulnerability of the systemBut before we dive into how to perform a cyber security risk assessment, let’s understand what a cyber security risk assessment is.What is a Cyber Security Risk Assessment?A cyber security risk assessment is the fundamental approach for companies to assess, identify, and modify their security protocols and enable strong security operations to safeguard it against attackers.It also helps to understand the value of the various types of data generated and stored across the organization. Without determining the value of your data, it is quite difficult to prioritize and assign resources where they are needed the most.In a cyber security risk assessment, you also have to consider how your company generates revenue, how your employees and assets affect the profitability of the organization, and what potential risks could lead to monetary losses for the company.Once you have identified all this, you should think about how you could enhance your IT infrastructure to reduce potential risks that might lead to financial losses to the organization.Furthermore, a cyber security risk assessment helps inform decision makers and support proper risk responses. Most C-suite executives and higher management professionals don’t have the time to delve into the minute details of the company’s cyber security operations.A cyber security risk analysis serves as a summary to help them make informed decisions about security for their organization.There are several ways you can collect the information you need to start your risk assessment process:• Review documentation.• Interview data owners, management, and other employees.• Analyze your infrastructure and systems.How to Perform Cyber Security Risk Assessment?To begin cyber security risk assessment, you should take the following steps:Step 1: Determine Information Value :Most organizations don’t have a large budget for security risk assessments, especially small-to-medium businesses (SMBs), so it’s best to limit your scope of assessment to the most critical business information. Spend time to define a standard for determining the importance of information and prioritizing it. Companies often include asset value, business importance, and legal standing. Once you have created a standard and it is embedded in your organization’s cyber security risk analysis solution, use it to categorize information as minor, major, or critical.Here are some questions that you can ask to determine information value:• How valuable is this information to competitors or attackers?• If this information is lost, could you recreate the information? How long would it take? What would be the associated costs?• Are there any financial or legal penalties associated with losing or exposingthe information?• Would losing the information impact the company’s day-to-day operations?• What would be the financial damage of the data being leaked or stolen?• What would be the long-term impacts of the information being lostcompletely or exposed? Would it cause reputational damage? How could you recover from it?Step 2: Identify and Prioritize AssetsThe first and most important step to perform a cyber security risk assessment is to evaluate and determine the scope of the assessment.This means you have to identify and prioritize which data assets to assess. You may not want to conduct an assessment of all your employees, buildings, trade secrets, electronic data, or office devices.You need to work with the management and business users to create a comprehensive list of all the valuable assets. Some assets could be valuable because they largely impact your company’s revenue, while others could be valuable because they ensure data integrity to your users.Once you have identified crucial assets for the assessment, collect the following information:• Data• Purpose• Criticality• Software• Functional requirements• Information flow• Interface• End-users• Hardware• Information security policies• Information security architecture• Network topology• Technical security controls• Physical security controls• Environmental security• Information storage protection• Support personal

Network Security

Network Security Monitoring

Recently I've been studying about Network Security. For a year, I've been using ettercap for pentesting and investigation, I even wrote a Lex app for it, but recently I've found a tool which is pretty similar but way better, logs are pretty organized and have better commands. I must say I will be using linux, there are options for network monitoring in Windows, but I'm not going to talk about them in this article.First of all, network security monitoring allow us to detect and respond to intrusions. The range of the NSM data is:Full content: all the information that cross the networkExtracted content: high level data stream, such as images and such.Session data: Record of the conversation between two nodes (this is the logs that bro generates and the part that I will be focusing).Transaction data: Similar to session data, but focusing on understanding the request an replies.Statistical data: Traffic resulting from various aspects of an activity.Metadata: Studying further the data results of the monitoring and understanding them.Alert data: Intrusion detection.And now I'm introducing Bro tool. Bro it's pretty easy to install. After downloading and opening the directory on the terminal, we can read the INSTALL instructions simply doing cat INSTALL , but it's a classic "./configure, cmake, make". If you have a problem, you should check if your network is wlan0, if not, change it. This took me a while to figure out.Once we installed it, we go to the directory where we saved it. In my case, it's /usr/local/bro but wherever. in the .../bro/bin you shoul see a lot of executables. We will be focusing on broctl, sudo that thing! sudo ./broctl.You should see something like this:Now we are starting. on the bro terminal we will write start that will start the scanning.n another terminal we locate again our bro directory and then we go to .../bro/logs. We should see a log with the date and a directory called current. We are gonna check current (cd current). In that directory we should find a lot of directories, but we are going to center in http.log. The directories are zipped so first we are using sudo gunzip *.log.gz to unzip them. now lets cat http.log.There we can see a lot of information divided in paragraphs. We should clearly see the GET requests in the network. If, for example, we enter www.testmyids.com in the browser, and doing again the cat http.log thing, it should allow us to clearly see the request for a favicon failed. A nice tip would be watching the x509.log directory, too. It contains information about the certificates of the places visited, which tell us the users are entering twitter, facebook, google... etc.When we want to stop we only write "stop" in the bro terminalThere are plenty more commands for bro that will be useful for us to check. You could spend a while analizing all the data, and I assure you, you can get conclussions easily due to it's well organized system.

Network Security

Is Malware Analysis Right for Your Business?

In the world of technology, things are constantly moving and changing — and cybersecurity is not an exception. As the good guys get smarter, the bad guys get sneakier and stealthier. This is especially true of malware, which has evolved dramatically in the last couple of years.We’re now seeing malware with artificial intelligence (AI) that is capable of mutating and even automatically detecting whether it is being run inside a sandbox. Due to this challenge, adoption of malware analysis has been on the rise in recent years. Does this mean that every company should start analyzing malware? The short answer is no.How to Know If Malware Analysis Is Right for You?There are two main reasons why it may not be the right time for a company to invest in a malware analysis team. First, many enterprises don’t have the resources to build and maintain such a team. Second, there are a lot of companies out there that specialize in malware analysis, many of which provide an on-demand service that generates indicators of compromise (IoCs) and makes them available to the public for free.For some companies, it may not make sense to have a team dedicated to analyzing malicious code because the business does not specialize in that area. It would be difficult to imagine an energy company investing in a malware analysis team, for example, but that doesn’t mean it shouldn’t use threat intelligence gathered by malware specialists. Even though most organizations don’t have to worry about malware analysis, they all need to worry about their security. Integrating a system that can alert security teams based on IoCs generated by specialized companies is a great way to enhance security on a budget.Enhance Enterprise Security on a BudgetPublicly shared IoCs are a great resource and can help businesses identify the presence of malware in their infrastructure, despite their inability to analyze malicious code. Ingesting these types of IoCs can help security teams detect malware without analyzing the code itself.For companies that want to have more visibility into network activity but lack the ability to analyze malware, using what is publicly available and developed by specialized companies around the world could be the difference between a malware infection and a crisis.

Network Security

Computer Network Defense

A CDN or Content Delivery Network is a global network of servers that serves web content to end-users more quickly by storing copies of files such as images in locations that are geographically closer to the users requesting that content. By using a CDN, websites reduce the load on their origin servers, which can enable them to serve more users without fear of overloading their servers. CDNs improve user experience by contributing to faster website load times, and also improve the security of websites by enabling them to mitigate the impacts of distributed denial of service (DDoS) attacks, and by giving them the ability to install additional security proxies through the content delivery network.Benefits of CDNsSome of the benefits of using a Content Delivery Network include:i. Decrease webpage and application load time: By caching copies of static files and delivering them from servers that are closer in distance to end-users, website load times are reduced. This improves user experience and has other benefits, such as increasing search engine optimization, as search engines take website performance into account when ranking pages.ii. Protect against DDoS and other attacks: CDNs protect a website’s origin server from DDoS attacks and other threats by enabling sites to handle increased traffic. Additionally, other security tools such as firewalls can be installed on the CDN and sit between a malicious user and a website.iii. Improve scalability: Content Delivery Networks allow websites and applications to scale up quickly, as CDNs can handle traffic spikes without websites needing to increase their origin server capacity significantly.iv. Reduced bandwidth and hosting costs: As CDNs cache certain web content, they reduce the amount of bandwidth needed at the origin or host server. Bandwidth expenses vary based on the hosting provider, but can be costly and unpredictable, so utilizing a CDN can save on hosting costs.v. Minimizes website downtime: Having high uptime is critical for businesses that rely on their website or application to generate revenue, such as Software as Service applications and eCommerce sites. CDNs protect against downtime through the security measures mentioned above, and can even sometimes deliver a cached version of the site if the origin server is down.There are a few different types of CDN in operation today, including CDNs operated by telecommunication companies and private CDNs, which are purpose-built for one company. Netflix and Facebook are examples of companies that have built their own Content Delivery Networks due to their large global presence and the huge amount of content they deliver each day. However, most businesses and individuals today looking for a CDN will use a commercial Content Delivery Network, such as Akamai, Cloudflare, or Fastly. While each CDN provider has some unique features, all CDNs work using the same basic principles.How CDNs cache contentAt the heart of Content Delivery Networks, also sometimes referred to as edge networks, is a set of Points of Presence or PoPs, which are groups of servers in multiple locations around the world. The servers hosted in each PoP are known as edge servers, as they are unique to the origin server which hosts the full version of a website or software, and are located at the “edge” of a network closest to the end-user. CDNs vary in the number of PoPs they include, with some networks having thousands of PoPs in all continents, and others focusing their PoPs in key areas they serve.Edge servers serve multiple purposes, including hosting cached files to improve performance and protecting the origin server by directing traffic to the CDN instead of directly to the origin. CDNs can host a variety of software tools that help with performance and security as edge servers act as reverse proxies, which intercept web traffic and handle it through a set of rules based on the software installed on your edge server. While CDNs are most known for caching content, they can also host threat detection software, image resizing tools, and much more. Below we outline two of the most common use cases for CDNs–caching content and protecting websites from attack.This type of caching is called server-side caching, and can also be set up without the use of a Content Delivery Network through programs such as Varnish Cache which sit in front of the origin server. However, by using server-side caching in conjunction with a CDN, websites can deliver even more optimal performance. The other commonly known caching method is client-side or browser-caching, in which copies of files are stored in a user’s local browser. Browser-caching means that if a visitor repeatedly visits a webpage, certain objects on that page, such as logo files, will be stored in their browser cache and so are delivered even more quickly. Most websites use a combination of browser caching and server-side caching, usually through a CDN, to realize the fastest website speeds possible.To ensure the cached files served from a CDN are up-to-date, websites enter information that tells the caching mechanism when the files expire. If a CDN discovers that a file has expired, it will re-fetch that file from the origin the first time it is requested. This is known as a “cache pull,” and is beneficial as this method means the CDN only requests files when they are needed. Another caching technique is known as “cache push,” when a website proactively tells the cache to update its files. This method can be used for larger files, or when a website updates most of its content and wants to ensure the cache has the updated content.How CDNs improve website securityIn addition to improving the performance of a website, Content Delivery Networks also improve the security of websites by detecting threats, blocking malicious traffic, and protecting the origin server from attacks. By utilizing a CDN rather than sending traffic directly to an origin server, the origin server is protected from Distributed Denial of Service attacks, in which attackers attempt to take down websites by sending a huge amount of traffic to a website at once. CDNs both distribute the traffic among multiple PoPs, enabling it to withstand the additional traffic, and can include tools that go a step further in protecting from DDoS and other security threats.Other security tools which are offered with many CDNs include firewalls and advanced threat detection software which will stop harmful traffic from getting through to the origin server. Firewalls monitor traffic and block certain traffic from entering a website based on a set of rules, such as IP address, and more advanced firewalls may examine the contents of a data packet or create smart rules to identify threats. CDNs may also include tools that mitigate the impact of harmful bots, secure APIs and manage the TLS/SSL certificates of websites, ensuring that traffic is encrypted. All of these security tools can ensure websites stay online, threats are quickly dealt with, and there is no threat to brand reputation based on security leaks.How to choose a CDNThere are many CDN solutions available, and every business or individual using a CDN may have different needs and priorities. When considering what Content Delivery Network to utilize, consider these factors:CDN use case: Depending on the function that your website or application serves, you may be serving different types of content. If you are planning to cache mostly static content such as images, most CDNs will be able to fulfill your needs, but if you want to cache dynamic content or personalized assets you should ensure your CDN will be able to handle those use cases.PoP Network: CDNs are intended primarily to deliver content to end-users more quickly, so the location of the Points of Presence is critical when determining what CDN to use. If a majority of your traffic comes from one region, ensure that the CDN you choose has a PoP or multiple PoPs in that location. If your traffic is globally distributed, choose a CDN with many PoPs around the globe.Available features: Content Delivery Networks can include hundreds of different products for website security, performance, and scalability. These range from basic caching tools to image optimization, advanced firewalls, and more. When determining what CDN to utilize, examine the products they offer compared to your priorities - for example, if website security is your greatest concern, choose a CDN with a robust set of security tools.User experience: While Content Delivery Networks are a commonly used tool, the user experience can vary based on the CDN. Some CDNs may have limited or complex user interfaces, while others have intuitive dashboards and APIs that can be easily managed using existing workflows. Certain CDNs may also offer fully managed services that take setup and management off of your plate.Price: The cost and pricing model of a CDN is important to factor into your purchasing decision. While some CDNs offer free or low-cost tiers for websites with basic caching and security needs, enterprise-level solutions can cost thousands of dollars a month. Many CDNs charge based on both the tools you utilize and the traffic that runs through the CDN, so make sure to include all of the functions you will be using and estimate how much costs will go up if your traffic increases.Support and documentation: As with other cloud solutions and software tools, the support offered by a CDN provider can range from user-generated forums to email support, to dedicated representatives. When determining what CDN to utilize, consider if you feel comfortable troubleshooting any issues yourself, or if you’d like more frequent access to support representatives. Look at the quality of documentation and level of support provided, along with any added cost for premium support.Compatibility: Certain CDNs may be better suited to different content management systems or software architectures. For example, some CDNs have plugins that are built to easily work with website builders. Before you choose your CDN, examine how it will work with your current application setup and the other tools you use.

Network Security

The Importance of Endpoint Security

To put it simply, endpoint security protects the commonly used digital devices mentioned above (smartphones, laptops, and desktop computers) from weaknesses from within the software that could lead to hackers, viruses, and malware entering into a system’s internal data storage where sensitive information is kept and accessing it for nefarious purposes.What is an Endpoint?Almost everybody has one, but they might not know what it is. Think about the digital devices that you use on a daily basis. A desktop computer? Probably. A tablet or laptop computer? Most likely. A smartphone or mobile device? Definitely. These devices are what is referred to in the network security space as endpoints.“Endpoints serve as points of access to an enterprise network and create points of entry that can be exploited by malicious actors,” (Forcepoint.com). Laptops, smartphones, and desktops are used widely by both consumers and businesses alike. But, for businesses having a level of protection from hackers looking to gain access to sensitive information about their customers and the company itself is of top priority.Why Endpoint Security is ImportantEffective endpoint security is a must for modern enterprises—locking all doors on your corporate house isn’t a matter of choice anymore. Data is the lifeblood of business, and protecting it is paramount to organizational success. With the shift towards mobility, security must now occur at all points within a network. Centralized security systems prove ineffective in today’s dispersed landscape. Jose-Miguel Maldonado, VP of Business Ops & Security at Rubica, explains, “People are outside the corporate security structure and today’s attacks are extremely sophisticated. Traditional solutions like on-premise firewalls and anti-virus just aren’t enough anymore”. As organizations grow, so do the endpoints and the cost of protection. However, the cost of not securing your network can be far greater in terms of data loss, regulatory fines, and reputational damage. On-premise Endpoint SecurityThis option is based on securing all network endpoints from a solution hosted and maintained on in-house servers. All costs fall on the user—this includes the space, electricity, cooling, and staff. On-premise software usually requires a large initial investment and can involve lengthy installation. For these reasons, it may not be the best choice for budget-conscious organizations seeking faster solutions.  Cloud-based Endpoint SecurityThis option involves securing all network endpoints from a solution hosted and maintained on cloud vendor servers. Often referred to as “endpoint protection,” this solution provides a cost-effective, agile option that can be up and running in minutes. Cloud-based solutions offer numerous advantages, starting with access to vendor databases and monitoring that provides rapid threat response. Additionally, for a reasonable monthly fee, users get automatic data backups, quicker patching even for remote devices, and remote system control.Types of Endpoint SecurityEndpoint security engages specific practices to block threats and secure your network. Here are some to keep in mind:Endpoint encryption: Involves the coding and scrambling of data, making it indecipherable without a key. Encryption is the last and possibly the most important security layer because it protects the data even if it falls into the wrong hands.Forensic analysis: Works in conjunction with EDR by monitoring all endpoint activity and creating a digital footprint of all incidents. All information and evidence surrounding an attack—what happened, who’s responsible, and the resulting consequences—is collected and analyzed to prevent future incidents. IoT protection: Many IoT devices sorely lack adequate security upon installation. What can your organization do to lock down IoT devices? Start by installing an EDR system to manage, monitor, and scan for vulnerabilities. Be sure to remove outdated devices, install next-gen solutions, monitor all app and device access, encrypt communications, and segment your network to isolate problems.Email gateways: E-mail is the most common way for criminals to attack networks, so email gateway software is critical today. Safe emails continue through the system, while potential threats go to quarantine. All email gateways should include virus and malware blocking, content filtering, and email archiving.Quarantine protection: This is the practice of separating dangerous files to prevent harm to devices and networks. Rapidly isolating dangerous files is essential to endpoint security, and quarantining also allows valuable files to be cleaned rather than discarded. As mentioned earlier, with the rise of remote work opportunities more endpoint devices are being used to complete work tasks. While convenient to use on the go and at any time, endpoint devices present a variety of avenues for outside threats to enter into a business network and compromise important data of the company, its employees, and customers.