Blog

Latest News From Blog

SEIM Technology

What are the benefits of a SOC?

What are the benefits of a SOC?By relying on threat intelligence, SOCs offer assurance that threats will be detected and prevented in real-time. Looking at a big-picture perspective, SOCs can:Respond faster: The SOC provides a centralized, complete, real-time view of how the entire infrastructure is performing from a security standpoint, even if you have several locations and thousands of endpoints. You can detect, identify, prevent and resolve issues before they cause too much trouble for the business.Protect consumer and customer trust: Consumers, already skeptical of most companies, are worried about their privacy. Creating a SOC to protect consumer and customer data can help build trust in your organization, which also includes preventing breaches.Minimize costs: While many organizations think establishing a SOC is cost prohibitive, the cost associated with a breach — including the loss and corruption of data or customer defection — are much higher. Additionally, SOC personnel will ensure that you’re using the right tools for your business to their full potential, so you won’t waste money on ineffective tools.These benefits are hard to put a price on because they quite literally keep your business running. But do you absolutely need a SOC? If you’re subject to government or industry regulations, have suffered a security breach, or are in the business of storing sensitive data — like customer information — the answer is yes.What does a SOC do?The SOC leads real-time incident response and drives ongoing security improvements to protect the organization from cyber threats. By using a complex combination of the right tools and the right people to monitor and manage the entire network, a high-functioning SOC will:Provide proactive, around-the-clock surveillance of networks, hardware, and software for threat and breach detection, and incident response.Offer expertise on all the tools your organization uses, including third-party vendors, to ensure they can easily resolve security issues.Install, update and troubleshoot application software.Monitor and manage firewall and intrusion prevention systems.Scan and remediate antivirus, malware, and ransomware solutions.Manage email, voice, and video traffic.Help with patch management and whitelisting.Provide deep analysis of security log data from various sources.Analyze, investigate and document security trends.Investigate security breaches to understand the root cause of attacks and prevent future breaches.Enforce security policies and procedures.Supply backup, storage, and recovery.However, the SOC does more than just handle problems as they arise. What does a SOC do when it’s not detecting threats?The SOC is tasked with finding weaknesses — both outside and within the organization — through ongoing software and hardware vulnerability analysis, as well as actively gathering threat intelligence on known risks. So even when there are seemingly no active threats, SOC staff are proactively looking at ways to improve security. Vulnerability assessment includes actively trying to hack their own system to find weaknesses, known as penetration testing. Additionally, a core role of SOC personnel is security analysis: ensuring that the organization is using the correct security tools optimally and assessing what is and isn’t working.

Other

Building an Active Directory Pentesting Home Lab in VirtualBox

Active Directory is often one of the largest attack services in Enterprise settings. In fact, the OSCP Exam was recently updated to have less emphasis on buffer overflows but added a section dedicated to Active Directory.AD can be confusing at first to learn, but one of the best ways to learn anything in software, is by installing and setting it up ourselves.Downloading Windows Server 2019Find the Windows Server 2019 download from the Microsoft Evaluation Center. Scroll down to the option "Windows Server 2019", and select the ISO download option, which Microsoft is apparently labeling as "Please select your experience:"Before the download will start, you'll be prompted to fill out some personal information. It asks for a work email, but a personal email (ie gmail, etc) should work fine too. Finally select your language, then start the download.After clicking download, you should see the file pop up in your downloads bar, and the webpage will update to reflect the file name of the Windows Server 2019 Eval version you're downloading.Installing Windows Server 2019 in VirtualBoxIn VirtualBox, start by clicking the New VM button, the blue spikey looking thing. In the VM Options pop-up, for Name type in "Windows Server 2019", for Machine Folder select a folder on your host computer where you want to store your VM files. Select "Microsoft Windows" for Type, and for Version select "Windows 2019 (64-bit)". Then click "Continue".In the next options panel, "Memory size", you can leave the default at 2048MB, aka 2GB, which is the minimum required memory amount for Windows Server 2019, or. But if you have the host RAM to spare, bumping up the VM memory to 4096MB or a little more is reccommended.(For our pentesting lab, these small values are fine, obviously though in a production setting you'd need significantly more RAM to run smoothly)For the "Hard disk" panel, select "Create a virtual hard disk now", then select "VDI (VirtualBox Disk Image)" and hit Continue. For "Storage on physical hard disk" I'm selecting the "Dynamically allocated" option.The "File location and size" should default to a new folder with your VM name from earlier, in the directory you also specified in the earlier step. I'd reccommend leaving this default so that all the VM files are contained in a single location. I'm leaving my VDI size at 50.00GB.After clicking through that, our new VM should appear in the left-hand sidebar, I have a few other VM's already installed which is why my machine appears further down on the list.Now that we have a VM created, we still need to install Windows Server 2019 onto our Virtual Machine. With the new VM highlighted (the background color should be a light blue) click the settings button.In the new pop-up, select "Storage", then under the "Storage Devices" window, click the empty disc icon. On the right-hand windows "Attributes", click the blue disk icon, click "Choose a disk file", then find the Windows Server 2019 .iso file we downloaded earlier. The filename will probably be the same or similar to: 17763.737.190906-2324.rs5_release_svc_refresh_SERVER_EVAL_x64FRE_en-us_1.iso. If the iso is loaded up correctly, you should see the "Empty" next to the disk icon change to the .iso file name. Click "OK" to save changes and close the pop-up.In VirtualBox, the steps that we just took are equivalent to inserting an install CD (or in this day and age, an install USB). So now we'll need to turn on the VM so we can actually install Windows Server from that .iso.With the new VM still highlighted, click the green "Start" arrow. A new window should pop-up on your host machine. This is our Server 2019 VM. After it finishes initially booting up, you'll see the Windows Server 2019 installation prompt.Leave the default settings as-is, and click next. You should see a new tab with a single "Install Now" button. Click that, and on the "Windows Setup" tab that appears, You should see 4 different versions of Server 2019. The option that we want is "Windows Server 2019 Standard Evaluation (Desktop Experience)".It's important to select the "Desktop Experience" version of Server 2019, this is the version of Windows Server that has a GUI similar to a standard Windows 10 install. In prior versions of Windows Server, you were able to install a GUI after initial installation, but that is no longer the case, so let's make sure we're installing the GUI version from the start.After selecting the correct version, you'll need to accept Windows License terms. Then select the "custom install" version, since this is a fresh machine and we're not upgrading from any previous versions. Our VirtualBox VDI should appear in the Windows Install tab as "Drive 0 Unallocated Space", it should be selected by default, so click the Next button.This will start the actual installation of Windows Server 2019 Desktop Experience. Like the download step from earlier, this process will take a little bit of time to run, so let Windows do it's thing through the install process. You'll probably notice that the Virtual Machine restarts a couple times through the install. This is normal.Initial Login & SetupOnce the install is finished, you'll need to supply a few more configuration settings to complete setting up your Windows Server VM. The built-in administrator username is pre-selected as "Administrator", for a password, I'm using P@ssw0rd!, not very secure, but it'll work for a small-scale home lab.Additionally, back in the VirtualBox manager, you can save the Administrator password for this machine by clicking "Settings", in the "General" tab, select "Description" then add some notes with our machine credentials.Once you've entered and saved our Administrator password, Windows should finish applying those new settings, and then open up a to a standard lock screen which should look familiar to you if you've used Windows 10 before.To login to our Windows Server VM, we'll need to hit "Ctrl + Alt + Delete". I work on both macOS and Windows Hosts, and trying to figure out the equivalent keys between various hosts can be a pain. Fortunately, VirtualBox has a nice built-in feature that allows us to input "Ctrl + Alt + Delete".On a macOS host, make sure you have your Windows Server 2019 VM selected, then in the upper menu bar, select "Input", hover over the "Keyboard" option, then click "Insert Ctrl-Alt-Delete". That dropdown will also show you what the keyboard shortcut on your host is to enter that without having the select the menu bar option.Once that's entered, you should be able to type in our Administrator password, P@ssw0rd! and login.On initial login, I got an automatic prompt asking if I wanted to turn on "Network Discovery", I went ahead and turned that on.Side Note: To the best of my knowledge, enabling "Network Discovery" doesn't affect ICMP settings. Ie, if you were to try to ping your Server 2019 VM from another host in your VirtualBox network right now, it wouldn't work. That's skipping ahead a couple steps though, so don't worry too much about it right now if that doesn't make sense to you.You'll also most likely see that the "Server Manager" program starts up by default. The astute readers among you might have noticed a tiny bright Orange "1" followed by a large heading labeled "Configure this local server". I think that means Windows wants us to click on it.Clicking on that link takes us to the "Local Server" configuration page, which can also be access via the left-hand sidebar.There's two main settings to take note of at the moment, the first is our Computer Name: "WIN-K3SDKO5BM8I", the second is the name of our Workgroup: "WORKGROUP".I won't go into too much detail about the differences between a Workgroup and a Domain but one of the key differences for our use case is that in a Workgroup, user accounts are managed by individual computers, whereas in a domain user accounts are managed by a central server or servers, called domain controllers.You might also hear it explained that in a Workgroup, all the various computers in that Workgroup are essentially peers, and no one single computer has elevated or admin credentials above the others in that Workgroup. Domains, conversely, have that central domain controller as the top-level administrative component, and as such have admin rights over the various user accounts within the Domain.Active Directory Domains is what you're more likely to see in larger scale, or Enterprise environments, and that's what we're trying to set up (albeit on a smaller scale) for our local pen-testing environment.With that explanation out of the way, let's go ahead and get started on our AD setup.Installing Active DirectoryTo start, let's rename our Windows Server 2019 Computer Name to something reflective of the fact that this will become our Domain Controller. Click the light-blue computer name, then in the "System Properties" pop-up, select the "Change..." button down next to the "To rename this computer...." text.I'm renaming my computer the very creative name, ADAMDC. Adam, for my name, and DC to reference the fact that this is our domain controller.Hit "OK" and after a few seconds that should update. You'll also see a pop-up stating that you'll have to restart in order for our name change to take effect. Hit "apply" in the "System Properties" window to save the changes. But choose the "restart later" option, to delay the automatic restart.We still need to setup some VirtualBox networking options, something we can't do while our VM is running, so this is a good opportunity to shutdown our VM.Click the "Windows" button in the bottom left-hand screen, then the power button icon and select "Shut down". This should be very familiar if you're used to working with Windows 10. What might not be familiar is the next pop-up, selecting a reason for shutting down.In our case, we'll just select "Other (Planned)" as the reason every time we shutdown our Windows Server VM. This isn't a production server, so it's not really important or even necessary to log reasons for shutdown.If you do shutdown without go through that process (ie you just close your virtual machine window) you'll get a mildly annoying pop-up the next time you turn on the vm. It's kinda like Microsoft's version of Mr. Resetti.Once that completes shutting down, click back into your "VirtualBox Manager".Installing Active Directory - VBox Network ConfigurationWe haven't look too much into our actual VirtualBox setup so far, other than what was absolutely needed to get our Windows Installation up and running. Now though, we're going to want to make sure we have our networking options setup and configured correctly before we move onto to actually installing Active Directory.VirtualBox has a couple different types of virtual networking options, but the one we're going to focus on is a "Host-Only" adapter. TODO MORE INFOFirst, ensure that you have a network setup in VirtualBox.Click "Tools" and then the hamburger menu looking thing to the right of it. You should see 4 options pop-up, "Welcome", "Media", "Network", "Cloud". Network is the option we want so click on that.If you don't already have a network click the "Create" button to make a new one, otherwise click properties to edit your existing one. Make sure the "DHCP Server" option is disable, and also select "Configure Adapter Manually"Give your adapter the settings of:IPv4 Address: 192.168.56.1IPv4 Network Mask: 255.255.255.0Still in VirtualBox Manager, select your Windows Server VM again, and select the options for that VM.In the Options pop-up, choose the "Network" tab, I have a NAT adapter in the Adapter 1 slot, so in Adapter 2 I've checked "Enable Network Adapter", set the Attached to: value as "Host-only Adapter", and for Name:, that's the name of the network we just created, I've selected my VBox network.Save those settings, and it's time to start up our Windows Server VM Again. Click the green start arrow. Then login with our administrator credentials.When you login, Server Manager should pop-up automatically again. Confirm that our computer rename from earlier successfully completed, then minimize Server Manager, and open up Command Prompt.In command prompt, type the following:ipconfig You should see an output with two network adapters listed (Virtualbox treats these as Ethernet connections). The first Network should be your NAT. That's how your VM gets external internet access. The second adapater should be the host only adapter we just setup, so you should notice that the IP will be in the range of the subnet that we specified when setting up the network a few moments ago.Now we need to manually assign our Windows Server Computer a static IP for our host-only network. Open up Control Panel, then select "Network and Internet", then "Network Sharing Center". You should once again see our two networks listed.Click the host-only network Ethernet (should most likely be Ethernet2), then select "Properties", then in the properties pop-up select the "Internet Protocol Version 4 (TCP/IPv4)" so that it is highlighted. Then click properties for IPv4.A new window should popup, and "Obtain an IP address automatically" is most likely pre-selected. Choose "Use the following IP address:"IP Address: 192.168.56.2Subnet mask: 255.255.255.0Default gateway: 192.168.56.1Preferred DNS server: 192.168.56.2With those settings inputted, click through the various "OK" buttons to apply the changes.Back in command prompt type cls to clear out previous ipconfig command. Then, re-run ipconfig.New IP, who dis?With all that setup out of the way, we now have a local network (the host-only network) that our VirtualMachines can use to talk to each other. We also assigned our server a static IP in that network which is recommended before setting up Active Directory. Finally, we pointed the preferred DNS server to our Windows Server Machine. We'll install a DNS server later to handle DNS for our AD Domain.Installing Active Directory - Back to Windows ServerSo, we now have our domain controller ready (not entirely true but we'll fix that shortly), but we still need a domain for it to be in control of.Return to the Server Manager Dashboard, and this time, select option 2 from the middle list. It's the "Add Roles and Features" link. The "Add Roles and Features Wizard" should pop up.Click "Next >" on the "Before You Begin" page, then on "Installation Type" ensure the first option "Role-based or feature-based installation" is still selected and click "Next >"On the "Select destination server" page, you should see our Windows Server 2019 Machine, named ADAMDC, in the Server Pool list, and click next.In the "Server Roles" you'll want to check the "Active Directory Domain Services" box. (This is the whole thing we've been working towards).When you click that box, a new pop-up will appear confirming that you want to add the additional required services for AD.We do. Click "Add Features".Click "Next" through the "Features" page.That'll bring you to the Active Directory Domain Services information page. Give it a quick read, then click "Next >"This is it, the confirmation page. As Uncle Ben said, "With great power comes great responsibility." When you're ready, click "Install".The installation will start and run for a little, you can close out of the installer window if you want, but since we're already in a VM you can also just open up a different window on your host to watch youtube while we wait.After the installation completes, we still have a little more work to do. Remember earlier when I said we had our "domain controller" ready? Well, I might've lied a little bit, back then it was still just a lowly server. But I think our server has performed admirably so far, and is worthy of a promotion.Click the "Promote this server to a domain controller" link. If you closed out of the installation wizard, you can also find this link back in Server Manager.That will pull up the "Active Directory Domain Service Deployment Configuration Wizard" Select "Add a new forest" radio button, and I'm using the Root domain name: adamdomain.com. Which for the record, is a domain I do not own. This isn't something you'd want to do in a real-world install, but since this is just for our home lab I think it'll be fine.Leave Forest & Domain functional level at "Windows Server 2016", and add a (DSRM) password, I'm going to use P@ssw0rd! again since this isn't a real AD install. Then go to the next page.On DNS Options, uncheck "Create DNS delegation" and click "Next".Wait for the NetBIOS domain name to automatically detect your domain name then click "Next".Click "Next" again on the Paths page to accept the defaults.On the "Review Options" page, there isn't much for us to do, click "Next" and the Configuration Wizard will run a check script to ensure the Active Directory install can complete successfully on your machine.On mine, I got a warning about weak cryptography algorithms and a warning about our first network adapter (the VirtualBox NAT) not having a static IP.We can ignore those and click "Install". This will initiate the rest of the Active Directory installation process. This process might take a while to complete, and like some of the previous stages, will lock out and reset while it runs.Once the server finishes install AD and resets, you'll see the lock screen again. Enter "Ctrl + Alt + Delete", but this time, you should notice the login page looks different than before.This is part of the change from our Server being in a WORKGRUP into a Domain. Log in with our adminstrator credentials, those are still valid. Then when "Server Manager" starts up again, click "Local Server". It will take a couple moments for the information on the Local Server panel to update. but you should see that it now reflects our AD install.With that done, we now have Active Directory installed, we don't have any other users, or other computers connected to our Domain yet, but we can do those things in another write-up.One other thing that I noticed and found interesting through the install is that after the install was finished ICMP was enabled when prior to that it was not. If you had tried to ping our Windows Server Prior to the AD installation, you would've gotten "Destination Host Unreachable".Here's a ping from kali to our Windows Server post-install:It's easy enough to configure Windows Server to enable ICMP pings, but I always thought it was counter-intuitive (although probably a sensible default for security reasons) that it was blocked by default.Nmap still seems to have issues running a ping against our windows host though, a default scan returns "Host Seems Down", but adding the -Pn flag does show that our Windows AD Server is up and running, here's the results of a standard nmap -sC -sV -Pn scan from Kali.┌──(kali㉿kali)-[~] └─$ nmap -sC -sV 192.168.56.2 -Pn Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-03 16:39 EST Nmap scan report for 192.168.56.2 Host is up (0.00074s latency). Not shown: 989 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-03-03 21:40:22Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: adamdomain.com0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: adamdomain.com0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped Service Info: Host: ADAMDC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_nbstat: NetBIOS name: ADAMDC, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:a9:d5:db (Oracle VirtualBox virtual NIC) | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | smb2-time: | date: 2022-03-03T21:40:23 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 64.26 seconds

Network Security

What is Information Security?

unauthorized access. Information Security is basically the practice of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording, or destruction of information. Information can be physical or electronic. Information can be anything like Your details or we can say your profile on social media, your data on mobile phone, your biometrics, etc. This Information Security spans so many research areas like Cryptography, Mobile Computing, Cyber Forensics, Online Social Media, etc. During First World War, Multi-tier Classification System was developed keeping in mind the sensitivity of the information. With the beginning of the Second World War formal alignment of the Classification System was done. Alan Turing was the one who successfully decrypted Enigma Machine which was used by Germans to encrypt warfare data. Information Security programs are built around 3 objectives, commonly known as CIA – Confidentiality, Integrity, and Availability. Information Security is not only about securing information from Confidentiality – which means information is not disclosed to unauthorized individuals, entities and processes. For example, if we say I have a password for my Gmail account but someone saw it while I was doing login into my Gmail account. In that case, my password has been compromised and Confidentiality has been breached.Integrity – means maintaining the accuracy and completeness of data. This means data cannot be edited in an unauthorized way. For example, if an employee leaves an organization then in that case data for that employee in all departments like accounts, should be updated to reflect the status to JOB LEFT so that data is complete and accurate in addition to this only authorized persons should be allowed to edit employee data.Availability – means information must be available when needed. For example, if one needs to access information on a particular employee to check whether the employee has an outstanding number of leaves, that case, requires collaboration from different organizational teams like network operations, development operations, incident response, and policy/change management. Denial of service attack is one of the factors that can hamper the availability of information.Apart from this, there is one more principle that governs information security programs. This is Non repudiation. Nonrepudiation – means one party cannot deny receiving a message or a transaction nor can the other party deny sending a message or a transaction. For example, in cryptography, it is sufficient to show that message matches the digital signature signed with the sender’s private key and that sender could have sent a message and nobody else could have altered it in transit. Data Integrity and Authenticity are prerequisites for Nonrepudiation.  Authenticity – means verifying that users are who they say they are and that each input arriving at the destination is from a trusted source. This principle if followed guarantees the valid and genuine message received from a trusted source through a valid transmission. For example, take the above example sender sends the message along with a digital signature which was generated using the hash value of the message and the private key. Now at the receiver side, this digital signature is decrypted using the public key to generate a hash value, and the message is again hashed to generate the hash value. If the 2 value matches then it is known as valid transmission with the authentic or we say genuine message received at the recipient sideAccountability – means that it should be possible to trace the actions of an entity uniquely to that entity. For example, as we discussed in the Integrity section Not every employee should be allowed to do changes to other employees' data. For this, there is a separate department in an organization that is responsible for making such changes and when they receive a request for a change then that letter must be signed by a higher authority for example Director of the college and the person that is allotted that change will be able to do change after verifying his biometrics, thus timestamp with the user(doing changes) details get recorded. Thus we can say if a change goes like this then it will be possible to trace the actions uniquely to an entity.At the core of Information Security is Information Assurance, which means the act of maintaining the CIA of information, ensuring that information is not compromised in any way when critical issues arise. These issues are not limited to natural disasters, computer/server malfunctions, etc. Thus, the field of information security has grown and evolved significantly in recent years. It offers many areas for specialization, including securing networks and allied infrastructure, securing applications and databases, security testing, information systems auditing, business continuity planning, etc.

SEIM Technology

Top 10 SIEM Use-Cases

A managed SIEM lets businesses get on with their core activities while not fretting that hackers will undermine their efforts or suffer from data loss. Even organizations with the budget to build an in-house cybersecurity operations center by hiring the right skilled cybersecurity experts still struggle to find and retain skilled staff and turn to managed SIEM providers.Although SIEM tools are primarily used for security purposes, organizations should be aware of several other SIEM use cases, such as automated compliance management, operational performance monitoring, or log management.Detecting compromised user credentials:Ensure a use case and workflow is in place to detect any attempts to compromise user credentials through Pass the Hash, Brute Force, Golden Ticket, or other malicious methods. In case of a successful compromise, it is crucial to detect and identify the users and entities affected to investigate the impact of the compromise and prevent further damage.Tracking system changes:SIEM should have a set of appropriate use cases for flagging critical system events, such as unauthorized modifications to the configurations or deletion of audit trails. The SOC should escalate detected changes on high priority to stop the unauthorized change damage and minimize impact, as tampering with audit logs is always a red flag.Detecting unusual behavior on privileged:Privileged users, such as system or database administrators, have extended access rights, making them an attractive target for hackers. With a SIEM, analysts can keep a close eye on any actions these privileged users perform and look for unusual behavior that might indicate a threat or a compromise.Secure cloud-based applications:Cloud computing provides many advantages to an enterprise. Still, it also comes with several challenges, which include requirements to meet cloud security compliance requirements, implementing appropriate RBAC, improving user monitoring, or protecting against potential malware infections and data breaches. A SIEM should support the ingestion of logs from cloud-based applications configured as log sources. A few examples of cloud applications include Salesforce, Office365, Box, DropBox, Google Workspace, and AWS.Phishing Detection:Phishing is an attempt by bad actors to extract sensitive information used in fraud and impersonation. This includes attempts to acquire personal information, such as social security numbers, bank account numbers, or PIN codes and passwords. It is critical to ensure that these data types are protected across the entire organization. Phishing, especially spear phishing, is often used to gain initial access to a network. When receiving a phishing email, analysts can use SIEM to track who received them, clicked on any links in them, or replied to them, enabling them to take immediate action to minimize damage.Monitoring loads and uptimes:A SIEM system should have appropriate correlation rules and alerts to monitor system load, uptime, and response time on in-scope servers and services. 24x7 monitoring of critical infrastructure enables catching faults and overloads early, ensuring that downtimes and the cost associated with them are prevented.Log ManagementDatabases, applications, firewalls, security solution stack, users, and servers generate high amounts of Syslog data. A SIEM tool should normalize and centralize the collection of log data. This allows integrated analysis and security correlation from a single pane of glass, thus, allowing the IT security monitoring team to search through the data for specific keywords or values.SIEM for GDPR, HIPAA, or PCI complianceOrganizations are subjected to many compliance regulations, such as GDPR, HIPAA, or PCI. With a SIEM system, you can document when and by whom data was accessed, read, or copied, fulfilling compliance requirements and preventing violations.Threat HuntingThe process of actively searching for cyber risks in an organization or network is known as threat hunting. A threat hunt can be conducted in response to a security issue or to uncover new and unknown attacks or breaches. Threat hunting requires access to security data from all places across the company, which a SIEM can provide.SIEM for automationSIEM automates threat detection activities and provides the foundation for automated incident response. Forwarding security alerts and incidents to SafeAeon enables accelerated incident response by automating manual tasks, resulting in lower security costs and increased SOC productivity. Get in touch with us for a discovery session now.Explore Machine Data With Splunk

SEIM Technology

Why Signature-Based Detection Struggles to Keep Up with the New Attack Landscape?

Signature-based detection has been the cornerstone of the security strategy of organizations for a long. Thanks to rapid technological advancements, attackers constantly find ways to evade and subvert defense mechanisms and traditional security tools. So, signature-based detection techniques are not enough in today’s new and constantly evolving attack landscape. Read on as we delve into the reasons why signature-based detection is ineffective today in the emerging threat landscape. Attack Signatures An attack signature is a pattern/ footprint associated with a malicious attack/ attempt to breach a system/ application/ network/ device. They can be found within data sequences or headers that match known malware, source network addresses, destination, specific series of packets, etc. Indicators of Compromise (IOC)The IOC is at the core of signature-based detection techniques. IOCs are the breadcrumbs or forensic evidence that enable IT security professionals to detect malicious activities and potential intrusion into the system/ network/ application/ device. IOCs include known byte sequences, specific attack behavior, malicious domains, geographical anomalies, email subject lines, file hashes, spurts in database read volume, login red flags, system file changes, DNS request anomalies, unusual outbound traffic, etc. Signature-Based Detection Used for identifying known threats, signature-based detection is the process of monitoring inbound traffic to identify patterns and sequences that match attack signatures. Antivirus developers initially used signature-based detection techniques in scanning systems and identifying evidence of malicious activity, if any. Signature-based tools compare the incoming packets against this database and flag any suspicious behavior, operating with a pre-defined database of known threats and their IOCs. Inability to Identify Unknown ThreatsOne of the main drawbacks of a signature-based solution is its inability to detect unknown threats. They are especially ineffective against zero-day attacks as they rely on the database of known signatures and fingerprints. But zero-day attacks are unknown to the industry previously. Only after a zero-day threat hits or is discovered can they be researched about, and patterns identified.  Further, attackers develop newer attacks to modify the attackers and evade signature-based malware detection technology. If attackers change the byte sequence within malware or other threats, they can easily avoid detection. Even a novice attacker can modify the malicious code slightly to escape detection by generating new signatures while keeping the malicious functionality intact. These two data points put this in perspective:99% of malware is seen only once before being modified to create newer attack signatures! 450,000 new malicious programs are registered every day, surging up from 350,000 malicious programs per day in 2019! Reactive in Nature Signature-based detection is reactive, making it ineffective in the current threat landscape where security defenses must be proactive. Given the growing sophistication, lethality, severity, and cost of attacks, organizations need to prevent known and emerging threats before they can wreak havoc. Signature-based solutions depend heavily on constant updates and patches, and the capabilities and proactiveness of the vendor. If the vendor does not update the solution, it would be worthless. Shorter Attention Spans While Attackers Stretch Out AttacksSignature-based detection solutions have shorter attention spans. In other words, the time range over which traffic and request analysis is done to find obvious patterns is narrow – as short as sub-seconds to one or two minutes. So, the attackers have slowed down attacks. Instead of orchestrating attacks within seconds and minutes, they spend days and weeks building attacks. They spend ample time snooping around for weaknesses, testing exposed functionalities, and building attacks over a timescale longer than what traditional tools are built to analyze. Ineffective Against Blended, Multi-Vector Attacks Attacks in the current threat landscape are not unidimensional. Attackers leverage the best of technology to understand the context of the target to choose techniques and attack vectors that will bring them the best results. They use automation to analyze targets and look for loopholes. Signature-based detection fails to understand the context and connection between the interrelated events behind the attack. Further, it cannot offer real-time alerts and triggers to help IT security teams avert attacks.  Use of Evasion TechniquesModern-day attackers leverage evasion techniques to amplify their strategies and ensure greater effectiveness of the attacks. For instance, they constantly move the target to make it impossible for signature-based detection techniques to connect the dots and prevent intrusion. Further, if attackers encrypt traffic, they can completely evade detection. They could leverage massive botnets to distribute malicious activities across multiple hosts and IP addresses, throwing off signature-based solutions. 

Network Security

What Is Endpoint Security?

Endpoint security is the practice of securing endpoints or entry points of end-user devices such as desktops, laptops, and mobile devices from being exploited by malicious actors and campaigns. Endpoint security systems protect these endpoints on a network or in the cloud from cybersecurity threats. Endpoint security has evolved from traditional antivirus software to providing comprehensive protection from sophisticated malware and evolving zero-day threats.Organizations of all sizes are at risk from nation-states, hacktivists, organized crime, and malicious and accidental insider threats. Endpoint security is often seen as cybersecurity's frontline and represents one of the first places organizations look to secure their enterprise networks.As the volume and sophistication of cybersecurity threats have steadily grown, so has the need for more advanced endpoint security solutions. Today’s endpoint protection systems are designed to quickly detect, analyze, block, and contain attacks in progress. To do this, they need to collaborate with each other and with other security technologies to give administrators visibility into advanced threats to speed detection and remediation response times.What’s considered an endpoint?outside its firewall. Examples of endpoint devices include:LaptopsTabletsmobile devicesInternet of things (IoT) devicesPoint-of-sale (POS) systemsSwitchesDigital printersOther devices that communicate with the central networkBenefits of Endpoint SecurityProtection of valuable dataProtection of company reputation by avoiding data lossReduction of downtime associated with security breachesAbility to ID and fix security gapsImproved patch managementIncreased visibility into the devices connected to the networkEndpoint security tools bring numerous benefits. Securing sensitive and/or valuable data on the endpoints being managed by an endpoint protection system lends a measure of protection for a company's reputation (not to mention the protection against associated financial loss). And, by avoiding security breaches on their devices, end users avoid associated downtime as well. Endpoint security tools also help ID and fix security vulnerabilities, including those addressed by software patches. These tools also enable IT, teams, to identify and monitor devices connected to the network. Failing to manage such devices leaves them open to attack by hackers. the central network.Why endpoint security is importantAn endpoint protection platform is a vital part of enterprise cybersecurity for several reasons. First of all, in today’s business world, data is the most valuable asset of a company —and to lose that data, or access to that data could put the entire business at risk of insolvency. Businesses have also had to contend with not only a growing number of endpoints but also a rise in the number of types of endpoints. These factors make enterprise endpoint security more difficult on their own, but they’re compounded by remote work and BYOD policies—which make perimeter security increasingly insufficient and create vulnerabilities. The threat landscape is becoming more complicated, as well: Hackers are always coming up with new ways to gain access, steal information, or manipulate employees into giving out sensitive information. Add in the opportunity, cost of reallocating resources from business goals to addressing threats, the reputational cost of a large-scale breach, and the actual financial cost of compliance violations, and it’s easy to see why endpoint protection platforms have become regarded as must-haves in terms of securing modern enterprises.