Do you ever use the term, ‘you are creating a tempest in a teapot’? It…
Ever wonder why there are too many TMP files detected on an infected system? Even…
The focus is growing for the European Union’s forthcoming “General Data Protection Regulation,” or GDPR.…
On March 29th a file was uploaded to VirusTotal containing a fake Microsoft Update Authenticode…
Another great conference at the Moscone Center in San Francisco. On the heels of RSA…
Takeaways from a Recent Identity Survey by IDG It’s the infamous joke we’ve all used…
It was a great week leading the RSA Conference Security Operations Center (SOC) Team consisting…
After attending RSA Conference 2017 it was clear the theme – The Power of CommUNITY…
In today’s world, cameras are just about everywhere – in stores, on the streets, inside…
February 23, 2017 the European Banking Authority (EBA) released the Final Report of the Draft…
Another year, another RSA Conference. At this point, I have lost count of my appearances…
Imagine being in a place where everyone around you is smarter than you and are,…
From the days of Slammer, Stuxnet, Shamoon, etc., to the recent Ukrainian (black energy) Power Grid and “Panel Shock” Attacks, we are witnessing a sophisticated surge and advancement in the attack domains across industrial control systems. View Resource »
From the days of Slammer, Stuxnet, Shamoon, etc., to the recent Ukrainian (black energy) Power Grid and “Panel Shock” Attacks, we are witnessing a sophisticated surge and advancement in the attack domains across industrial control systems.
View Resource »
I’ve had the privilege of working in a few different SOCs at various maturity levels ranging from the stony shores of regulatory compliance – “Yes, we have a security solution”, to the deep shark-infested waters of a global enterprise under frequent attack by nation state-sponsored attack groups. Throughout all of these different engagements, I’ve worked at many skill levels, from junior / Level 1 analyst…
Azeem Aleem and Dave Gray Nothing will work if you are not serious about it – Sam Abell This blog is intended to take a different perspective (pun intended) of how we view our security platforms and how to go about rationalizing our Business-Driven Security™…
In an era of agile development and digital transformation, any application is subject to ongoing enhancement and improvement. Indeed, software engineering is a complex process with many interdependent tasks where multiple functions share responsibilities to strike a balance between software quality and business objectives, regardless…
John Ruskin, one of the great visionaries of the 19th century, said “Quality is never an accident; it is always the result of intelligent effort”, in our continuing journey through the lifecycle of a threat pattern, we are now at the testing phase. After analyzing requirements, asset and…
So far, we’ve discussed the first five keys to a successful identity assurance: business context, anomaly detection, machine learning, broader ecosystem, and consistent experience. Let’s close the series with an important topic for both end users and administrators: flexible authentication. Administration Flexibility When we think of providing flexibility for administrators, we focus on the authentication methods available based on data sensitivity and user context and…
If you are a fan of the CBS Show 60 Minutes you may have seen a couple of well-done episodes around the espionage and intrigue of spies hacking cell phones. The problem is that these episodes don’t go far enough informing the average user as to…
Your diverse, dynamic user base demands fast, convenient authentication and access—no matter where they are or what devices they are using. But you need authentication to be secure above all, with visibility across all applications and resources (cloud to ground),the assurance that your users are…
By Steve Mowll and Chris Williams Question: When it comes to the complexities of identity management, is what we try to do in identity management the problem or is it just inherently hard? Point: We might be making it harder than it needs to be.…
Several years ago, I was talking to an organization which had recently deployed risk-based authentication on its online customer portal. Based on their business model, I was especially curious to learn why they had selected to add consumer authentication to their website. The answer was simple, “It is a competitive advantage for us.” Fast forward to 2017, and in recalling that statement, it makes more…
Fraud risk management has become a burden in recent years, and not just because the attackers have gotten better at their game. The tools and technologies used to detect and mitigate fraud events are better, but they are also plentiful. A recent RSA survey found…
February 23, 2017 the European Banking Authority (EBA) released the Final Report of the Draft Regulatory Technical Standards on Strong Customer Authentication and Common Secure Communication for the Payment Services Directive 2 (PSD2). This final report heralded a welcome change in the EBA’s position on…
In my previous blog, Why Malware Installers Use TMP files and the Temp folder, I discussed the advantages malware can have by using atomic writes instead of simply copying the malware to the intended location. In this blog, I discuss how ransomware uses the same technique for its purpose and how it is different from…
On April 8th, an interesting DLL was uploaded from Canada to VirusTotal. What makes it interesting is that the detections on VirusTotal are mostly heuristics and do not settle on a single family. The malware is also configured to beacon to an RFC1918 internal IP address, however, the name 816db8a1916201309d2a24b4a745305b.virus indicates it was picked up…
A new variant of this tool, previously reported in 2013 by TrendLabs, was submitted to VirusTotal from the Philippines on March 27th, 2017. Its original filename, 2017.exe, was prescient since it has the ability to exploit CVE-2017-5638 and other previous Apache STRUTS vulnerabilities. File Details File Name: 2017.exe File Size: 107008 bytes MD5: …
On March 29th a file was uploaded to VirusTotal containing a fake Microsoft Update Authenticode certificate. Soon thereafter, RSA Research investigated the sample based on certain artifacts that matched those present on Shell_Crew malware RSA Research previously reported on. This Windows DLL file was compiled on October 28th, 2014 at 06:35:47 GMT (Table 1). File…
Exploit kits (EK) are a very popular with attackers to compromise a target system. The ease of use and its success rate compared to other infection vectors are among the reasons attackers are attracted to using these kits. In recent years, exploit kits were used to deliver ransomware, the most famous of which was the…
Ever wonder why there are too many TMP files detected on an infected system? Even if they have different names, the file are exact copies of one another, why? The first thing a malware installer (first stage of infection) does when executed on a target system – be it a dropper or downloader – is…
In an era of agile development and digital transformation, any application is subject to ongoing enhancement and improvement. Indeed, software engineering is a complex process with many interdependent tasks where multiple functions share responsibilities to strike a balance between software quality and business objectives, regardless of the specialized nature of the teams within the organizational…
Industrial Control Systems (ICS) attacks have a direct impact on people’s lives. The consequences of these attacks can be unpredictable, which is why ICS protection is a hot topic in security right now. Defining the right protection layer and best approach to secure communications in this environment is crucial. Historically, ICS departments operated independently from…
In previous posts we have discussed two of the most critical phases in the “The Lifecycle of a Threat Pattern”: analysis and design. In the analysis phase the objective is to fully understand the asset in scope by getting deeper into the context to formulate a set of residual risks to which the asset might be…
If you do not fully know the asset, how can you protect it? This is the first challenge security practitioners face during any activity, whether it is a penetration test, code review, risk assessment, or design of a threat pattern. In a previous post, author Davide Veneziano provided an overview of the building-block required to design a consistent…
