Cyber Defense

Cyberattack Techniques Matrix

2017-01-05T04:43:00.002+11:00

Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Execution	Collection	Exfiltration	Command and Control
Accessibility Features	Accessibility Features	Binary Padding	Brute Force	Account Discovery	Application Deployment Software	Command-Line Interface	Automated Collection	Automated Exfiltration	Commonly Used Port
AppInit DLLs	AppInit DLLs	Bypass User Account Control	Credential Dumping	Application Window Discovery	Exploitation of Vulnerability	Execution through API	Clipboard Data	Data Compressed	Communication Through Removable Media
Basic Input/Output System	Bypass User Account Control	Code Signing	Credential Manipulation	File and Directory Discovery	Logon Scripts	Graphical User Interface	Data Staged	Data Encrypted	Connection Proxy
Bootkit	DLL Injection	Component Firmware	Credentials in Files	Local Network Configuration Discovery	Pass the Hash	InstallUtil	Data from Local System	Data Transfer Size Limits	Custom Command and Control Protocol
Change Default File Association	DLL Search Order Hijacking	Component Object Model Hijacking	Exploitation of Vulnerability	Local Network Connections Discovery	Pass the Ticket	PowerShell	Data from Network Shared Drive	Exfiltration Over Alternative Protocol	Custom Cryptographic Protocol
Component Firmware	Exploitation of Vulnerability	DLL Injection	Input Capture	Network Service Scanning	Remote Desktop Protocol	Process Hollowing	Data from Removable Media	Exfiltration Over Command and Control Channel	Data Obfuscation
Component Object Model Hijacking	Legitimate Credentials	DLL Search Order Hijacking	Network Sniffing	Peripheral Device Discovery	Remote File Copy	Regsvcs/Regasm	Email Collection	Exfiltration Over Other Network Medium	Fallback Channels
DLL Search Order Hijacking	Local Port Monitor	DLL Side-Loading	Two-Factor Authentication Interception	Permission Groups Discovery	Remote Services	Regsvr32	Input Capture	Exfiltration Over Physical Medium	Multi-Stage Channels
Hypervisor	New Service	Disabling Security Tools		Process Discovery	Replication Through Removable Media	Rundll32	Screen Capture	Scheduled Transfer	Multiband Communication
Legitimate Credentials	Path Interception	Exploitation of Vulnerability		Query Registry	Shared Webroot	Scheduled Task			Multilayer Encryption
Local Port Monitor	Scheduled Task	File Deletion		Remote System Discovery	Taint Shared Content	Scripting			Remote File Copy
Logon Scripts	Service File Permissions Weakness	File System Logical Offsets		Security Software Discovery	Third-party Software	Service Execution			Standard Application Layer Protocol
Modify Existing Service	Service Registry Permissions Weakness	Indicator Blocking		System Information Discovery	Windows Admin Shares	Third-party Software			Standard Cryptographic Protocol
New Service	Web Shell	Indicator Removal from Tools		System Owner/User Discovery	Windows Remote Management	Windows Management Instrumentation			Standard Non-Application Layer Protocol
Path Interception		Indicator Removal on Host		System Service Discovery		Windows Remote Management			Uncommonly Used Port
Redundant Access		InstallUtil							Web Service
Registry Run Keys / Start Folder		Legitimate Credentials
Scheduled Task		Masquerading
Security Support Provider		Modify Registry
Service File Permissions Weakness		NTFS Extended Attributes
Service Registry Permissions Weakness		Obfuscated Files or Information
Shortcut Modification		Process Hollowing
Web Shell		Redundant Access
Windows Management Instrumentation Event Subscription		Regsvcs/Regasm
Winlogon Helper DLL		Regsvr32
		Rootkit
		Rundll32
		Scripting
		Software Packing
		Timestomp

2016 Gartner Magic Quadrant for Security Information and Event Management

2016-08-25T03:12:00.001+11:00

Evolution of Memory Storage

2016-07-21T01:58:00.002+11:00

Ransoware Discoveries

2016-04-14T03:18:00.003+10:00

Cybercrime in 2015

2016-04-14T03:17:00.002+10:00

Power of Certification ;-)

2016-04-14T03:16:00.002+10:00

Encryption of chat apps

2015-11-29T05:56:00.000+10:00

Security Leaders 2015

2015-11-29T05:46:00.002+10:00

CISSP per Country (June, 2015)

2015-09-06T08:13:00.000+10:00

Country	# CISSP
United States	65362
United Kingdom	5024
Canada	4456
Korea, Republic of	2775
Australia	1789
Netherlands	1692
India	1649
Japan	1420
Germany	1406
Hong Kong	1393
Singapore	1311
China	931
France	762
Switzerland	726
Spain	513
Sweden	461
United Arab Emirates	446
Belgium	411
Brazil	394
Finland	393
South Africa	388
Poland	372
Denmark	337
Ireland	323
Italy	320
Mexico	304
Israel	279
Malaysia	261
Taiwan	251
Saudi Arabia	249
Norway	192
Russian Federation	191
New Zealand	181
Thailand	174
Austria	160
Nigeria	145
Turkey	133
Hungary	130
Colombia	127
Argentina	121
Czech Republic	104
Indonesia	103
Romania	102
Egypt	101
Pakistan	93
Qatar	93
Greece	91
Philippines	80
Chile	79
Luxembourg	67
Croatia (local name: Hrvatska)	59
Portugal	56
Kuwait	54
Slovakia (Slovak Republic)	54
Sri Lanka	53
Kenya	47
Bahrain	44
Bulgaria	44
Puerto Rico	38
Uruguay	34
Serbia	32
Barbados	31
Cyprus	30
Peru	30
Trinidad and Tobago	30
Guatemala	27
Jordan	26
Latvia	24
Ghana	23
Costa Rica	22
Oman	22
Tunisia	20
Vietnam	20
Jamaica	19
Uganda	18
Estonia	17
Mauritius	17
Ukraine	17
Lithuania	15
Lebanon	14
Slovenia	14
Zimbabwe	14
Guam	13
Cayman Islands	12
Morocco	12
Kazakhstan	11
Panama	11
Bermuda	10
Curaçao	10
Macau	10
Macedonia, the former Yugoslav Republic of	9
Malta	9
Venezuela	9
Dominican Republic	7
Jersey	7
Ethiopia	6
Bahamas	5
Bolivia	5
Bosnia and Herzegovina	5
Ecuador	5
El Salvador	5
Iran (Islamic Republic of)	5
Montenegro	5
Botswana	4
Gibraltar	4
Mozambique	4
Tanzania, United Republic of	4
Zambia	4
Albania	3
Azerbaijan	3
Bangladesh	3
Honduras	3
Iceland	3
Monaco	3
Namibia	3
Senegal	3
Afghanistan	2
Andorra	2
Armenia	2
Cote d'Ivoire	2
Guernsey	2
Guyana	2
Isle of Man	2
Malawi	2
Moldova, Republic of	2
Palestinian Territory, occupied	2
United States minor outlying islands	2
Uzbekistan	2
Virgin Islands (U.S.)	2
Angola	1
Anguilla	1
Belarus	1
Belize	1
Bonaire, St. Eustatius, and Saba	1
British Indian Ocean Territory	1
Burkina Faso	1
Burundi	1
Cameroon	1
Chad	1
Congo, the Democratic Republic of the	1
Faroe Islands	1
Fiji	1
French Guiana	1
Georgia	1
Grenada	1
Guadeloupe	1
Haiti	1
Kosovo	1
Lesotho	1
Liechtenstein	1
Madagascar	1
Myanmar	1
Nicaragua	1
Paraguay	1
Reunion	1
Saint Barthélemy	1
Saint Kitts and Nevis	1
Saint Lucia	1
Seychelles	1
Virgin Islands (British)	1

We have arrived into the future

2015-01-07T10:28:00.004+10:00

After repairing the damage to history done by his previous time travel adventures, Marty McFly (Fox) and his friend Dr. Emmett "Doc" Brown (Lloyd) travel to 2015 to prevent McFly's future son from ending up in jail.

Here are 20 things Back to the Future II lied to us about:

1) Flying Cars

Obviously, it isn't just Doc's DeLorean that can fly. When Doc and Marty arrive at the future, they pop in going the wrong way on a highway — a highway at about 50 feet above the ground, complete with hovering signs and street lamps (although what the hell they're supposed to be illuminating is unknown, because there's obviously no street). Since there are plenty of cars on the ground of 2015 Hill Valley, I'm not sure if every car in the future could fly, but since absolutely 0% of the cars in 2015 can fly, it's kind of a moot point.

2) Mr. Fusion

Of all the inventions in Back to the Future II, Mr. Fusion would certainly have been the most useful. The time Home Energy Reactor transforms garbage — any garbage, apparently — into power via nuclear fusion. A clean, practically limitless source of energy that also gets rid of our trash? Back to the Future II, you are cruel.

3) Alpha-Rhythm Generator

Since Marty was with his girlfriend Jennifer when Doc picked him up to go to 2015, Jennifer got to tag along. And then she started asking questions. And then Doc zapped her with an sleep-inducing Alpha-Rhythm Generator, instantly rendering her unconscious. Since this is pretty much a Pocket Date Rape Kit, it's probably for the best it doesn't exist.

4) The Weather Service

Apparently the weather is on a strict schedule in 2015; Doc knows the exact time the pouring rain he and Marty arrive in will stop, thanks to the Weather Service, presumably a government agency that takes care of such things. Something tells me if the actual government were in charge of the weather, it would still be exactly as chaotic as it is now.

5) Rejuvenation Centers
I'm sure there are plenty of places calling themselves rejuvenation centers in 2015, but I bet they're mainly spas that offer massages and facials and such. The Rejuvenation Center Doc went to de-aged him 30 years, enough that he had to wear a rubber prosthetic when he picked up Marty so he wouldn't be baffled at Doc's newfound youth. This seems somewhat more useful than a massage.

6) Power Shoelaces

Since Marty needs to imitate his son to prevent him from ending up in jail, he has to dress like him, and this includes a pair of Nike Air Mags whose laces automatically constrict, essentially tying themselves for the wearer. Not only do we not have these, but Nike actually released replica Air Mags in 2011 with non-functional power laces. If the proceeds hadn't gone to the Michael J. Fox Foundation, it would have been a major dick move.

7) Self-Adjusting, Self-Drying Jackets

The other part of Marty's disguise? A jacket that adjusts to fit its wearer's body with the touch of a button. Obviously, it would almost certainly be more cost efficient to just buy clothes that fit, but the self-drying feature — which activated after Marty jumps in the town square's little lake — would be pretty groovy.

8) The U.S. Mail Fax Service

Like so many films of the ‘80s that tried to peek into the future, BttF2 was convinced of the eternal viability of fax machines — to the point that even public mailbox have fax machines. For the faxes you need to send on the go!

9) Gas Robots

In Bttf2, when you get your flying car filled up, a hovering robot actually fills the tank for you and then processes your transaction. In reality, not only do we not have robot workers pumping gas, he don't have human workers pumping gas either. We have to do it ourselves. That sucks.

10) Holographic Movie Theaters

Despite the fairly recent surge of popularity for 3D movies, we still don't have genuinely holographic movies like Jaws XIV. We also don't have holographic ads for movies, like the giant, 3D, incredibly obviously computer-generated shark that launches itself from the cinema marquee to chomp/promote itself to Marty. I'm more sad about the ads, personally.

11) Pepsi Perfect

In the ‘80s themed diner Marty visits, he orders a Pepsi, and the diner automatically gives him a Pepsi Perfect. I have no idea what makes Pepsi Perfect different from other Pepsi products other than its awesome container, but I'd say if there's one item on this list that might actually happen by 2015, Pepsi Perfect is it.

12) Suspended Animation Kennels

At one point, Doc mentions he left his dog Einstein in a suspended animation kennel. As a pet owner who is emotionally traumatized whenever I have to board my pet, I really, really wish these things were real.

13) Remote Hovering News Cameras
When Griff and his hooligans buddies are being led away from the courthouse they've wrecked by the police, a hovering news camera is instantly on the scene. It might not be a big deal for most people, but I imagine CNN and the other 24-hour news stations would kill for someone to invent these things.

14) Mobile Trashcans

When Doc needs to angrily throw the sports almanac away, a small trash can happily scoots by for him to conveniently put it in. Now, I'm pretty sure this trash can didn't know Doc needed it — that would take a great deal of AI that I'm pretty sure even the movie couldn't imagine — so I think these trash cans just wander around. How that's more useful than a stationary trash can that people know where to find, I don't know, but either way we still don't have them.

15) The Scenery Channel

This is the channel on the projected TV in future Marty's house, which simply displays a landscape. Honestly, since pretty much all TV providers have free music channels, I'm a little surprised no one's thought to include this as a feature. It's be better than watching E!, at least.

16) Chiropractic Hoverbelts

When Grandpa McFly arrives at Future Marty's house, he's thrown his back out. The solution? Some kind of belt — that attaches to leg cuffs — which floats and carries George McFly upside down. I'm not really sure of the science of how this works, but maybe 2015 knows something we don't.

17) Retractable Indoor Garden Center

Whenever a McFly wants a banana, he or she just reaches up and grabs one, like our primate ancestors might have. Of course, our primate ancestors were grabbing things out of trees, and the McFlys are grabbing them from their Indoor Garden Center, which comes down from the ceiling, and provides a variety of fruits and vegetables right of the vine/tree/whatever. Someone seriously needs to get around to inventing this.

18) Food Hydrators

Besides ceiling bananas, the other item the McFlys have for dinner is a pizza, fresh from the hydrator. Of course, the pizza that Grandma Lorraine puts in the hydrator doesn't look dehydrated, it just looks like a tiny pizza; however, the hydrator both enlarges the pizza and cooks it. With, uh… hydration, I guess.

19) Phone Glasses

Despite the prevlance of fax machines, Back to the Future Part II did actually have the foresight to recognize that people in 2015 would carry around small, portable, personal phones. Of course, BttFII thought these phones would also be sunglasses, but I'll still give them an E for effort.

20) The Cubs Will Win a World Series

The big headline on the day Marty arrives in 2015? The Cubs winning the World Series after a 107-year championship drought. Come on, Back to the Future II. Some things are just too ludicrous to ever believe.

The modus operandi of Sony attack 2014

2014-12-24T03:21:00.003+10:00

This was a coordinated attack targeting Sony Pictures Entertainment (SPE) and utilized a Server Message Block (SMB) Worm Tool to conduct cyber exploitation.
This SMB Worm Tool is equipped with a listening implant, lightweight backdoor, proxy tool, destructive hard drive tool, and destructive target cleaning tool.
The SMB worm propagates throughout an infected network via brute-force authentication attacks, and connects to a command and control (C2) infrastructure.
The malware has the ability to propagate throughout the target network via built-in Windows shares – this is what makes it a worm.
Based on the username/password provided in the configuration file and the hostname/IP address of target systems, the malware will access remote network shares in order to upload a copy of the wiper and begin the wiping process on these remote systems.
There are no callback domains associated with this malware since connections are inbound only on a specified port number.
- 131.222.102 / Thailand
- 96.33.164 / Poland
- 53.215.64 / Italy
- 87.126.116 / Bolivia
- 185.154.99 / Singapore
- 31.102.100 / Cypress
- 105.226.235 / United States

According to an FBI press release:

As a result of our investigation, and in close collaboration with other U.S. government departments and agencies, the FBI now has enough information to conclude that the North Korean government is responsible for these actions. While the need to protect sensitive sources and methods precludes us from sharing all of this information, our conclusion is based, in part, on the following:

Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks.
The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack.
Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea.

Some items of note (provided without any tinfoil hat, partisanship, or prejudice):

The wording is carefullyand purposefully used:
- “the FBI now has enough information to conclude that the North Korean government is responsible for these actions.” – note, this does not clarify whether the Republic of North Korea launched, ordered, encouraged, or simply commented on the action. The use of the word “responsible” is purposefully vague.
Correlation forcing causation:
- “there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks.” – bad guys share code and are notoriously lazy. They will use whatever it takes to get the job done. As such, code is borrowed from other attackers, purchased in underground markets, etc.
- “significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea.” – If you’ve ever seen a movie or television show where ‘hacking’ is depicted, you already know that attackers “hop” from server to server to conduct their nefarious activities. This is as much to hide their tracks as it is to leverage distributed resources.
- “the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea.” – again, similarities in tools and code are not enough to assign attribution.

The FBI, and other agencies, argue that the totality of the data is what makes them positive of the North Korean involvement.

The above components of the “total data” could be a false flag (http://en.wikipedia.org/wiki/False_flag) meant to push the investigation towards an uninvolved third-party. This would not be the first instance of false flag hacking attribution.

It is my recommendation that organizations make a conscious decision to refer to the breach simply as “The Sony Breach” and make no association to the Republic of North Korea, “cyberwar”, or “state sponsored attacks” when discussing this, and future breaches that may draw similarities.

The evidence provided thus far, or lack thereof, makes parroting and perpetuating this information irresponsible, at best, and potentially dangerous in extreme circumstances.

References:

- https://www.us-cert.gov/ncas/alerts/TA14-353A

- http://www.fbi.gov/news/pressrel/press-releases/update-on-sony-investigation

Attack components:

SMB Worm Tool:

This worm uses a brute force authentication attack to propagate via Windows SMB shares. It connects home every five minutes to send log data back to command and control (C2) infrastructure if it has successfully spread to other Windows hosts via SMB port 445. The tool also accepts new scan tasking when it connects to C2. There are two main threads: the first thread calls home and sends back logs (a list of successful SMB exploitations), and the second thread attempts to guess passwords for SMB connections. If the password is correctly guessed, a file share is established and file is copied and run on the newly-infected host.

Listening Implant:

During installation of this tool, a portion of the binaries is decrypted using AES, with a key derived from the phrase “National Football League.” Additionally, this implant listens for connections on TCP port 195 (for “sensvc.exe” and “msensvc.exe”) and TCP port 444 (for “netcfg.dll”). Each message sent to and from this implant is preceded with its length, then XOR encoded with the byte 0x1F. Upon initial connection, the victim sends the string, “HTTP/1.1 GET /dns?\x00.” The controller then responds with the string “200 www.yahoo.com!\x00″ (for “sensvc.exe” and “msensvc.exe”) or with the string “RESPONSE 200 OK!!” (for “netcfg.dll”). The controller sends the byte “!” (0x21) to end the network connection. This special message is not preceded with a length or XOR encoded.

Lightweight Backdoor:

This is a backdoor listener that is designed as a service DLL. It includes functionality such as file transfer, system survey, process manipulation, file time matching and proxy capability. The listener can also perform arbitrary code execution and execute commands on the command line. This tool includes functionality to open ports in a victim host’s firewall and take advantage of universal Plug and Play (UPNP) mechanisms to discover routers and gateway devices, and add port mappings, allowing inbound connections to victim hosts on Network Address Translated (NAT) private networks. There are no callback domains associated with this malware since connections are inbound only on a specified port number.

Proxy Tool: Implants in this malware family are typically loaded via a dropper installed as a service, then configured to listen on TCP port 443. The implant may have an associated configuration file which can contain a configurable port. This proxy tool has basic backdoor functionality, including the ability to fingerprint the victim machine, run remote commands, perform directory listings, perform process listings, and transfer files.

Destructive Hard Drive Tool:

This tool is a tailored hard-drive wiping tool that is intended to destroy data past the point of recovery and to complicate the victim machine’s recovery. If the CNE operator has administrator-level privileges on the host, the program will over-write portions of up-to the first four physical drives attached, and over-write the master boot record (MBR) with a program designed to cause further damage if the hard drive is re-booted. This further results in the victim machine being non-operational with irrecoverable data (There is a caveat for machines installed with the windows 7 operating system: windows 7 machines will continue to operate in a degraded state with the targeted files destroyed until after reboot, in which the infected MBR then wipes the drive.) If the actor has user-level access, the result includes specific files being deleted and practically irrecoverable, but the victim machine would remain usable.

Destructive Target Cleaning Tool:

This tool renders victim machines inoperable by overwriting the Master Boot Record. The tool is dropped and installed by another executable and consists of three parts: an executable and a dll which contain the destructive components, and an encoded command file that contains the actual destruction commands to be executed.

Network Propagation Wiper:

The malware has the ability to propagate throughout the target network via built-in Windows shares. Based on the username/password provided in the configuration file and the hostname/IP address of target systems, the malware will access remote network shares in order to upload a copy of the wiper and begin the wiping process on these remote systems. The malware uses several methods to access shares on the remote systems to begin wiping files. Checking for existing shares via “\\hostname\admin$\system32” and “\\hostname\shared$\system32” or create a new share “cmd.exe /q /c net share shared$=%SystemRoot% /GRANT:everyone, FULL”. Once successful, the malware uploads a copy of the wiper file “taskhostXX.exe”, changes the file-time to match that of the built-in file “calc.exe”, and starts the remote process. The remote process is started via the command “cmd.exe /c wmic.exe /node:hostname /user:username /password:pass PROCESS CALL CREATE”. Hostname, username, and password are then obtained from the configuration file. Afterwards, the remote network share is removed via “cmd.exe /q /c net share shared$ /delete”. Once the wiper has been uploaded, the malware reports its status back to one of the four C2 IP addresses.

Gestão Efetiva do Tempo

2014-12-10T22:09:00.003+10:00

Estabeleça suas metas e prioridades
Comece cada dia com uma lista de ações
Use tempo para gerar tempo
Consolide tempo para as ações importantes
Respeite o tempo dos outros
Delegue com responsabilidade
Não tome decisões com informação insuficiente
Invista seu tempo em assuntos que realmente importam
Separe tempo para o próprio desenvolvimento pessoal
Mantenha um registro semanal

O que eu aprendi com as mulheres

2014-11-27T00:47:00.003+10:00

Visão holística

Agilidade

Organização

Detalhismo

Sensibilidade

Versatilidade

Percepção aguçada

Multitarefa

Cuidado com a imagem

Humanismo

Decálogo da Liderança

2014-08-28T05:53:00.001+12:00

1. Faz o que fala

2. Mobiliza antecipadamente pessoas e áreas para atingir objetivos

3. Estabelece planos, metas e responsabilidades bem definidas

4. Saber ouvir, compreende e valoriza as diferenças

5. Promove discussões e dá liberdade para que as pessoas se expressem

6. É humilde para aprender e ouvir; interage com respeito, independente do nível hierárquico

7. Elimina etapas desnecessárias - que afetam os controles e a segurança - e reduz a burocracia

8. Promove uma comunicação aberta e frequente entre a equipe, com feedback e coaching (Dá feedbacks positivos e negativos sobre desempenho, comportamento e atitude com base em evidências e dados objetivos)

9. Celebra metas e objetivos atingidos

10. É verdadeiro - não diz "meias verdades"

White Hat Vs. Black Hat

2014-07-28T08:27:00.002+12:00

Have permission to test X Have no permission to hack

Knows how to break and to fix x Just knows how to break

PGP X IRC

Help the feds X Chased by the feds

Well paid X No (good ;-) job

Certifications X Internet search tools

Pro X Amateur

Ethic X No ethics

Positive development X Target of bullying

Socialized X Imbalance of social relations

Relevant content X Duplicate content

Complete sentences with good spelling and grammar X Invisible text and stuffed keywords

Business and non-malicious reasons X Violates security for little reason beyond maliciousness or for personal gain

With BYOD, Mobile Is The New Desktop

2014-07-25T23:00:00.000+12:00

Source: Bluebox

Global Cyber Attack Maps

2014-06-29T05:07:00.001+12:00

1 - Cyber Warfare Real Time Map by Kaspersky

2 - Top Daily DDoS Attacks Worldwide by Google

3 - Security Tachometer by Deutche Telekom

4 - Cyberfeed Live Botnet Map by AnubisNetworks

5 - Real-time Web Monitor by Akamai

6 - IpViking Live Map by Norse

7 - Honeypots from the Honeynet Project

8 - Global Activity Maps by Arbor

9 - Global Botnet Threat Activity Map by Trend Micro

10 - DDoS Attacks by ShadowServer

11 - Internet Malicious Activity Maps by TeamCymru

12 - Globe and WorldMap by F-Secure

10 Steps to avoid target attacks

2014-06-29T05:03:00.003+12:00

1. Remove the local admin privileges to avoid lateral movement and privilege escalation.

2. Detect vulnerabilities scans in your network.

3. Firewall rules should adhere to the principle of least privilege, remove the “any” firewall rules.

4. Monitor the admin and database activity.

5. Implement a malware detection tool.

6. Keep sensitive data encrypted.

7. Create a security engagement program and train your people to avoid social engineering attacks.

8. Perform the fine tuning of the current security tools before implement new tools and hardening all devices.

9. Implement a security in depth approach based in defensive zones.

10. Hire the best information security professionals with competitive salary package.

2013 Year of the Mega Breach

2014-06-20T03:07:00.003+12:00

Data breaches saw a 62% increase in 2013 over the previous year.
(Source: Symantec)

EMC Privacy Index

2014-06-17T11:50:00.001+12:00

Password Security Roundup

2014-05-30T01:42:00.001+12:00

https://www.dashlane.com/securityroundup

CISO Job

2014-04-14T05:26:00.002+12:00

The Cisco 2013 Annual Security Report & Security Intelligence Operations

2013-06-21T11:24:00.000+12:00

http://blogs.cisco.com/security/standing-up-to-threats-the-cisco-2013-annual-security-report-and-security-intelligence-operations/

How to use PGP to verify that an email is authentic ;-)

2013-03-22T07:14:00.000+12:00

http://xkcd.com/1181/

Disconnect to Connect

2013-02-26T05:46:00.002+12:00