I never thought I'd spend an evening reading about revenge porn the way I binge a Netflix series. But once I started, I couldn't stop. This isn't just a story about heartbreak or bad decisions, it's about control. Someone taking your trust, your privacy, your body, and using it against you. The harm isn't only in the exposure. It lingers in fear, in sleepless nights, in that gnawing feeling that something private is no longer yours.

Technology has made it easier, faster, and often invisible. Images can be copied, shared, manipulated, or turned into deepfakes that never involved the person at all. I found myself scrolling through articles, thinking about how fast this can happen, how little control people really have once their images are out there. The law has been trying to catch up, sometimes slowly, sometimes awkwardly, but it is catching up.

Across the UK and Europe, consent is everything. Sharing or threatening to share intimate images without it is a criminal act. UK law pulls together several statutes to define offences, protect victims, and hold offenders accountable. Even maritime workers and travellers far from shore are covered, I honestly didn't know that until recently.

The Online Safety Act 2023 updated the Sexual Offences Act 2003 to put consent front and centre. Sharing, threatening, or creating images without permission is illegal. Deepfakes are included. Penalties can reach two years in prison, and cases motivated by sexual gratification may result in sex offender registration. The law recognises that these abuses often happen within coercive or controlling relationships, which the Serious Crime Act 2015 addresses.

Earlier legislation laid the groundwork. The Criminal Justice and Courts Act 2015 made non-consensual sharing its own offence. The Sexual Offences Act 2003 criminalises voyeurism and secret recordings. The Police, Crime, Sentencing and Courts Act 2022 added protections against upskirting and filming someone breastfeeding without consent. Reading all this, I felt a mix of relief and frustration, relief that the law is recognising the seriousness, frustration at how long it took.

Campaigns and technology also play a role. Refuge's "Naked Threat" campaign, the Georgia Harrison Campaign, the government backed "Not Enough," and the End Violence Against Women Coalition shine a light on abuse. StopNCII.org, developed by SWGfL, helps prevent images from spreading on participating platforms. Police campaigns provide guidance, reassurance, and advice. I even took some time to explore these resources, and it struck me how many people have been affected and supported. Realising the breadth of help available reminded me that reaching out isn't a weakness, it's a step towards reclaiming control.

Support exists. The Revenge Porn Helpline, Refuge, Women's Aid, Internet Matters, and the National Domestic Abuse Helpline all offer practical advice, emotional support, and help navigating the legal system. The Police provide protection, record and investigate the offence, gather evidence and act against the person responsible. Every part of the support system echoes the same message: responsibility sits entirely with the person who chose to harm, and victims are never at fault

Protections are growing across Europe too. Italy's Red Code law carries penalties of up to six years. Ireland covers real and synthetic images. Belgium, the Netherlands, Malta, Poland, Portugal, and Sweden criminalise non-consensual sharing. France, Germany, and Spain include deepfakes under privacy and sexual-violence laws. So many countries are catching up.

Civil protections like GDPR add another layer. Digital images are personal data, and misuse is a serious violation. People can request deletion, stop processing, challenge AI-generated likenesses, and seek compensation. Privacy isn't optional, it's a right.

Distance doesn't remove responsibility. Jurisdiction at sea follows the ship's flag, location, and nationality of those involved. UK-flagged ships are treated as UK territory, so UK law applies even in international waters. Coastal states can assert authority within twelve nautical miles. Some countries prosecute citizens for

offences committed abroad. The UN Convention on the Law of the Sea ensures that distance doesn't give anyone a free pass.

Cybersecurity can't erase abuse, but it can restore some control. Strong device locks, encrypted backups, two-factor authentication, careful app permissions, encrypted folders, monitoring logins, and reverse-image searches all help maintain autonomy.

Revenge porn exists where technology, human behaviour, and social power collide. UK and European law treat it seriously. Campaigns demand accountability. Support networks provide guidance. Maritime law ensures offenders can't escape responsibility. As AI, deepfakes, and synthetic imagery advance, protections must keep evolving too.

At the heart of this is one truth: everyone deserves control over their image, privacy, and life. Respect and dignity aren't optional. The law and support systems exist to protect those rights and help people reclaim them. Reading about all this reminded me just how much these protections matter, for everyone.

CyberIsle, the Isle of Man's premier cyber security conference, returned for its seventh year, continuing its tradition as a leading forum for knowledge-sharing and collaboration. Hosted by the Office of Cyber Security and Information Assurance (OSCIA -IoM), this one-day annual event brings together experts, innovators, and thought leaders to explore current and emerging trends in the cyber security landscape through keynote presentations, panel discussions, and interactive sessions.

CND was proud to be part of CyberIsle 2025. Our consultants actively engaged in panel discussions and gained valuable insights from other distinguished speakers. This year, we were thrilled to have our Senior Penetration Tester, Charles, join forces with our CTO, Jeff, to deliver a dynamic and thought-provoking presentation "Beyond the Breach," that sparked meaningful conversations among attendees.

The evening before the conference, CND attended the Networking Dinner—a fantastic opportunity to connect with both new and familiar faces in the industry. These informal exchanges set the stage for a day of collaboration and learning.

CyberIsle continues to be an essential event for advancing cyber security awareness and best practices, and we look forward to supporting CyberIsle 2026.

Top Tip - Start Looking Early in Your Second Year

So, you're a university student dreaming of a third-year cybersecurity placement. You've survived fresher's week, learned that "phishing" isn't about trout, and mastered the art of submitting assignments 3 minutes before the deadline. Progress!

But now comes the real boss level: finding a cybersecurity placement.

But here's the twist; if you wait until the end of your second year to start looking, you're already late. The cybersecurity world moves fast like, "patch-it-before-it's-breached" fast. So, let's get cracking in your second year, shall we?

You could sit back, relax and wait for the university to come up with the goods, this is typically the university's Careers Service, Employability Team, or a dedicated Placements Team. In some cases, individual academic departments (such as Engineering or Computer Science), also have their own placement coordinators or officers who work closely with students and employers.

However, all too often students are left high and dry and at the last minute, have to shorten their 4 year degree to a 3 year degree without a placement year. So what? I hear you ask, aside from having to accept the dregs of the remaining student housing. For an employer, a graduate who has completed a placement year can hit the ground running, having gained some invaluable commercial experience and will definitely have an edge over their 3 year graduate competitors.

In addition to providing cyber security services, we also own the UK's oldest independent cyber security recruitment agency, and despite the alleged shortage of cyber security professionals in the UK, we have found that there are far too many graduates looking for work than there are jobs for them, a placement year may not only give you an edge commercially, but the cyber skills you develop during your placement may result in you achieving a higher final grade. 

Step 1: LinkedIn Is Your New Social Life

Yes, it's time to stop binge-watching conspiracy documentaries and start binge-connecting with professionals. Update your profile. Add keywords like "cybersecurity," "threat hunting," and perhaps not "I promise not to hack your coffee machine." Bonus points if you've done a Capture the Flag (CTF) and didn't cry.

Yes, a profile picture is a must have, and no, your profile picture shouldn't be you in a nightclub, LinkedIn isn't Facebook. Even if the nightclub is hosting a DEFCON afterparty. 

When reviewing LinkedIn profiles for prospective staff, we often look at their activity, what have they posted, liked or commented on. Your activity on LinkedIn is public, and can provide a positive and negative perspective on what you are about.

Step 2: Slide Into DMs (But Make It Professional)

Here's the golden rule: don't wait for job boards to do the work, or even your university. Reach out to companies directly. Send emails. Message professionals. Be bold, be polite, and for the love of encryption, spellcheck.

Example:

"Hi, I'm a second-year cybersecurity student looking ahead to my placement year. I'm passionate about cybersecurity and have a knack for [insert skill eg spotting vulnerabilities]. I looked at [insert company name] and love what you do, especially [insert key detail]"

It's confident. It's clear. It's better than "Hi, do you have jobs?" Which is surprisingly common and never successful.

Make sure you spell the company name correctly! You would be amazed about how many prospective placement students lack this ever essential attention to detail in their rush to apply to as many companies as possible.

Finally, make sure it's you that makes the approach and not a well meaning relative, afterall, it's you that will be employed, not your ever helpful Uncle Herbert. If you attend a trade show or cyber conference with a relative, such as BSides and speak to the sponsors looking for a placement, don't let your relative dominate the conversations about you, it won't reflect well. 

Step 3: Learn Stuff (Before You're Asked About It)

Let's be real: companies aren't offering placements entirely out of the kindness of their firewalled hearts. They're paying you a wage, giving you access to their systems, and trusting you not to accidentally email the entire company with "test123." That said, they know that you are only 2 years in, and aren't expecting a 31337* hacker.

So, show them you can hit the ground running.

Brush up on the basics. Know your OWASP Top 10 from your top 10 Spotify tracks. Be knowledgeable about the basics such as networking and protocols, unless you want your placement interview to last exactly 12 minutes.

And if you don't know something? That's fine, just be honest and show you're actively learning. That's code for "I watched a YouTube tutorial five minutes ago and now I'm dangerously confident."

Remember: the more you know before you start, the less likely you are to break something expensive. And that's exactly what companies want — a student who's curious, capable, and not a dangerous liability with admin access. 

Interlude - Ancient Cyber History, who says this isn't educational!

*31337 = eleet = elite. Was originally a term for extremely capable hackers in the 90's and as a result, then used as the favoured hacker port for Back Orifice, a backdoor application that lets hackers remotely read and write files on Windows computers, this was improved (BO2K) by the Cult of the Dead Cow in 2000, numerous crudely named plug-ins were written, called Butt Plugs

The plug-in ButtFunnel allows you to ping sweep for BO-Infected Computers through a Back Orifice infected computer

The plug-in ButtTrumpet upon activation, will fire off an email to a predetermined SMTP server and email address

The plug-in ButtSniffer 'sniffs' passwords, filters packets, from the Back Orifice infected computer.

Back in the day, "Back Orifice" wasn't just a cheeky name, it was the go-to party trick for cyber security professionals who wanted to wake up a room by showing just how easily things could go wrong. Fast forward to today, and just uttering the word "cyber" is enough to send half the audience into a deep, peaceful slumber, despite the fact the threats are more real than ever. Twenty-five years ago, if you gave a talk about "computer security" (because "cyber" hadn't been invented yet), you could practically watch the audience stiffen up with boredom, rigor mortis by PowerPoint! The crude but humorously named elements of Back Orifice were a life saver, and helped to awaken an audience to the threat.

Note: if you have Googled for Butt Plug and ended up here, you are almost certainly in the wrong place!

Step 4: Be a Cyber Detective

Companies love initiative. So, stalk (ethically) their websites. Find out what they do, who they work with, and whether what they do peaks your interest. 

Tailor your message. If they specialise in defence, talk about national security. If they work with banks, mention fraud detection. If they sell socks rather than SOCs… maybe try another company. 

Also, consider the locations of their offices, CND have offices in the UK and Isle of Man, but we only take placement students in the Isle of Man, and if tropical beaches and palm trees aren't your thing, you may wish to look elsewhere! Seriously though, look at accommodation costs for where you are applying, as most placement student employers don't pay for accommodation.

Top Tip: Prioritise placement applications near your home town and move back in with Mum & Dad. If that sounds like a living hell after becoming feral at uni, perhaps approach your favourite Aunty for her spare room.

Step 5: Stay Hydrated and Don't Panic

Rejections will happen. Ghosting will happen. You'll send an email and hear nothing but the sound of your own sobbing. It's fine.

Keep going. Keep learning. Keep reaching out. Don't let rejection reduce the quality of your approaches.

And remember: every cybersecurity expert started somewhere, possibly in a hoodie, surrounded by empty coffee cups, wondering why their Python script won't run. 

If you are as truly awesome as you obviously are, afterall you're reading this blog, then you may have a number of opportunities, don't immediately accept the first, but hold out (not too long) and select the best for you.  Also, don't try to haggle for more money, unless you truly cannot afford to accept, nor should you pitch potential placement opportunities against each other, otherwise you may end up with none.

Step 6: Try Before You Buy

A placement year gives you an opportunity to see if this employer is where you would like to end up when (if) you graduate. This works both ways, the employer will be evaluating you for the same reason throughout the placement.

Final Tip: Ask your lecturers, alumni, relatives, or even your nan (she might know someone from her bridge club who works in cyber). You never know. 

CND's Annual Placement Schedule

September. We start taking applicants for a start the following June, you will receive a fact finding call from our Team, this is your chance to ask logisitcal questions about the placement. 

December. If shortlisted, you will have a remote technical interview, this is your opportunity to ask about what you will be doing, we will try to include the current placement student on the call. Don't even think about using AI!  

January or February. Finally you will have a face to face formal interview in the UK near Bath, after which you will be informed about whether or not you have been selected.  You will be introduced to the current placement student as your mentor.

June. Start your placement, we will try to have a 2 week overlap with the previous placement student to show you the roles and around the Isle of Man.

Boston here we come! For those who've not yet had the opportunity to travel to a Splunk .conf event, it really is an event to behold. Big corporations with stock market listings are often necessarily conservative and perhaps, a bit dull. Splunk has none of that going on, if you're a cyber security professional this is a great annual occasion to really look forward to.  

Boston Vs. Vegas

Two CND consultants were travelling out this year to .conf which had moved from Las Vegas to Boston, Mass. USA. This was very welcome, not just for a shorter flight and cooler time of year but Vegas can be a lot esp. at 45°C in the height of summer. Dare I say it also had a more professional feel to it in the vast Boston convention centre; there's something about walking past inebriated individuals flushing their cash away at a slot machine in Vegas that doesn't sit well on the walk into a tech conference. I covered conf23 in Vegas here (URL).  

Day 1: Keynote

Big on our list of goals this year was to get to grips with the very significant changes in Splunk Enterprise Security 8.x and of course I can't get past the introduction without a nod to Artificial Intelligence (is it AI or just ML?). Splunk is of course now a Cisco company and so the key note speeches (URL) on the opening day by the general manager, Kamal Hathi talked about the integrations and alignments with Cisco products. A good example of this product alignment was the announcement on free Splunk license metering for Cisco firewalls which could be quite attractive for enterprises using Cisco firewalls (personally I never enjoyed administrating them, not very admin friendly compared to competitors such as Palo Alto or Juniper).

There was also a significant focus on the concept of a Splunk Cloud data lake and the necessity of this at hyperscale (or ludicrous as Kamal put it) to train AI models on threat detections centrally across customers. It sounds very sensible but I was left unconvinced that many customers would sign up for this despite promises of anonymised data. What did impress upon me through the speech, (URL) was the scale up in data bandwidth, data processing, CPU requirements and storage that the AI changes will bring about. It did present as a real paradigm shift forwards in the IT industry that the cyber industry needs to help protect, and with cyber professionals hard to train and recruit, turning to AI tooling to support this volume tsunami has to be part of the solution.

Day 2: Platform announcements and Tech sessions

Splunk Enterprise Security 8 was released last year and I think it fair to remark that it wasn't the smoothest landing; for a start there have been a lot of changes to terminology used with a table of past and present terms now required; even as an accredited ES admin I have found it tricky to remember the nomenclature changes for example a 'Correlation Search' is now an 'Event-Based Detection'. Another challenge was the underlying KVstore and MongoDB changes from 4.x to 7.x, this is not strictly ES but it has been lumped in with the ES changes.

ES 8.1 was released to coincide with conf 25 and all the headlines sounded very exciting e.g. 66% faster UI through improved efficiencies, runbooks and response plans integrated to the SOC workflow and version controlled detection tunings all built into an enhanced UI through Mission Control. I was very keen to get ES 8.1 installed and tested; many of the technical sessions myself and my colleague would attend related to ES. 

SEC1123: Enterprise Security 8.1: Enhanced Detection and Investigation for the SOC

This was an interactive session that was fully subscribed and included interactive labs working directly on the new ES version. It was good but somewhat rushed and as the first session out of the gate after key notes it felt somehow distracted. Regardless it was good to get hands straight onto the new product. (URL)  

SEC1638: From Request to Response: Mastering Security Data Onboarding

This session by Splunk Security Architect Duncan Goff was straight-forward but landed really well. The key here is that often customers just try to wedge in all their data without necessarily considering the use case and lifecycle for it. Granted if it is DNS or firewall logs then it almost always makes sense to onboard, but other log types should be considered and have a runbook for actions on, associated with it. Duncan walked us through the OMM framework which definitely left an impression on us for use during consultancy. (URL inc. video)

SEC1337 – Splunk Enterprise Security 8: AI Era Defence for Modern SOC's

Presented by Marquis Montgomery who is a bit of a legend within Splunk having been a principal contact for ES for many years and he used to deliver the platform training. I was really looking forward to this session detailing ES 8.1 changes. I would summarise my takeaways as:

• AI is highly likely to be leveraged in malicious attacks
• SOC's are already overwhelmed, unmanageable volume of alerts
• ES 8, intended to be unified TDIR platform platform
• Better signal to Noise / Richer Context / Faster decisions
• Updated use case library
• Detection versioning, allows non-destructive editing of the default mode
• Also adds a detection diff view, side by side code view
• Full featured editor mode
• Enrichment with Threat Intelligence & SOAR Automation
• TruSTAR built into ES8 for intelligence feeds
• Playbooks for SOAR now built into ES8.1 (premium), this is great as it will give real working exposure on SOAR playbooks and practices.
• Response plans, helps standardise the workflow and organisational SOP's means docs are not elsewhere and with assignable given tasks, allowing collaboration.
  
  

Session slides (URL) Session Video (URL) 

SEC1668 – Blazing-Fast Security Ops: Unleashing Splunk ES 8.0 for Speed and Scale

Another session covering ES enhancements, really detailed on some methods to improve performance. Slides (URL), Video (URL). My summary:

• Focus on performance and scale
• How Splunk can help you
• How you can self help
• Performance ingredients
• ES (Front End (JS), Search (SPL), Backend (Python), KVStore
• Platform ( Web server, Search infra, Layout and API's)
• 4 Pillars
• Goal: Fast detection / Fast time to ack / Scale with Growth in data
• Pillar: Experience (how analysts interact with the page, speed of load, analyst queu)
• Pillar: Efficiency (parallel load, ms load times, SID caching etc)
• Lean KVstores, this will also impact replication
• Pillar: Velocity (API optimisations, custom commands are only on SH, Macro, distributed to peer tier) this is 15x faster.
• Cost of enrichment, macro was invoking enrichment, index= was 50% faster.
• The outcome was to remove 5 lookups, 10 joins and then 30% faster than it was.
• Enrichments can be expensive to achieve
• Ask what search we can do on the IDX instead of just the SH
• - Up to 67% faster overall in ES 8 with all the combined improvements

DEV1136 – Everything you didn't know about metrics in Splunk Platform

 I think metrics is taught very minimally through the Splunk professional education course, or certainly was when I went through it in 2020. I've never had a customer ask me about it either but I appreciate that for some events this could be a far better fit and more efficient licence meter wise. This was an interesting session that focused a little bit on hacks to wedge more data into a metric index and still cap out at 150bytes. Interesting side knowledge even if not immediately usable. Slides (URL), Video (URL). My notes:

# Metrics

• floating point number storage
• Max of 150 bytes per events
• multimetric format, can lead to savings on licence ingest

• Metrics only store to the second by default, not sub-second
• Licensing:
• Metrics different, more complex and can be more expensive
• Metrics do use less disk space, can be up to 4x less.
• Metrics have no _raw journal file, unless you have an IDX cluster
• Can be means to improve the stored search
• strings.data and merged_lexicon.lex
• These perform differently in metrics
• Can use HEC, this allows the index, host, source, sourcetype
  

• New command, very efficient

Happy Hour in the Pavillion

Having sat through 5 lectures it was good to cutaway to some of the novel / fun exhibits at conf including a guitar stand simulating a manufacturer monitoring production with a Splunk edge hub. It was all good fun and genuinely relaxed, great to meet other spelunkers whom we'd worked with over the years. There was even a novel beer dispenser with a Splunk dashboard, I may have partaken.

Day 3: Tech Sessions and Search Party

The day started early on another very pleasant day in Boston, I'd been out early and run to Bunker Hill and back on the Freedom trail covering some 9km. We took the bus down to the conference centre which was only about a mile and a half from the hotel district where many Splunkers were staying. The sessions started at 0830 and you could feel the energy of people cutting around trying to get to their sessions in good time. I started with SEC1494.  

SEC1494 – Splunking around the Phishmas Tree

An easy start to the data with an engaging presenter who talked through an investigative process using domain data an custom search to pivot on Threat Actor data to locate domain generation algorithms that matched a given TA. I really enjoyed it and it got us thinking about search efficiency and alternative methods. I did point out that using a custom command prevents streaming searches to the indexer tier, which can be inefficient at scale. Slides (URL), Video (URL).  

DEV1408 – Transform Splunk Enterprise Management with Integrate CI/CD pipelines

Using Git and CI/CD practices when managing Splunk conf files, TA's and Apps is a key skill and a usual part of any given Splunk PS day for me. I would also add that all my more successful clients are using git, whilst those who are not tend to struggle locating and maintaining their golden source of code and prone to more config errors.

I was keen to see how others maximise their efficiency and usage of Git. In some ways this session was more introductory and covered how one US company and their internal Splunk team use git. It was good, but the presenter was not using best practices and just using the default 'search' app for hosting all their saved searches, they should have created their own discrete organisation app and probably split this into several discrete elements. Regardless I enjoyed the session. Slides (URL), Video (URL)

SEC1474 – Splunk and MITRE ATT&CK: Everything Covered? How We Know.

This covered some interesting points around coverage and exposure. Again it walked security engineers back to really looking at what data they have, what their threats are and then identifying which detections they need to fill in a gap analysis type method. My notes?

# finding and labelling data

• What Data Source ID's from MITRE are we associating with?
• In Security essentials there is a lookup that we can use

<pre>

| inputlookup mitre_enterprise_list

</pre>

## ADS framework

• standard for documenting detections
• https://blog.palantir.com/alerting-and-detection-strategy-framework-52dc33722df2
• https://github.com/palantir/alerting-detection-strategy-framework

Session slides (URL), Session video (URL).

SEC1224 – Mastering the Detection Engineering Lifecycle: From Data Ingestion to Detection Triumph

This was one of my favourite sessions and the two women who presented were clearly very strong technically and experienced, it was a pleasure to listen to and made me want to go away and really work through detection engineering. I took a lot of notes in this class, too many to repost in full here but if you just pick one video to watch from conf this would be it. Class (URL), awaiting video at time of writing. A summary of my notes:

## Detection Lifecycle: Key Stages and considerations

• Define the objectives
• What are we trying to find?
• Identify the requirements
• What is necessary in the environment to achieve the objective?
• How do we go about detecting X
• What log sources do I need for the detection
• Is the data complete
• Does the data need to be enriched or correlated with TI?
• What detection logic should I use? Whats the response plan on detection
• Implementation, Testing & Validation
• Continuously Monitor and tune
• What is the lifecycle of this detection, how do we maintain it?
• Reporting and Metrics
• How effective is this detection engineering
• How do we report our coverage and effectiveness?

PLA2018 – Deployment Server Reunion Tour

This was sadly the last session I attended and was somewhat more casual hosted in one of the theatre areas on the main conf floor. Essentially a lot has changed on the DS in the past few years and no longer do you have to awkwardly scale the DS via a sort of waterfall method using 'noop' as taught in core implementation. There is now an inbuilt scaling facility that can be readily used. I'd be keen to lab this out as it is a rare thing to implement at scale at a client. Session slides (URL).  

Search Party

I love that Splunk hire a band or singer to close out their conferences, in the past they've had Gwen Stefani, Snoop Dogg and others! This year they had the band Weezer and rented the MGM Music Hall at Fenway Park baseball stadium. It was a neat venue and despite being filled with nerds (yes, myself included) it had a hum of energy and fun around it. Whacky dancers with CRT tellies on their heads cut about throwing shapes, and themed cocktails flowed freely. We had a great time and tried to start a mosh pit to Enter Sandman which was covered and enjoyed a good social with fellow Splunkers. Great end to the conference and particularly enjoyable this year.

I was very surprised on Tuesday to receive a nudge from a fellow Splunk Professional Services (PS) consultant, saying that Splunk 10.0 had been released overnight with almost no fanfare or mention. Splunk first released their Data-to-Everything platform in 2004 and has been ingesting data logs as the leading SIEM tool, trusted by corporations, governments and other organisations globally since.

As a PS consultant, my colleagues and I are always eager to try the new features which hopefully makes our job easier and improves the usability and security posture of the organisation we are working to support. New major Splunk versions are typically released every few years and version 9.0 was released back in June 2022 and version 8.0 in October 2019. Patch releases and minor features are released incrementally, typically every 6-10 weeks approximately.

So this morning I set about one of our lab instances running 9.4.3 and set to upgrade it to 10.0.0,

Read the docs!

Engineers and admins can be lazy or blasé when it comes to reading manuals; I like to think I'm very diligent in this matter and always check the docs before an upgrade particularly at a client site. However mistakes do happen, and I was caught out in Splunk 9.4.0 at the start of this year when support for linux changed from being kernel version based to Linux OS based. The 'so what' being that Red Hat Linux (RHEL) version 7.0 was quietly dropped, and only by digging into the sub-page of system requirements was this noticeable. 

Lesson learned without pain thankfully, and I always recommend clients upgrade their standalone or test environments first so that we can adequately assess the changes alongside their hardware, storage and OS. 

Did I mention, Read the Docs: Welcome to Splunk Enterprise 10.0

Key changes:

Depending on the size of your organisations' Splunk deployment and the maturity of it, will probably influence what really matters to you in terms of features and changes. There are several new Federated search elements which is not something many of my clients have made use of, but MSP's or multi-national organisations may have particular use cases for federated search. 

Features I found notable: 

• mTLS (mutual Transport Layer Security) - Useful for organisations looking to secure logs data transiting to the Splunk indexer tier.
  
  
• OpenSSL 3.0 - Transit security enhancement, replacing older OpenSSL versions.
  
  
• RBAC changes, fine-grained access - Previously when decided on role based access, admin_all_objects was the sledgehammer option in some circumstances. This can provide junior admins or users which a greater level of access than they need. 
  
  
• Python 3.9 - This is a major change and it has been a gripe for some app developers that 3.7 (which is quite niche and deprecated) was still being used. When preparing apps for cloud and using a virtual environment for development this can be a pain, so I'm pleased to see this and I hope this will see the start of more regular alignment with newer Python versions.
  
  
• Forwarders (Agents), Effective configuration - Forwarders (endpoints with the UF agent package) tend to be under the administrative remit of different engineering teams in most organisations. This means that you more often than not, need to pickup the phone and ask a favour to check the config on an endpoint or ask for some code to be pushed out to an endpoint. These new changes should mean that config is available to inspect right from the Splunk Enterprise UI. This could be a real timesaver and reduce admin effort. Note that Splunk has renamed forwarders to Agents in the settings menu, see below. 
  
  
• Bulk Data Move - This is somewhat interesting but constrained to S1 (standalone) Splunk instances, and allows data to be moved from one index to another to live in a more logically index. Perhaps this will be expanded to clusters in future, which may prove useful as organisations grow their Splunk environment.

Supported platform changes:

Splunk has an aggressive software support policy, I really admire this and at 24 months it means admins must stay on top of their patching through a little and often approach. Too often in the technology industry we are forced to deal with legacy products and operating systems that are well past their death date. I did support a client last year that was in a real mess with Splunk Enterprise version 7.x on their servers, and Splunk UF 6.x on their endpoints. This lead to a recursive dependency cycle problem between apps, platform and OS and we had to adopt a rapid upgrade and fix-forward approach to get them in a good position after an MSP had effectively let them down. The point of this is that I encourage my clients to be upgrading or reviewing the patch releases every 4-6 weeks and keeping a beady eye on the advisory page for any CVE's that need patching, note a series of critical >9 CVSS scores mainly  related to GoLang in June this year.

The big changes this cycle appear to be:

• Removal of support for Ubuntu 20.04
• Removal of RHEL 7 (I mentioned this being less obvious in 9.4.x)
• Windows, there are probably some changes. But please, don't run Splunk Enterprise on Windows, you're just losing out on performance potential.

Wrapping up

I'm keen to explore some of the changes discussed, notably Forwarder / Agent management and visibility, this could be significant for admin teams. I'll also be reporting back from Splunk .Conf in Boston this September where CND will be sending at least two Professional Services consultants, do get in touch if we can help you with the items raised here.

As our company name, Computer Network Defence Ltd, suggests, we monitor business networks and catch computer hackers. When an incident is detected, we need our highly trained analysts to investigate the activity and triage the threat as quickly as possible.

We feel this is best achieved by embracing diversity in all its forms, we don't want our Security Operations Centre to be filled with 20 something year old white males from the same town, we need our analysts to bring different ways of thinking in the hope that one of them will hold the solution to what they are seeing. Someone who has grown up in Mogadishu will have a different risk appetite to someone from Morecombe, a female analyst will have a different approach to a male analyst, and on it goes through culture, sexuality, neurodiversity, etc.

The only thing all of our staff need is respect for one another's capabilities and of diversity in all its forms, (we don't fulfil quotas around diversity, we appoint on capability). We ask every candidate at final interview for their perspectives on diversity in the workplace. Everyone is free to have their own opinions, but in the workplace their views must be expressed in a respectful way. 

Terminology

• Neurodiverse = a group with varied neurological profiles, such as neurotypical and neurodivergent.
• Neurodivergent = an individual whose brain diverges from the neurotypical norm.
• Neurotypical = describes an individual whose brain functions in a way that is considered typical or standard by societal norms.

Neurodiversity

Front and centre of our diverse workforce is embracing neurodiverse staff. Information Technology and Cyber Security fortunately appears to attract a disparately large number of neurodivergent candidates as the industries suit their positive attributes.

Of our 50 staff we estimate around 40% are neurodivergent, (diagnosed and undiagnosed) and they bring many great qualities over and above lateral thought, some of the positive qualities for the more common neurological difference types are detailed below

Types of Neurodiversity

Neurodiversity encompasses a range of neurological differences, including but not limited to:

• Autism Spectrum Disorder (ASD)
• Attention Deficit Hyperactivity Disorder (ADHD)
• Dyslexia
• Dyspraxia

Positive Attributes of Neurodivergent Employees

Autism Spectrum Disorder (ASD)

• Attention to Detail: Individuals with ASD often excel in tasks requiring precision and accuracy.

• Strong Focus: They can maintain concentration on tasks for extended periods.

• Logical Thinking: Their approach to problem-solving is often systematic and logical.

Attention Deficit Hyperactivity Disorder (ADHD)

• Creativity: ADHD individuals are often highly creative and innovative.

• Energy and Enthusiasm: They bring a high level of energy to their work.

• Multitasking: They can handle multiple tasks simultaneously.

Dyslexia

• Big Picture Thinking: Dyslexic individuals often excel in strategic thinking and seeing the overall picture.

• Problem-Solving: They are adept at finding unique solutions to problems.

• Verbal Communication: Many dyslexic individuals have strong verbal communication skills.

Dyspraxia

• Resilience: Dyspraxic individuals often develop strong coping strategies and resilience.

• Creative Problem-Solving: They can think outside the box to overcome challenges.

• Empathy: They often have high levels of empathy and understanding.

...

Challenges Faced by Neurodivergent Employees

 While neurodiverse individuals bring many strengths to the workplace, they may also face challenges:

• Autism Spectrum Disorder (ASD): Social interactions and communication can be difficult. They may also be sensitive to sensory stimuli
• Attention Deficit Hyperactivity Disorder (ADHD): Maintaining focus on a single task can be challenging.
• Dyslexia: Reading and writing tasks may be more difficult.
• Dyspraxia: Coordination and motor skills may be impaired.

Preparing The Workforce and Workplace for Working with Neurodivergent Staff

Within Computer Network Defence Ltd we looked at ways we could improve the workplace for all staff including those who are neurodivergent, and implemented the following:

1. Education and Training: Foster a culture that acknowledges and celebrates the benefits of neurodivergent staff while acknowledging the challenges. Provide training to all employees about neurodiversity.
2. Flexible Work Environment: Create a flexible work environment that accommodates different needs, such as quiet spaces or adjustable work hours.
3. Support Systems: Implement support systems, such as mentoring programs and employee resource groups.

Adapting the Interview Process for Neorodivergent Staff

1. Relax: Create a welcoming and relaxed interview environment, tell them about the structure, who they will be meeting, some of our neurodivergent candidates visit the location ahead of the interview.
2. Clear Communication: Use clear and straightforward language in job descriptions and interview questions.
3. Stress Reduction: We will send the candidates some of the questions ahead of the interview to reduce their anxiety and allow them to prepare their answers.We also invite candidates to complete a pre-interview questionnaire which gives the candidate the opportunity to request interview adaptations – such as additional time

Conclusion

By embracing neurodiversity, organisations can tap into a wealth of unique talents and perspectives, fostering innovation and creating a more inclusive and dynamic workplace.

Introduction

Microsoft 365 offers powerful collaboration and productivity tools, but default settings often leave numerous security gaps. This post aims to highlight five common misconfigurations we frequently encounter in our audits, along with practical steps to address them. During this post, we'll look at the following five areas:

• Security Defaults

• Conditional Access Planning

• Guest Invite Settings

• User App Consent Settings

• External Collaboration Settings
  
  

This is not exhaustive but hopefully aims to highlight some key areas for improvement across your tenant. 

Security Defaults: Helpful Intentions, Harmful Limitations

Microsoft introduced Security Defaults to help organisations without dedicated IT teams get a baseline of security features enabled. When turned on, Security Defaults enforce a standard set of policies like MFA (multi-factor authentication) for all users and block legacy authentication protocols. Security Defaults are enabled by default for all new tenants.

While this is a good starting point for ensuring a base layer of protection, Security Defaults are not designed for flexibility or scalability. For businesses with more complex needs or desire to control their own identity security, Security Defaults can often be more of a constraint than a benefit. 

The Main Issue Relying on Security Defaults

Security Defaults do not allow organisations to take fine-grained control over their identity security and with Security Defaults enabled, it prohibits the use of Conditional Access policies. Ultimately, this leaves organisations without the ability to build policies that suit their use cases and needs.  

Don't Disable Security Defaults Blindly

 Disabling Security Defaults does open the door to greater control, but that door swings both ways. Without a clearly defined and well-executed Conditional Access strategy, it's easy to accidentally weaken your organisation's overall security posture.

Bottom line: If you're planning on disabling Security Defaults, have a plan and act on it immediately. That starts with designing Conditional Access properly, not just creating a few policies, but thinking it through and following a well-designed framework. Utilise 'report-only' mode where appropriate to put policies in an audit mode to gather statistics and remediate blocks before flicking the switch. 

Conditional Access: Not Just "Set and Forget"

 We've spoken about Conditional Access above, but Conditional Access is arguably the most powerful tool in Microsoft 365's security toolkit, however, it only delivers value when it's planned, maintained, and aligned to your business needs.

A common issue we see in audits is that Conditional Access policies are:

• Unstructured: Created reactively over time without a coherent strategy

• Overlapping: Multiple policies apply to the same users with conflicting or redundant rules

• Forgotten: Policies are enabled once and never revisited, even as the business evolves

• Exception without Supplemental Coverage: Exceptions happen; however, users or groups are often included in an exception without supplemental policies to reduce the attack surface of the exception

Why a Strategic CA Design Matters

 Poorly planned Conditional Access can lead to:

• Access gaps: Users bypass MFA due to policy exclusions or misalignment

• Operational friction: Legitimate users are blocked or slowed down, leading to productivity loss and policy pushback

• Unmanaged growth: "Policy sprawl" leads to hard-to-audit, hard-to-maintain environments
  
  

Following a planned approach or a framework can help clarify your Conditional Access policies and keep your policies organised and clear to their intent.

One of the recommended ways to achieve this is to adopt personas for your users in your organisation. Identifying user groups and identifying the applications and resources that they require access to, from where and on what device, will help to streamline your deployment.

An example of a few personas may be Internals, Externals, Devs, Admins, Emergency Access. Don't hesitate to use sub-sets where required too! 

Our Recommendations

• Determine your personas ahead of time

• Utilise report-only mode first before deployment

• Leverage a clear naming convention

• Monitor sign-in logs and policy impacts regularly

• Follow up exceptions with suitable supplemental policies

• Implement what works for your organisation

Guest Invite Setting Defaults: Who's Inviting Whom?

By default, Microsoft 365 tenants allow all users to invite external guests into the tenant. While collaboration is a core benefit of Microsoft 365, this setting poses a real risk when not managed correctly.  

What This Means

Any user either intentionally or accidentally can invite an external user (e.g. a personal email address, contractor, or competitor) into the tenant. That guest could then be granted access to files, Teams channels, or SharePoint sites.  

Why This Is Risky for Businesses

• Lack of visibility and control

• Potential for data leakage

Recommendation: Restrict Guest Invites

In the Entra portal:

Identities > External Identities > External Collaboration Settings, under Guest invite settings change the setting to:

• "Only users assigned to specific roles can invite" — This will mean only users with certain roles assigned will be able to invite guests into your tenant.
  
  

This ensures that guest access is deliberate, auditable, and controlled. 

User App Consent Settings: A Backdoor You Didn't Notice

Another commonly overlooked area is user consent to applications. By default, Microsoft 365 allows users to consent to third-party applications requesting access to their Microsoft 365 data (e.g. Outlook, OneDrive, Teams).  

What's the Risk?

• A user can unknowingly grant a malicious app access to their email, calendar, or files

• Once consented, dependant on the permissions these apps can read data, send mail on the user's behalf, or exfiltrate information

How App Consent Works

 When an app is registered (either by a developer or third party), it can request OAuth permissions to read or manage user data. If users are allowed to approve these requests, a single click can lead to a wide-scale breach.

Recommendation: Restrict User Consent

 Navigate to Entra > Enterprise Applications > Security > Consent and permissions:

• Toggle this to "Do not allow user consent"

• Ideally utilise the Admin Consent Workflow to allow users to request access, which must be approved by an appropriate admin
  
  

Additionally, regularly audit consented applications in your environment to ensure applications are known and trusted, also checking the permissions and authentication methods these applications hold.

External Collaboration Settings: Everyone Is Welcome… by Default

When you first spin up a Microsoft 365 tenant, the external collaboration settings are wide open. That means:

• You can share files, folders, or sites with any external domain

• No restrictions are applied to guest domains or user types

• The defaults for file sharing permit the creation of anyone links
  
  

This is great for collaboration speed—but terrible for data protection and governance.

Risks of Allowing All Domains

• Anyone with a public email address (e.g. Gmail, Outlook) can become a guest

• Increased likelihood of data leakage

Recommendation: Implement a Safe List or Block List

In Entra > External Identities > External Collaboration Settings > under Collaboration restrictions, configure:

• Allow invitations only to the specified domains (most restrictive)
  
  

This setting ensures that only those users from known and trusted domains can be invited to collaborate with, greatly reducing the chance of accidental data oversharing and data exfiltration. 

Wrapping Up

In this post, we've hopefully shone a light on a few common misconfigurations that with a few small changes can provide organisations with an increased security posture. A lot of these settings are often found at their defaults, indicating that organisations aren't aware of the risks they face until it's too late.

If you'd like help securing your Microsoft 365 tenant or want to explore your configuration in more depth, get in touch for a tailored audit or review. 

Lets start with what is CAPTCHA?

CAPTCHA is an acronym that stands for "Completely Automated Public Turing Test to tell Computers and Humans Apart" and is a type of challenge-response test used in computing to determine whether the user is human, and in doing so deter bot attacks and spam.

Everybody that uses the internet regularly would have received many of these challenges in the past and never encountered an issue. However they can also be used with malicious intent. This activity is not isolated to malicious websites, and in recent weeks we have seen an increase in legitimate sites that have been compromised and which present a fake CAPTCHA screen to the end user.

The ultimate aim of the attacker is to get unsuspecting users to fall victim to crafted CAPTCHA/ Verification error messages in order to infect user devices to exfiltrate data for a variety of reasons that may include the theft of bit coin wallets, passwords, browsing history data or personally identifiable information.

This initial access technique first reported in 2024, is proliferating due to its efficacy and comes in different guises, with the end goal to install malware on the users asset. A large amount of incidents are reporting the LummaStealer malware as the payload but this is not unique.

The process that the exploit follows in an incident identified by CND is detailed below:-

After a short period of time browsing an infected website, the user receives a fake CLOUDFLARE CAPTCHA screen asking them to verify that they are human. See Figure 1.

  Upon checking the 'Verify you are human' box a second pop up screen is presented. See Figure 2.

This window encourages the user to click the "Fix It" button suggesting it will start Windows Defender and fix the issue.

Upon clicking the "Fix It" button, a third window is displayed that presents instructions for the user to complete. See Figure 3.

What has happened in the background by clicking the "Fix It" button is that it has copied a PowerShell script into your clipboard. PowerShell is a powerful command line tool and scripting language for managing and automating tasks and we shall return to the script in a moment. 

Figure 3 shows the user being asked to complete the following key combination to complete the fix. Windows + R and then Ctrl + V, followed by Enter. The Windows + R command opens a 'Run' box and Ctrl + V pastes the PowerShell script from the clipboard that was placed there by hitting the "Fix It" button. The user then executes the PowerShell command by selecting Enter.

The PowerShell script could be anything that the attacker has written, but in recent weeks the script retrieves a malicious file from another website, which is downloaded and installed on the users asset.

By following the key combination from Figure 3, this user initiated activity bypasses web browser controls, which may have otherwise prevented the download from occurring.

This attack downloads and installs legitimate tools alongside malicious files as part of the infection process and part of the malware installation process includes a persistence technique that ensures that the files are run every time the machine is restarted.

The files are predominantly installed and run in the C:\Users\(Username)\ AppData\Local directories although other files were installed in Temp folders. CND observed the malicious payload creating and storing a .lnk file in the users Start Up folder.

Mitigation of this type of threat starts with user training. Ensuring staff are aware of the threat increases their understanding of this type of attack and minimises the likelihood that they would be enticed to complete the keyboard instructions necessary for this attack to be successful.

Additionally, it is advised that browser history retention is minimised where possible to limit the amount of data that could be exfiltrated. Removing the ability to access the 'run' dialogue box and 'cmd' prompt is also recommended to prevent this attack deceiving users into unintentionally executing the PowerShell command.

In the event that the attack was successful, the asset should be removed from the network at the earliest opportunity. As the payload downloaded by the PowerShell command may differ from attacker to attacker analysis of the assets logs is imperative to identify the malwares follow on TTP's.

Where possible a full forensic investigation of the infected asset should be considered to identify the extent of any data breach and if the breach contains data that would necessitate disclosure to the relevant authorities.

Any Indicator of Compromise identified through the investigation process such as Command & Control IP addresses/ URL's, should be considered for inclusion in any future monitoring and identification processes that you have on site. Consideration should also be given to releasing this information to the OSINT community.

The affected user should change all of their passwords regardless of whether they are stored in the browser or a password manager.

Finally, before the asset is reintroduced to the network, it should be flattened and rebuilt with a fresh image. The level at which the device is wiped depends on a multitude of factors such as the type of malware initially installed, the level of persistence introduced, etc.

Upon reintroduction of the new user asset, their account may require enhanced monitoring for a period of time to ensue that any details stolen by the attacker are not used to regain access to the account.

In conclusion, a simple yet effective tactic is gaining popularity amongst threat actors targeting unsuspecting users. This initial access type allows threat actors to install their malware and carry out nefarious activities that may bypass existing security measures. Educating users about this threat type is imperative to enhance the security of your network. 

Introduction

In a significant development for social media users in the EU, the Appeals Centre Europe (ACE) has been launched to handle complaints against major platforms like Facebook, TikTok, and YouTube. This new independent body aims to streamline dispute resolutions under the EU Digital Services Act (DSA), providing users with a centralised mechanism to address content moderation issues. The establishment of ACE marks a pivotal moment in the regulation of social media platforms, enhancing accountability and transparency in content moderation practices.

What is ACE and How Does It Work?

The ACE was established on 8 October 2024, with funding from Meta Platforms' Oversight Board Trust. Certified by Ireland's media regulator, Coimisiún na Meán, and based in Dublin, the ACE will serve as a one-stop shop for dispute resolutions. It will be operational by the end of 2025 and will be financed by fees imposed on social media companies for each case reviewed. Users will pay a small fee to file a dispute, which will be reimbursed if the decision is in their favour. The ACE will review cases within 90 days to ensure platform decisions align with their content policies.

The establishment of ACE represents a significant step forward in the regulation of social media platforms. By providing a centralised and independent body to handle complaints, the ACE aims to enhance accountability and transparency in content moderation practices. This is particularly important given the growing concerns about the impact of social media on public discourse and individual rights.

Which Appeals Can ACE Help With?

The ACE will handle a variety of complaints related to content moderation on social media platforms. This includes disputes over content removal, account suspensions, and other moderation decisions. By providing a centralised mechanism for these complaints, the ACE aims to make it easier for users to seek redress without going to court. However, it is important to note that online platforms may refuse to engage with the ACE, as the body cannot impose binding settlements.

The types of appeals that ACE can help with include:

• Content Removal: Users can appeal decisions to remove their posts or content.
• Account Suspensions: Appeals against temporary or permanent account suspensions.
• Policy Violations: Disputes over alleged violations of platform policies.
• Other Moderation Decisions: Any other decisions made by platforms that users believe are unfair or inconsistent with the platform's policies.

By handling these types of appeals, the ACE aims to ensure that content moderation decisions are made fairly and transparently, and that users have a clear and accessible path to challenge decisions they believe are unjust.

Can All Social Media Users Appeal?

Initially, the ACE will cover complaints against Meta's Facebook, ByteDance's TikTok, and Alphabet's YouTube. Over time, more social media platforms will be included. Users from these platforms can file complaints if they believe that content moderation decisions have been unfair or inconsistent with the platform's policies. The ACE's remit ensures that all users, regardless of their location within the EU, have access to this dispute resolution mechanism.

The inclusion of multiple platforms under the ACE's remit is a significant development, as it ensures that a wide range of users can benefit from its services. This is particularly important given the diverse user base of these platforms and the varying content moderation practices they employ.

Impact on Social Media Companies

The establishment of the ACE has significant implications for social media companies. They will need to engage with this new body and potentially face increased scrutiny over their content moderation practices. The financial implications include fees for each case reviewed by the ACE, which could add up given the volume of complaints. This development may prompt companies to enhance their content moderation policies and practices to reduce the number of disputes.

For social media companies, the ACE represents both a challenge and an opportunity. On the one hand, they will need to invest in improving their content moderation practices to reduce the number of complaints. On the other hand, the ACE provides a clear and structured process for handling disputes, which could help to enhance user trust and confidence in their platforms.

User Benefits

For users, the ACE offers a streamlined and accessible way to resolve disputes with social media platforms. This is particularly beneficial compared to traditional court proceedings, which can be lengthy and costly. The ACE's 90-day review period ensures timely resolutions, and the reimbursement of filing fees if the decision is in the user's favour adds an extra layer of fairness. Overall, the ACE aims to ensure that content policies are applied fairly and impartially.

The benefits of the ACE for users include:

• Accessibility: A centralised and independent body to handle complaints.
• Timeliness: A 90-day review period for resolving disputes.
• Fairness: Reimbursement of filing fees if the decision is in the user's favour.
• Transparency: Clear and transparent processes for handling complaints.

By providing these benefits, the ACE aims to enhance user trust and confidence in social media platforms, and ensure that content moderation decisions are made fairly and transparently.

ACE's Board of Directors

The ACE will have a board of seven non-executive directors, including three from Meta's Oversight Board: Cherine Chalaby, Catherine O'Regan, and Marie Wieck. The additional four non-executive directors will have no relationship to any social media company or entity funded by a social media company, ensuring the independence of the body. This diverse board aims to bring a balanced perspective to the oversight of content moderation practices.

The inaugural CEO of ACE, Thomas Hughes, is a former executive director at digital rights advocacy organisation Article 19 and a former director of Meta's Oversight Board. Hughes has emphasised the importance of having an independent body to ensure that platforms' content policies are fairly and impartially applied. His leadership is expected to guide the ACE in establishing robust processes and maintaining its independence from both governments and social media companies.

Challenges and Future Outlook

While the establishment of ACE is a significant step forward, it is not without challenges. One of the primary challenges will be ensuring that social media companies engage with the ACE and comply with its decisions. Since the ACE cannot impose binding settlements, its effectiveness will largely depend on the willingness of platforms to participate in the dispute resolution process.

Another challenge will be managing the volume of complaints. Given the large user base of platforms like Facebook, TikTok, and YouTube, the ACE may face a high number of disputes to review. Ensuring timely and fair resolutions will require efficient processes and adequate resources.

Looking ahead, the ACE aims to expand its remit to include more social media platforms. This expansion will enhance its ability to provide a comprehensive dispute resolution service for users across the EU. Additionally, the ACE may serve as a model for similar initiatives in other regions, promoting greater accountability and transparency in content moderation practices globally.

Conclusion

The launch of the Appeals Centre Europe (ACE) marks a new era for social media complaints in the EU. By providing a centralised and independent mechanism for dispute resolution, the ACE enhances user rights and ensures fair application of content moderation policies. This development underscores the importance of accountability and transparency in social media practices, benefiting both users and the broader digital ecosystem.

As the ACE becomes operational, it will play a crucial role in shaping the future of content moderation and user rights in the EU. By offering a fair and accessible platform for resolving disputes, the ACE can help build trust between users and social media companies, ensuring that content policies are applied consistently and transparently. This initiative represents a significant step towards a more accountable and user-centric digital environment.

Overview

This blog post introduces the concept of emergency access accounts—what they are, why they're essential, and how to manage them securely, including recent recommendations for authentication. The post will focus on M365 controls but the general concepts can be taken away.

What are Emergency Access Accounts?

An emergency account, sometimes called a "break-glass" account, is an administrative account intended strictly for emergency use. It's designed to provide "all-access" in situations where standard admin credentials are unavailable.

Why Use Emergency Access Accounts?

Emergency accounts are essential for maintaining access during unexpected outages or critical events. Some scenarios where they may be needed include:

• Network outages or hardware failure
• Service issues beyond your control
• Natural disasters affecting trusted IP locations
• Sudden loss of privileged accounts
• Malicious attacks on your accounts
• Accidental lockouts due to configuration changes

This list is not exhaustive but highlights common situations where emergency accounts can prevent or mitigate access issues.

Best Practices for Secure Configuration

Emergency access accounts are highly privileged and typically exempt from routine policies. To ensure they remain secure yet accessible when needed, follow these best practices:

1. Create Two Emergency Access Accounts
   Provisioning two emergency accounts is recommended. This allows redundancy and alternating dependencies for authentication, adding control and flexibility. Use secure authentication methods distinct from those used by standard admin accounts.
   Account Naming: The account name (e.g., breakglass01 or john.smith) is less critical than its role, so don't get too caught up on it! However, using non-descriptive names adds a layer of obscurity. Regardless, each account will still hold the Global Admin role.
   Domain suffix and Syncing: Emergency access accounts should use the default *.onmicrosoft.com domain for your tenant. They should not be federated or synced from on-premises environments to maintain independence from potential local failures.
2. Exclude from Most Conditional Access Policies
   To ensure availability during emergencies, exclude these accounts from all but a few essential conditional access policies. While it's important to protect these accounts, applying restrictive policies could inadvertently lock them out. You may want to enforce phishing-resistant MFA or restrict one account to specific office IP addresses or device GUIDs for an additional layer of security.
3. Assign the Global Admin Role Permanently
   During emergencies, access should be immediate and straightforward, without requiring role assignments. Permanently assigning the Global Admin role minimizes delays and reduces complexity under pressure.
4. Limit Password and MFA Device Availability
   Emergency account credentials should be unique, long and securely stored. Ideally, these accounts would be passwordless, eliminating the need to know the password. However, if a password or security key is required, restrict access to only those who absolutely need it, likely excluding most of your day to day IT team. If passwordless is being utilised the security key or passkey should be made unavailable to most users, locked away and only accessed when required.
5. Implement Strong, Phishing-Resistant MFA
   With new MFA enforcement policies in Azure and Entra portals, it's advisable to implement phishing-resistant MFA methods, such as FIDO2-based passkeys or passwordless options. Configure conditional access policies to require these robust authentication methods for these accounts.
6. Enable Monitoring and Alerting
   Activate monitoring and alerting for emergency access accounts to notify you or your security team of account usage. This enables timely detection of unexpected activity and quick investigation. Ideally, these accounts should only be accessed for periodic testing or in real emergencies.
7. Conduct Testing
   Finally, regularly test access to these accounts. There's nothing worse than being in an emergency to find your accounts can't actually login and help during the event you've prepared for. A simple login and permission check is all that's needed to make sure the accounts are ready when you need them.

Whilst this is not an extensive list of best practices it should get you started to correctly configuring and securing emergency access accounts within your tenant!

Summary

Emergency access accounts are a critical safeguard in ensuring access continuity during crises. Following the best practices above provides a foundation for securing these accounts while maintaining their availability. For more assistance with secure Microsoft 365 tenant configuration, emergency accounts or general tenant security, feel free to reach out to CND.

Introduction

In a landmark decision, the European Union's top court, the Court of Justice of the European Union (CJEU), has ruled against Meta's data retention practices. This ruling has significant implications for how Meta, and other Ad-funded social networks, operate within the EU. The decision enforces the data minimisation principles of the General Data Protection Regulation (GDPR), which could lead to substantial changes in data handling and privacy practices across the industry.

Background of the Ruling

The CJEU's ruling stems from a long-standing legal challenge against Meta, initiated by privacy advocate Max Schrems. The court determined that social networks like Facebook cannot indefinitely retain user data for Ad targeting purposes. This decision aligns with the GDPR's requirement for data minimisation, which mandates that personal data should only be kept for as long as necessary for the purposes for which it was collected.

The case against Meta has been ongoing for several years, highlighting the complexities and challenges of enforcing data privacy regulations on a global scale. The GDPR, which came into effect in 2018, has set a high standard for data protection, and this ruling reinforces the importance of compliance with these regulations. The decision is a significant victory for privacy advocates and sets a precedent for how data retention practices should be managed by social media companies.

What Information Does Meta Hold?

Meta collects a vast array of data from its users, including personal information, browsing habits, and interactions across its platforms. This data is used to create detailed profiles for targeted advertising. The types of data collected include:

• Personal Information: Names, email addresses, phone numbers, and other contact details.
• Behavioural Data: Information about user interactions, such as likes, shares, and comments.
• Browsing Data: Data on websites visited, search history, and online activities.
• Location Data: Information about the user's location, gathered through GPS and IP addresses.

This extensive data collection allows Meta to offer highly personalised advertising services, which are a significant source of revenue for the company. However, the CJEU ruling emphasises that such extensive data retention practices must be curtailed to comply with GDPR. This means Meta will need to implement strict data retention limits and ensure that only necessary data is kept for the shortest time possible.

Scams have been around for as long as people have been trading, but the rise of the internet has opened the floodgates for increasingly sophisticated cons. One of the latest and most devastating types is known as the "pig butchering" scam. Despite its unusual name, it doesn't have anything to do with farm animals. It's a financial fraud that preys on victims' emotions and trust, building a relationship before draining them financially.

In this blog, we'll explore what exactly a pig butchering scam is, how you can spot one, and what steps to take if you've fallen victim to this increasingly common online con.

What is the Pig Butchering Scam?

The term "pig butchering" refers to the way scammers "fatten up" their victims, similar to how a farmer prepares a pig for slaughter. It starts when a fraudster initiates contact with a potential victim, often through social media, dating apps, or messaging platforms. The scammer will usually come across as friendly, charming, and relatable, with the goal of building trust over time.

After establishing rapport, the scammer introduces the idea of a lucrative investment opportunity. Most commonly, these scams involve cryptocurrency or stock market investments—areas that might seem enticing but complex for the average person. The scammer might claim to have insider knowledge or access to special investment strategies. To make it more convincing, they often show fake screenshots of profitable returns, making the victim believe they're onto something big.

As trust deepens, the victim is encouraged to invest small amounts of money at first, which will appear to grow quickly (on fake websites or apps controlled by the scammer). Soon, they are coaxed into investing larger sums. The scam continues until the victim tries to withdraw their funds—only to find that the scammer has disappeared, leaving them with nothing.

How to Spot a Pig Butchering Scam Attempt

While pig butchering scams can be highly sophisticated and emotionally manipulative, there are still tell-tale signs you can watch out for. Here are some red flags to keep an eye on:

1. Unsolicited Contact from Strangers

A common sign is being contacted out of the blue by someone you don't know. This might happen on social media, dating platforms, or even through email or messaging apps. Scammers will appear friendly, personable, and interested in building a relationship, whether romantic or simply friendly.

 2. Too-Good-to-Be-True Investment Offers

Once a relationship is established, the scammer might start discussing an amazing investment opportunity that promises high returns with minimal risk. Whether it's cryptocurrency, stocks, or some other financial platform, be suspicious of anyone offering guaranteed profits—legitimate investments carry risk, and no one can predict the market with certainty.

 3. Pressure to Act Quickly

Scammers often create a false sense of urgency. They might say you need to act fast because the opportunity is limited or that the prices of certain assets will skyrocket soon. This pressure is a tactic to stop you from thinking things through or doing proper research.

 4. Elaborate Fake Backgrounds

Many scammers craft convincing stories about their backgrounds, claiming they're successful investors or well-connected professionals. They may show you fake profiles, doctored social media pages, or even create detailed websites. If someone new to your life seems too good to be true, they probably are.

 5. Requests for Financial Information or Access

A major red flag is when someone asks for your financial details, whether it's for your bank account, crypto wallet, or access to online trading accounts. They might offer to "help" you manage your investments or transfer funds, but handing over this kind of access can lead to disaster.

 Do Scammers Use Blackmail in Pig Butchering Scams?

Yes, once a scammer has you emotionally or financially entangled, they might resort to blackmail. If you start pulling away or expressing doubt, scammers might use threats to manipulate you into continuing the relationship or sending more money. Here are some ways they could attempt to blackmail you:

 1. Threatening to Expose Personal Information

After building a close relationship, scammers may collect personal information such as intimate photos, personal messages, or financial details. If you try to pull away, they might threaten to expose this information to your family, friends, or colleagues.

 2. Pretending to Involve Law Enforcement

Some scammers may try to frighten victims by claiming that they have been unknowingly involved in illegal activities like money laundering. They'll threaten to report you to the authorities unless you continue to follow their demands. These threats are baseless, but they can be scary for victims who feel out of their depth with complex investments like cryptocurrency.

3. Threatening to Harm Your Reputation

Scammers may also claim they'll destroy your online or personal reputation, threatening to spread false or damaging information about you. They could suggest they'll post fake social media messages, or claim to have evidence of wrongdoings. This tactic is designed to create fear and make you comply with their demands.

 4. Fake Legal Threats

Some scammers have been known to send forged legal documents or emails pretending to be from solicitors or law enforcement agencies. They claim you're facing legal consequences unless you pay additional fees or comply with their instructions.

If you ever receive threats like these from a scammer, **do not engage**. Cut off all communication and report the incident to the authorities as soon as possible.

What to Do if You Fall Victim to a Pig Butchering Scam

If you've fallen victim to this scam, it can be overwhelming, but there are immediate steps you should take to protect yourself and, in some cases, recover your losses.

 1. Cut Off Communication

Stop all contact with the scammer. Block their phone number, email, and any social media profiles they've used to communicate with you. The quicker you distance yourself from them, the better.

2. Contact Your Financial Institution

If you've transferred money, contact your bank or financial institution right away. They may be able to freeze your account or reverse transactions, especially if you act quickly. If your investments were in cryptocurrency, contact your crypto exchange, as they might be able to freeze the assets in your wallet.

3. Report the Scam to Action Fraud

In the UK, report the scam to Action Fraud, the national fraud and cybercrime reporting centre. By reporting the fraud, you'll help authorities track down these criminals and potentially prevent them from scamming others.

 4. Reach Out to the National Cyber Security Centre (NCSC)

The National Cyber Security Centre (NCSC) can offer guidance on how to protect yourself from further threats and provide tips on securing your digital information. They also collaborate with law enforcement to combat cybercrime. If you're in the Isle of Man, the Isle of Man Office of Cyber Security and Information Assurance (OCSIA) can offer additional local support.

5. Seek Legal Advice

If you've lost a significant amount of money, consider speaking to a solicitor who specialises in fraud cases. They can help you understand your options and whether it's possible to recover your lost funds.

6. Be Aware of Follow-Up Scams

Scammers might target you again, pretending to be law enforcement or agencies offering help to recover your money. Be cautious if anyone reaches out after the initial scam, especially if they ask for more money or personal information.

Final Thoughts

The pig butchering scam is a cruel and manipulative tactic that preys on trust and financial aspirations. It's crucial to remain vigilant and educate yourself on the warning signs of such frauds. If something feels off, take the time to verify the situation with a trusted financial adviser or expert.

Stay safe online, and remember—if it sounds too good to be true, it probably is.

For more information on scams and how to protect yourself, check out these great resources:

- An Episode of the Darknet Diaries Podcast discussing real-life pig butchering scams and how victims were targeted. - A Recent Episode of HBO's Last Week Tonight that covers the rise of pig butchering scams and other modern fraud tactics.

Computer Network Defence proudly celebrated its 20th anniversary with a Garden Party. The celebration, held at the Digital Mansion, Corsham, brought together employees, their families some travelling in from America, Isle of Man and various areas of the UK to commemorate two decades of dedication, innovation, and success.

Founded in 2004, CND has grown from a family run business to a global leader in cybersecurity solutions, protecting businesses and individuals from digital threats, whilst still maintaining its original family values. Over the past 20 years, the company has consistently pushed the boundaries of technology, developing cutting-edge products and services that have set new standards in the industry.

The anniversary BBQ was a heartfelt thank you to the team members who have been instrumental in the company's journey. Attendees enjoyed a day filled with delicious food, fun activities, and homemade cakes, a firm favourite amongst team CND.

"Many thanks to all of Computer Network Defence Ltd (CND) for the last 20 years! It's been a journey, who'd have thought all those years ago that we would end up with 70 of the best cyber security staff in the world," said Andy Cuff, CEO of Computer Network Defence.

As CND looks to the future, the company remains committed to its mission of providing top-tier cybersecurity solutions and continuing to innovate in an ever-evolving digital landscape. With a strong foundation and a talented team, Computer Network Defence is poised for even greater achievements in the years to come.

A couple of weeks ago a new version of Splunk was released: 9.2.2, this included various CVE resolutions (URL) and many of our clients have already rapidly responded and upgraded their version of Splunk. Upgrading is a quick and fairly low effort, low risk exercise so long as you haven't allowed tech-debt to creep into your infra. However once your architecture scales to a clustered environment such as a C1, C13 or even Multi-site instance then rather more effort is needed to upgrade.

Working with a client recently they had over 40x Splunk Enterprise servers that required upgrading which included multiple Search Head Clusters (SHC's). On the clusters were a variety of large Key Value Stores (KV stores) which serve as small database type constructs using MongoDB. These are important to backup just prior to upgrade works taking place, clients don't want stale data here and so a just-in-time backup is really valuable to have.

KV store backups at scale

The Splunk official upgrade docs (URL) tells you to backup the KV store and there is a detailed page with commands to verify the status and restore process (URL), however there is no means offered to do this at scale, which in the case of this particular client was multiple clusters, multiple apps and multiple KV stores. All of this builds up to an 'N*' scaling challenge.

Step 1: CLI SPL search to obtain a list by app

From the linux command line (wait, you are running linux right?) of your Splunk Enterprise server you can run a Splunk SPL search to gather all the apps that have a KV store. In some cases you may want to specifically exclude generic or heavy use apps such as Security Essentials or Python upgrade readiness but it all depends on the client need. Trivia, it wasn't until Splunk version 4.x that there was a GUI, prior to that all search was done via the CLI and this has largely been forgotten that you can even do it this way, it helps us in this instance by removing manual process which are more likely to create errors.

# Note the end of the command write to output to: 'kvlist-raw.txt' 

Step 2: Create a NetRC file

We're going to need to issue a CURL command for each KV store that we need to backup, this was over 30 individual items for my client in this instance and the intention is speed; if we were to manually enter a password for each connection it would sub-optimal. So we can use a netrc file during the works which should be deleted immediately thereafter. See the CURL docs (URL).

In this instance the machine is set to 'localhost', this must be placed on one of the Search Heads to function, otherwise it will fail to connect to the endpoint.

#!bin/bash

vi ~/.netrc
machine localhost
login
password

# Save and exit
chmod 400 ~/.netrc

Step 3: Clean-up the KV store list

We now need to use REGEX to extract cleanly the app and the list of KV stores we wish to input to our automation script, without this phase we would generate errors.

cat kvlist-raw.txt | egrep '\w+,\w+' | sort | uniq > kvlist-clean.txt
rm kvlist-raw.txt

Step 4: Create the automation script

This is the key part of our process and incorporates standard CURL retries, there are lots of options which can be edited and you can reference the docs to adjust to your target environment (URL).

Obviously set the filename variable and 'splunkhome' path per the deployment.

touch kvstorebackup 0700
vi kvstorebackup

#!/bin/bash

filename='Splunk-x.x.x-upgrade-'$(date +%F)
splunkhome='/opt/splunk/bin'
total=$(cat kvlist-clean.txt | wc -l)

echo "# Splunk KVstore backup script, there are a $total of KV's to backup:" > backup

while IFS="," read -r value1 value2 remainder
do
echo "curl --retry 20 --retry-delay 30 --retry-max-time 600 -n -k -sS -X POST HTTPS://localhost:8089/services/kvstore/backup/create -d archiveName=$filename-$value1-$value2&appName=$value1&collectionName=$value2'" >> backup
echo 'sudo -H -u splunk '$splunkhome'/splunk show kvstore-status | grep backupRestoreStatus | grep backupRestoreStatus | cut -d ":" -f 2 | cut -d " " -f 2' >> backup
echo 'sleep 5s' >> backup
done 

Step 5: Generate the backup file and run it

Great, so the file 'backup' has been created with a list of the target environments app and KVstores, you need to check the script, run it and then the file will initiate the process with Splunk. You won't need a password at this point because you stored it in Netrc.

Go make a brew, this bit can take at least 20-30mins in larger environments. It is also carried out in series and not parallel unfortunately.

# Generate the backup file:
./kvstorebackup < kvlist-clean.txt

# Check the backup file:
cat backup

# Check the KVstore status:
sudo -H -u splunk /opt/splunk/bin/splunk show kvstore-status | grep backupRestoreStatus

# Execute the backup script
chmod 700 backup
./backup 

Step 6: Measure twice, cut once

Great, so your backups should have completed, but you must go and check them to make sure they make sense, there are the right number of them and that it looks like you'd have a way out if the upgrade goes wrong. 

# Check that the backups are in place:
sudo -iu splunk
ls /opt/splunk/var/lib/splunk/kvstorebackup

Git / Feedback

I hope this script helps you and that it simplifies your Splunk upgrade, we'd love to hear any feedback if it was useful to you. At some point in the future we may publish it to the Splunkbase and Git.

Any e-mails to:

- This email address is being protected from spambots. You need JavaScript enabled to view it.

 CND sent two senior members of the team to Splunk Conf.24 in Las Vegas. The following is their account.

'We started the conference by attending talks by Splunk CEO Gary Steele who delivered the opening keynotes along side Cisco Present Chuck Robbins. With Splunk's recent merging with Cisco everyone was intrigued to see whether there would be any key take aways from the event. It just so happens, there was a unexpected roar of applause which followed Chuck Robbins remark "We're not going to ruin Splunk." This statement certainly delivered an impression as throughout the next 3 days, every Cisco employment would repeat it during every appearance on stage.

It sounds like Splunk will be retained as a separate entity and have some of the Cisco services woven into it rather than being re-badged as a Cisco tool/service. From a SIEM/Cyber Security perspective that means Splunk Enterprise Security (ES) will start to see integration with the Talos threat research Cisco is already doing as well as Cisco's ThousandEyes User Monitoring agent.

There were two notable themes for this year's conference, the first being the "We're not going to ruin Splunk", followed with another relating the AI. Splunk are due to release a Splunk ES integrated AI that will help Security Analysts write detections and navigate security incidents by directing them through security playbooks. That is on top of the much hyped Splunk AI Assistant chat bot that will help non-Spluker's write searches by translating natural language into Splunk's SPL search language.

Many of the presentations were AI related with titles such as 'Build Your Own AI Detection Engine Co-Pilot' and 'Developing Behavioural Analytics Using Generative AI'.

One was titled 'In defence of the SOC Analyst' and covered all the reasons AI can't replace a good SOC Analyst, (not yet anyway). Breakout sessions with hands-on labs was a welcome first at .Conf for me, it reminded me a little of SANS rather than the usual death by PowerPoint. Following the speakers methods for yourself, on your own laptop helps to cement the learning and I will now be able to take some of the techniques from those sessions to my own customers not just as theory, but with working examples.

While wandering through the exhibition hall I ran into the ex-team leader for one of my customers who is now working for Splunk. He was demonstrating the use of Splunk in a Smart Home by monitoring the consumption of food stuffs by the inhabitants and tallying their calorie intake against data from their fitness tracker. It was then able to suggest meals based on the food left in the fridge and their expected requirements for the next day. He mentioned they could do with some snack items like crisps and it just so happened that that afternoon in the breakout area attendees were offered Cheeto's and Dorito's as a snack. I scooped up an arm full and delivered them to the smart home stand back in the exhibition hall for which I was rewarded by the staff there with ice-cream, (I think crisps for ice-cream was a pretty good trade especially given it was 43° outside).

At an invitation from 'Jade' at Arrow (another Splunk partner we transact with), Jeff and I attended the Arrow mixer at one of the Venetian's cocktail bars. It turned out that Arrow weren't the only group hosting an event there, it was busy and as we entered, we were greeted by the director of a US based partner org who insisted on putting our drinks on his tab, he then swapped cyber stories and experiences with us, it became clear that their experiences partnering with Splunk as an organisation are remarkably similar to CND's despite the different characters involved on opposite sides of the Atlantic. Eventually we turned to seek out the gathering we were supposed to be at the bar was half empty but we never did find Jade!

On the last evening we attended the farewell party featuring 90's nostalgia act, TLC. Safe to say we enjoyed our final hours in Sin City, we made connections, caught up with friends, learned a lot and thoroughly enjoyed our time at .Conf24. Looking forward to next year already! 

That's a wrap on .conf24!

Ethical hacking, penetration testing, red teaming, offensive security. Those words evoke an image of someone with a black hoodie up, coding whilst a wall of binary scrolls slowly behind. The binary is usually green for good measure.

So, over the last few years this has become to de facto 'cool' job. The idea of using malicious techniques, developing exploits and being a professional menace appeals to the dark side of a lot of people. You get to be the bad guy, get paid and not go to prison? That sounds to me like a win-win-win.

Sorry to burst any bubbles, but if you go into the industry with that mentality, you're unlikely to be pleasantly surprised. Over my years in the talent industry, the ask for many testers has shifted. Back years ago, the conversation was "Matt, find me the most technical person you can" and now it's "They need to be technical, but also able to be in front of a customer". What does that mean exactly?

This is written from my experience placing numerous testers and working with companies for many years. I am not a penetration tester, well, unless we count getting Root on Legacy.

It's a business facing role

Penetration testing is a business facing role. A company pays for you to test and validate their security measures within a tightly confined scope (usually, more on that later).Stakeholders at the business are your customers and their expected output is not a custom coded C2 framework or you gloating that you got Domain Admin. The output is a report.

The company are paying you to test and point out problems you find and then offer the remediation actions that you would recommend to plug that gap. Now yes, I understand many companies offer tools and staff to help consultants put these together, however your ability to write in a way that a non-technical audience, who may have no idea what SQL injection is, will be critical to your success.

Oh, that's right, it's unlikely that whoever reads that report will be a security professional, or at least one of the people reading it won't be. If they don't understand it, what do you think that says to them? I'll leave that one with you.

You will meet resistance

One of my long-term connections once regaled me with the tale of how whilst doing a penetration test, he asked for his IP to be whitelisted for the test.The network manager, who we shall call Dave, responded with "Aren't you meant to be a hacker?".

Whilst incredibly insightful, it misses the fundamental point.You are there to help this person to secure the environment by deploying Offensive techniques, however the sad truth is that no one likes their homework being marked. People will be naturally a bit wary of someone coming to check if they are doing things the right way.

The best antidote to this? Win hearts and minds where possible.If you find a vulnerability, the worst thing to do is gloat, be smug, feel superior.Address it with the relevant person and take a professional and helpful tone.

People like Dave may be beyond help, but this point leads me on to my next.

You will need to speak to people.

Sorry, can't help this one.It's a huge part of the job.

If you're going to succeed in penetration testing, being able to sit with a customer and explain why what you've done is important beyond "got root" is super important.Would a CFO care about how advanced your malware development skills are?Probably not.Will the care how much it's going to cost them if said Malware took a hammer to their estate?Most definitely.Know your audience and tailor your communications effectively.Honestly, this will turbo charge your career and give you a lot of extra value added.

If your only wish to speak to people is to social engineer them, you're going to be disappointed.

Soft skills matter, okay?

 I cannot bang this drum loudly enough. It's been a theme through this article. The way you interact with people can really affect your career. The days of penetration testers being sat in silence away from people to do 'hacky-stuff' are long gone.

But how do you develop those skills? There isn't really a Try Hack Me room or a HTB lab for it. The answer is way simpler than you think, and I can give you an example. Bear with me.

My girlfriend has a massive family, some of whom are young children. While sat on their sofa a few months back, one of the kids sidled over and asked me what I do. I got thinking, how do I explain "I help organisations grow their Offensive Security capability, using current recruitment best practice, technical knowledge and leading tools" to a five-year-old.

I went with "Companies use me to find the pretend bad guys, to help protect them from the real bad guys."

Do you see? Practice explaining things to people who have zero idea what it is you do. Whether that's a friend, partner, parent. Try and explain something technical to them in a way they can understand. For people in the sector, talk about XSS, BurpSuite, Gobuster, Johntheripper all make sense, but to someone outside? Absolute gibberish. Try and explain something as if the person was five. Honestly it's a skill you can develop.

Still keen?

Penetration testing is cool. It just is. If I was to ditch the talent industry it would be where I headed. However, it's not the "Mr Robot" existence some people think it is. Your work is an expense to a company and you will constantly be looking to deliver an output to them.

If you begin to develop the people and consulting skills that sit alongside being a technical whizz, then you can expect to see quicker success across all aspects of the job.

There are a few giveaway's here straight away that tell us this is a high risk message:

- 1: The sender is from an entirely random e-mail address, however in the initial message this doesn't show up as clearly until the potential victim clicks the message to expand it.

- 2: This was sent via iMessage, this messaging type has a few risks associated with it as opposed to simple SMS text as it invokes software calls on a phones OS. For an explanation of this threat vector, which has been used for sophisticated NSO group spyware 'Pegasus' see (URL 1, URL 2). If you operate in an elevated risk situation or using a work device you should disable iMessage entirely. iMessage was probably used in this instance as it is a very low cost distribution mechanism that appears as time sensitive SMS messages do.

- 3: Mixed details, the company is masquerading as parcel company 'Evri', however it then goes on to say 'Post Office', which is it? Plus if you look closely there are punctuation errors.

- 4: No SSL, the URL begins with: 'http://', why are they not using an SSL certificate, if you're submitting details online or even just browsing the web it should be to a reputable site with a valid SSL certificate

Unfortunately my family member clicked the link and interacted with the scam site, before realising and letting me know. You can see how it happens especially early in the morning.

Risk assessment / PICERL

This potential scam attack occurred in the home and there is a real risk in domestic settings if home users and work from home networks are not secured and isolated. Thankfully I have at least multiple separate networks at home so that data is entirely compartmentalised (Work | Home | TV | Security | Guest | Full-Access) so there can be no spill over events in the event of ransomware of Malware arriving in a domestic network. 

Considering where you might be on the PICERL diagram (Containment) is generally great practice even if it doesn't apply with this threat type (probably!). Is the threat contained, what else might be necessary?

DNS protection:

I previously wrote about the benefits (URL) of using a security focused DNS provider such as NextDNS, Cisco Umbrella or Cloudflare which will often pickup newly registered domains (NRD's) and malware, phishing domains more quickly than ISP DNS provision. I strongly support this simple measure and in fact this would have blocked the given 'domain' in this fraud attempt had my family member been using it. They opt not to, because the Adverts (which track them round the internet) are useful!? I tested it with a VPN on in a sandbox browser:

I verified my Splunk logs and performed a simple lookup which tells me:

• The URL maps to server: 43.157.103.124
• Hosted in Germany (indicative) 
• Blocked accordingly as a Newly Registered Domain type

Doing the right thing:

There is an expression: 'The standard we walk past, is the standard we accept', what this means to me is that accepting low level scamming as just part of life is not acceptable. I will not walk idly past whilst people are defrauded as a cyber security professional. So there are several quick measure that we can take taking less than 10 minutes:

10 minute actions:

• Reported the site to NCSC: Phishing: Spot and report scam emails, texts, websites and... - NCSC.GOV.UK
• Reported the URL as phishing to McAfee / Trellix: Check Single URL (mcafee.com)
• Reported the URL as phishing to Cisco / Talos: Web Reputation Support || Cisco Talos Intelligence Group - Comprehensive Threat Intelligence
• Check the listing on Maxmind, we know it is listed in Germany, who hosts the site?
• Check the DNS registrar: 'gname' based in Singapore
• Reported as malicious to the registrar.

Scammer summary:

In just under 10 minutes I have established:

• The scam domain is registered to a DNS registrar in Singapore. However their site looks less than legitimate and I note they do not even have an SSL certificate on their site? Low confidence they will action a block on the domain.
• Hosted in Germany, on Tencent cloud server.
  
• Tencent is a Chinese media company, and I did attempt to file a fraud report with them, however their site is poor and is set to only handle copyright infringement. Over my lunchbreak I did call their help number from an anonymous number and attempt to register it, the handler directed me to a Chinese language website, they clearly have no intent to prevent fraud.
• Does this amount to state sponsored acceptance of cyber crime? Lacks any effort to law enforce the prevention of it? 

PICERL, Lessons Learned:

In this case we were adequately compartmentalised and it is a domestic individual, but what could have been done better, what if this was a corporate entity? What would we professionally recommend:

• Cyber Awareness training. CND provide programmes to train employees to recognise and test simulated phishing attacks.
• Reducing Threat surfaces. Work with a client to understand their connectivity requirements and what recommendations can be put in place to reduce and disable threat vectors.
• Logs / SIEM tools. CND is Splunk Professional Services partner, we have several fully trained professionals. We could setup alerting for the SOC to notify based on Risk Based Alerting that a phishing domain / NRD has been attempted to be accessed by a corporate device.
• Firewalls / Proxy filtering. A commercial grade firewall such as a Palo Alto or Cisco may be configured to prevent access to NRD domain entirely and prevent any possible egress of data to such categorized sites.
• Compartmentalisation. Good network design and isolating device types, departments or use cases and consulting with our clients can lead to improved security practices. CND has decades of Cyber Network experience.
• Data leakage / OSINT. Reducing the digital footprint that individuals leak in a professional capacity or real phone numbers etc would reduce the reconnaissance data  available to threat actors. CND has significant OSINT capability and we can consult on ways to monitor and reduce the cyber profile.

Is hacktivism a cyber threat? 

Yes, in a way hacktivism is considered a cyber threat, this is only determined by the nature of act itself and the impact it can have and the extent hacktivists are willing to go to have their voices heard. Here are some examples of how hacktivism can pose as a cyber threats;

1.Data Breaches: Hacktivists will often target organisations and their database. This breaches often result in sensitive information being leaked, which results in a criminal offence in the UK under the Data Protection Act 2018. Many will disagree and argue hacktivists are exposing the wrongdoings of organisations or individuals that need to be addressed.

2.Risk of Cyber Conflict: Targeted acts by hacktivists will often increase tension within the cyber realm. This usually occurs as counter-attacks actioned by the hacktivist victims. This then escalates into an attack cycle and 'break the internet' meaning it can potentially damage cyberspace and its many platforms.

3.Disruption of Services: The normal method used by hacktivists is the DDoS, also known as distributed denial of service attack. The aim of this attack is to flood the network with traffic resulting in websites crashing making it inaccessible to users.

4.Civilian Cyber Casualties: Due to some indiscriminate attacks by hacktivists the risk of collateral damage is high. There is often negative impact on innocent users who hold connections to the target.

These are good examples of when hacktivism can become a cyber threat, however not all hacktivist wish their attacks to become so severe. Many utilise their tools and skills to ensure their voice and campaigns are heard. We will explain more about how hacktivism can become a cyber-criminal act in the next section.

Understanding the reason behind the purpose of the targeted attacks allow people to form an opinion on whether hacktivism can be seen as a threat. Many argue that hacktivists utilising their technical skillset is necessary for fighting injustice and uncovering corruption within large organisations and governments globally. The other view is hacktivism is yet another form of cyber threat and is a dangerous, thoughtful and disruptive force resulting in a negative impact. 

What motivates a hacktivist? 

 The motivations of hacktivists can be highly verified, from fighting injustice to combating censorship. Unlike traditional activism, hacktivist have gained a further and more impactful digital approach. They are able to break into computer systems and target websites, social media platforms, networks, databases and email threads.

Their motivations can also determine who their targets are, such as exposing corrupt organisations or shedding light on the harmful acts of certain individuals. These are examples of why it is so difficult to answers whether hacktivists are a threat or not. While many acts of hacktivism can lead to positive outcomes, there is not denying some hacktivists will overstep the mark and use their platform for their own gain, or carry out malicious, unprovoked attacks.

This is when the fine line between the acts of hacktivism and cyber criminality can become a little blurred. If an attack breaches a number of laws and regulations, it is very clear that this is a cybercrime.

Is hacktivism good or bad?

Enter There is no yes or no answer to whether hacktivism is good or bad. It will appear that hacktivism sits in the middle of activism and cyber threats. We will now explore both sides of the argument below;

Arguments against Hacktivism

Lack of Accountability: A hacktivist attack is often carried out by an individual or anonymous group. This leads to a lack in accountability when attacks fall into a cyber criminality act, this can also lead to concerns about misuse of positioning and power throughout the cyber realm.

Ethical Dilemmas: As mentioned before, the line between activism and criminality can often become blurred throughout hacktivism. It is understood that sometimes ethical boundaries are crossed. This can escalate into breaches of privacy, compromising the security of individuals and financial ruin of innocent organisations.

Unintended Consequences: The common method of hacktivists is DDoS and gaining unauthorised access to networks and computer systems. This will often lead to a disruption to the target that are not intended causing damage and negative impact to innocent bystanders or businesses.

Arguments in favour of Hacktivism

Platforms for Voices: Hacktivism is a great way of providing support and a platform for people who struggle to be heard. It is an effective way to raise awareness to many concerns, such as social injustice, oppression and censorship giving undermined individuals and groups a chance to be heard.

Catalysing Change: Hacktivism can be served as a catalyst for change and reformation, especially in areas such as social and political power structures. The transformative opportunities hacktivism can have is an important factor to remember.

Allowing Transparency: Hacktivism has time and time again uncovered hidden truths and lies in some of the world's most powerful entities. Shining the light on corruption and dangerous organisations has made them accountable for their actions resulting in a dynamic change.

With hacktivism covering such a vast range of activities, from social media take over to political data breaches, it is important to remember your cyber security. This is something we will discuss further in one of our upcoming blog posts.

Conclusion 

We hope that today's blog has answered your questions about hacktivism and whether it is a threat. Don't forget you can ask us more questions in the comments below. If you are wanting to know more about hacktivism, don't forget to check out our previous blog 'What is a Hacktivist?'.

What is a simple definition of hacktivist?

A simple definition of hacktivist comes from its name, which is derived from the words 'Hacker' and 'Activist'.

The way hacktivists work is by disrupting the computer systems of individuals and organisations. This is then followed by a variety of acts, denying the service to users, or if they break into the systems, they may leak important and confidential information, changing images or copy of the website, taking over social media platforms or tampering with marketing campaigns. The idea is to generate media attention ensuring their causes are seen and spoken about.

Here is an overview of some reported hacktivist causes and the purpose of their online attacks:

• Protecting freedom of speech, especially online.
• Protesting, with a main focus on war, capitalism, animal cruelty and globalisation.
• Demonstrating support, for citizen uprising and democracy.
• Supporting and helping immigrants and victims of war.
• Accessing government computer systems that pose a threat to the world.
• Accessing agricultural computer systems as an act of environmental protest.
• Preventing the financing of terrorist groups.
• Using social media platforms to support those who have been silenced or have their rights infringed.

These are all genuine and demonstrates how different each hacktivist groups or individual's causes are and the reasoning behind their attacks. Some of the most widely known hacktivist groups include;

Anonymous

The most well-known and recognised groups globally. Their main targets include the Church of Scientology, large corporations and governments and their institutions.

Masters of Deception (MOD)

This group is based in the United States and is famously known for hacking various large telephone companies.

Chaos Computer Club

Focusing mainly on government transparency and freedom of information. Chaos Computer Club is one of Europe's largest hacktivist groups consisting of over 6,000 active members.

Legion of Doom (LOD)

Still considered an inspiration to many hacktivist groups. Established in 1984 and world famous for posting the Hacker Manifesto, this group is considered one of the founding fathers of hacktivism.

What is an example of a hacktivism? 

 Hacktivist groups and individuals have a vast selection of tools and techniques used for their goals. Below are some examples of hacktivists campaigns and how they action them.

• Website Replication: This method works by mimicking an insisting and legitimate website. The URL will be changed slightly allowing the hacktivists to avoid censorship rules and gain access over the entire platform.
• DoS and DDoS attacks: DDoS , also known as Distributed Denial-of-Service, is a common tactic to flood the target's computer system and 'crashing' the website making it inaccessible to users.
• Blogs: Blogging anonymously is an easy way for individuals and groups to shed light on their target's issues, especially if there is censored or confidential paperwork involved.
• Doxing: This is a method that focuses specially on one person or organisation. Sensitive and private information is gathered over time and released to the public.
• Information Leaks: This tactic often requires the support of an 'insider' if the network wasn't breached by the hacktivists themselves, collecting sensitive information for the hacktivists who will then make it public.

An example of a hacktivist act which is highly publicised is the creation of WikiLeaks, the media company established in 2006 by founders Julian Assange and John Young. The purpose of WikiLeaks is freedom of speech and identifying false claims throughout world history records. You have no doubt read a number of American political scandals over the years thanks to WikiLeaks and their media team. 

Is it legal to be a hacktivist? 

No, it is understood that hacktivism is not legal and still considered a form of cybercrime. This is often debated, even within Hacktivist groups as many feel they are using their rights for freedom of speech. However, this is a stark contrast to other hacktivist groups and individuals accessing computer systems and stealing corporate and personal data from their victims.

Identifying lone and group hacktivists can often be an difficult task, making law enforcement difficult. This is due to the fact that the members of these groups are spread globally, making them tricky to pin point unless they combine their online attacks with physical protests. Having said that, most hacktivists groups ensure their physical protests are peaceful resulting in them avoiding legal prosecution all together.

An effective way of preventing hacktivist attacks is increasing online security and cyber protection. This has been an important focus for many organisations, especially in recent years. Here are some examples of precautions you can take with your cybersecurity for you and your company;

• Employ a cyber security team to carry out procedures, such as penetration tests to ensure your computer systems and networks are safe from cyber-attacks.
• Ensure you are educating your employees with updated cyber security training, especially those who have access to company emails to prevent your company falling victim to a phishing attack.
• Undergo a detailed cyber audit of the company, ensuring all weak spots are located and a cyber secure strategy is put in place. Continue these tests frequently to help identify and address weaknesses in the company's computer system and network. 

What is the difference between a hacker and a hacktivist? 

Admittedly it is difficult to see the difference between hackers and hacktivists. This is mainly due to the fact they both use the same tools for their attacks.

The main difference you'll find is hackers will often break into a computer system for monetary gain, or use the platform as a stage to 'show off' their technical talent. Hacktivists on the other hand are usually aiming to achieve a goal of social or political gain relating to their cause.

Conclusion 

Many feel that hacktivist and their movements are thought to be more ethical, but it is important to remember that certain aspects of hacking and hacktivism are illegal. This is a topic we will go into more detail in our next blog.

We hope this has cleared up a few questions you had about hacktivists and how they work. If you have any further questions, please leave us a comment below. 

 As Gold ERS holders, we are lucky to have access to unique opportunities. In Summer 2023 CND were invited to attend the RAF Halton 'Employer Engagement Management and Leadership Experience'. This was a national event with over 50 participants from a variety of industries, taking part.

Upon arrival, on a rather drizzly day the attendees were split into randomly selected syndicates, ensuring each groups included a cross section of organisations. This was swiftly followed by exceptional, well organised team building exercises, the first half including outside junior and senior level command tasks.

The groups were pushed to their physical and mental limits racing to complete several challenges from Land Rover tyre removal using only the limited kits available, to creating bridges to cross ditches and obstacles.

After a debrief and learning points shared, the groups had a opportunity to enjoy lunch and do some networking.

Once everyone had recovered, the second half the day started with officer level challenges including problem solving and planning scenarios under extreme pressure, such as performing calculations (S=D/T) and assessments to produce COA. This was followed by a spaceship simulator with each member focusing on different stations, such as weapons, comms, engineering and bridge. It was this challenge especially that highlighted the importance of strong communication and command which was one of the key take aways Team CND took from the day.

The day concluded with certificate presentations and the chance to say farewell to newly formed teams. A truly wonderful and exciting day had by all attending, gaining some valuable new knowledge about the importance of communication throughout a tight knit team. Something that will be effectively utilised within CND. Not to mention, a nostalgic and unwavering soft spot for the RAF.