Thriving in the Digital Age: Mastering Digital Continuity and Cyber Risk Management

In today's dynamic digital landscape, businesses face a constant barrage of challenges. Evolving customer expectations, ever-present cybersecurity threats, and a growing emphasis on sustainability demand a strategic approach and execution. Here's where the concepts of digital continuity and cyber risk management come into play, acting as cornerstones for organizational resilience and success.

This blog post explores why these concepts matter and how businesses can leverage them to navigate the ever-changing digital world.

The Power of Digital Continuity

• Digital continuity ensures a seamless flow of digital information, guaranteeing operational efficiency and fostering seamless collaboration. It allows businesses to adapt to technological advancements without disruption, ensuring the consistency, accessibility, and reliability of their digital assets.

Here's how CyberSecOp can help you establish a robust digital continuity plan:

• Digital Transformation Assessments: We conduct a thorough evaluation of your existing architecture, systems, processes, and data flows, identifying areas for improvement and pinpointing vulnerabilities.

• Business Continuity Planning: Our experts collaborate with you to develop a comprehensive business continuity plan, ensuring minimal disruption in the face of unforeseen events.

• Data Management Solutions: We implement robust data management practices to safeguard your critical information and streamline access for authorized users.

 Building a Culture of Cyber Resilience

Strengthening cybersecurity measures is crucial for protecting sensitive data and critical infrastructure from cyber threats. Conducting regular risk assessments and fostering a culture of cybersecurity awareness among employees are essential steps.

CyberSecOp offers a suite of services to bolster your organization's cyber defenses:

• Managed Security Services: We provide proactive threat detection, rapid incident response, and 24/7 security monitoring to safeguard your systems from cyberattacks.

• Penetration Testing: We simulate cyberattacks to identify vulnerabilities in your systems and applications, allowing you to address them before malicious actors exploit them.

• Security Awareness Training: Our engaging training programs equip your employees with the knowledge and skills to identify and mitigate cyber threats.

Digital Continuity: A Pillar of Sustainability

Digital continuity aligns with sustainability initiatives by optimizing resource utilization and minimizing waste. By digitizing operations, businesses can reduce their carbon footprint and enhance energy efficiency, contributing to a more sustainable future.

Conclusion

By embracing digital continuity, strengthening cybersecurity practices, and prioritizing sustainability, businesses can navigate the digital landscape with confidence, agility, and a commitment to the environment. Partnering with CyberSecOp empowers you to unlock the full potential of digital technologies while mitigating cyber risks and driving growth alongside a sustainable future.

Ready to thrive in the digital age?

Contact CyberSecOp today to discuss your unique needs and discover how we can help you build a resilient and sustainable future!

SEC Proposes New Cybersecurity Rules

The SEC proposed to add new Item 106 to Regulation S-K and updates to Forms 10-Q and 10-K that will require public companies to provide periodic updates about previously disclosed cybersecurity incidents when a material change, addition or update has occurred.

These days cyber-attacks are common across all industries and sectors, however, the finance industry inclusive of fintech seems to be one of the most targeted by cyber-attackers and cyber criminals. In 2021, according to Statista, the finance industry was ranked as the second largest target for cyber-attacks being targeted four times more than healthcare and almost nine times more than government. Although most organizations in the finance industry have built formidable security programs, the inbound threats have also become much more frequent and sophisticated. As cyber-attacks constantly grow in number and sophistication, we see organizations being breached every day. According to J Makas at ThinkAdvisor.com, by 2023 an estimated 33 billion accounts will be affected by cyberattacks targeting the financial sector.

SEC in response to rising threats

The Securities and Exchange Commission (SEC), in response to these rising threats and as a result of concerns voiced surrounding the lack of preparedness across the industry to advanced cyber-threats, has proposed new rules with a focus on standardizing and increasing cyber-reporting across the finance industry and public companies. The new rules proposed on March 9th of 2022 would require public companies to make prescribed cybersecurity disclosures. This proposal is an attempt to protect investors and strengthen their ability to evaluate public companies’ cybersecurity practices and incident reporting. cover IT risk management, cyber incident reporting, and cyber risk disclosure. The proposed rules would make cybersecurity a large part of the overall enterprise risk management

The proposed rules are an expansion on SEC’s previous guidance from 2011 and 2018 and would make material cybersecurity incident reporting, including updates about previously reported incidents as well as ongoing disclosures on companies' governance, risk management, and strategy with respect to cybersecurity risks, including board cybersecurity expertise and board oversight of cybersecurity risks, all mandatory.

            In specific, the new rules would add cybersecurity incidents on Form8-K requiring organizations to disclose all cybersecurity incidents and identified risks. The information required on the Form 8-K would cover (a) the timing of cyber-incidents and whether they are resolved or ongoing, (b) required brief details on the nature of the incident, (c) a report on any affected data even if the data was not exfiltrated, d) effects of every cyber incident on the organization’s operations, and e) information on remediation activity. One interesting item of note is that the actual date the cyber-incident began will be required and not just the date it was discovered.

Require companies to disclose

Also, the new rule would require companies to disclose the following in form 10-K:

·         Does the company have a cybersecurity risk assessment program and if so, provide a description of such program;

·         Does the company engage assessors, consultants, auditors or other third parties in connection with any cybersecurity risk assessment program;

·         Does the company have policies and procedures to oversee and identify the cybersecurity risks associated with its use of any third-party service provider (including, but not limited to, those providers that have access to the company's customer and employee data), including whether and how cybersecurity considerations affect the selection and oversight of these providers and contractual and other mechanisms the company uses to mitigate cybersecurity risks related to these providers;

·         Does the company undertake activities to prevent, detect, and minimize the effects of cybersecurity incidents;

·         Does the company have business continuity, contingency and recovery plans in the event of a cybersecurity incident;

·         Have previous cybersecurity incidents have informed changes in its governance, policies, procedures, and technologies;

·         How and whether cybersecurity-related risks and incidents have affected or are reasonably likely to affect its results of operations or financial condition and if so, how; and

·         Cybersecurity risks are considered a vital part of its business strategy, financial planning, and capital allocation and if so, how.

requires cyber risk management to be identified in the organization's 10-K form

The proposed rules will also require information on the company’s cybersecurity governance, board oversight of the cybersecurity risks, and how cybersecurity risks are managed and assessed to be present in the company’s form 10-K as well as in annual reports. Companies will also be required to identify any members of the board with expertise in cybersecurity including their names and a full description of the nature of their expertise. Besides these requirements, there will also be disclosure requirements to tag any data that at any point was considered to be affected in any way by a cyber-incident. Lastly, foreign private issuers ("FPI") will also have mandatory incident disclosures to make.

These rules proposed by the SEC are meant to provide more visibility to investors as well as the federal government, thereby protecting investors as well as standardizing the level of cybersecurity and IT risk management programs across public companies and the finance industry. It is likely that Congress as well as entities such as the SEC will not stop here and will continue to propose further cybersecurity and IT risk management related regulation.

Gartner Recognizes CyberSecOp - Ranked 2nd for Security Consulting Worldwide.

CyberSecOp receives the highest overall score on Gartner Peer Insights for Security Consulting Services, Worldwide in 2022.  

June 8, 2022 - CyberSecOp today announced that its Security Consulting Services received a 4.9 out of 5 overall rating from Gartner Peer Insights, placing CyberSecOp in the top two on Gartner’s Security Consulting Services Worldwide category.

"Peer reviews are extremely valuable for evaluating any purchase decision," said Josh Bauer, Executive Director at Loxo Oncology/Lilly.  “CyberSecOp appears to actively and continuously listen to us as a customer to ensure they deliver innovative solutions and a valuable user experience."

“CyberSecOp is honored to receive our current ranking status and client feedback, and we will continue to prioritize customer satisfaction across the board."  Vincent LaRocca, CEO & Co-Founder.

2022 Gartner Peer Insight

Gartner Peer Insights is the firm's platform for rating and reviewing enterprise technology solutions by end-user professionals for end-user professionals. Through user-contributed reviews from people who have actually used the services, the rating system combines expert opinions and peer insights. Peer Insights User Reviews offers a suite of interactive features for technology buyers, including the ability to customize evaluation criteria to create a quadrant view tailored to the user's goals and priorities. The platform employs rigorous methodologies, processes, and quality standards to deliver unbiased research and authentic peer reviews.

What is Gartner’s research?

Gartner research: Trusted insight for executives and their teams

Gartner research, which includes in-depth proprietary studies, peer and industry best practices, trend analysis, and quantitative modeling, enables us to offer innovative approaches that can help you drive stronger, more sustainable business performance.

Gartner research is unique, thanks to: 

Independence and objectivity

Our independence as a research firm enables our experts to provide unbiased advice you can trust.

Actionable insights

Gartner’s research is unbiased, containing vital takeaways and recommendations for impactful next steps.

 Proprietary methodologies

Our research practices and procedures distill large volumes of data into clear, precise recommendations.

Healthcare is a Top 3 Cyber Target

 Attacks on the healthcare industry are on the rise as noted in a recent article published in CYBERSECOP.  Healthcare providers of all sizes are subject to attack and in this case, CHRISTUS Health learned of “unauthorized access” likely similar to 254 ransomware incidents targeting patient care facilities between June 2020 and April 2022 worldwide.  Patients are at risk, both their health and their PII where threat actors can alter and/or add to patient billings with no notice of impropriety.  The true impact will be hard to discern until more time and data are collected but we know one thing for sure, the healthcare industry needs to take cybersecurity as seriously as they do patient care and follow their own advice; Plan, Prevent, Protect and Respond.

Plan – Get a Risk Assessment to identify and understand your cybersecurity vulnerabilities is one of the most critical steps as the awareness will lead to a prioritized remediation plan.  Even a chink in the armor will have your patients, employees, and community concerned as a cyber-attack will likely affect critical operations because the prize is financial data, patient, and employee Personally Identifiable Information (PII).

Prevent - After an assessment is completed, you need a trusted and reliable security cyber organization to assist in leveraging the right framework and controls to be measured by such as HITURST, HITECH, HIPAA and PCI.  These guidelines assist in defining the appropriate critical security controls for effective cyber defense.  These efforts can be awareness training, policy creation & enforcement, and security controls as well as incident response readiness and governance.  It’s a journey, not a sprint.

Protect – Within most remediation plans include investments in endpoint protection dark web monitoring and focusing on digital trust goals to ensure the technology investments already made as well as those in the future work in harmony.  Like a Rubik’s cube, the goal is to have every facet of your organization in order, not just celebrating a single win.  It is important to have a managed security partner to protect your patients, employees, devices, and data with monitored protection systems along with managed & encrypted backups with a Security Operations Center staffed with certified security professionals watching and engaging on your behalf 24x7x365.

Respond – Did you know that a threat actor will live in your ecosystem for an average of 121 days mining sensitive data, passwords, organization charts, and behaviors before acting?  Nearly 95% of ransomware attacks are preventable so what starts as a threat becomes a technology issue, then a business risk issue, and eventually decision-making and communications issue at the board level.  Do you pay the ransomware or not?  Are we able to recover our data?  Has the threat actor accessed our PII?  And equally important is how do you keep from reaching this point again.  Having an incident response assessment and plan might be the one thing you do if you don’t buy into everything else.  You should receive an IT assessment of “how capable are we to thwart an attack?” and “how able are we to recover if breached?”  Buying cyber insurance is not the silver bullet it used to be so having an incident partner who is proactively focused on your company’s sensitive data and reputation is paramount.

Not unlike a hospital, there are two main ways to address cyber security by coming through the Emergency Room or the front door proactively for testing; I recommend the latter.  A proactive health check is the best step to understanding your ability to fight off an attack like a stress test.  The results may drive adjustments in behavior and readiness, such as point endpoint detection, policy creation & enforcement, and security training.  If you enter the ER, then don’t panic because you read this blog and signed up a reputable security partner to react & respond, including quarantining affected systems to prevent the ransom spread, resetting all passwords, checking your backups, activating your existing crisis/DR plans and negotiate with the threat actor if that is the best business decision communicating carefully along the way with detailed documentation.  The moral of this story is that hope is not a strategy, so know your security scorecard and realize cyber readiness is a journey, not a sprint.

Author: Christopher Yula

Don't let a cyber security breach damage your reputation

Cybersecurity breaches have cost many organizations some of their largest clients. While most organizations quickly hire legal experts, public relations teams, and a cyber security firm like CyberSecOp, the reputation damages have already begun. For example, your client may not have access to your services for hours before you realize that your system was affected.

Prime attack time

Attackers are strategic with time selection to minimize their activities being seen by employees.  Most attackers operate on weekends or at night, knowing that most organizations’ employees do not access or monitor systems at this time.

When does reputation damage begin?

Reputation issues may begin long before the organization knows about an attacker. Some attackers disclose information on social media so that the organization will act quickly to their demands. Most cybercriminals spend an average of three months on clients’ systems before they act, but by this point, they may have already sold your data on the dark web or to your competitor.

Disclosing sensitive information violates privacy policies and requirements such as CCPA, GDPR, and some states’ and countries’ data protection regulations or requirements. The data disclosed may also include clients and your client’s customer information, putting your clients at risk. They, too, need to report the breach to their customers and provide the necessary protection to protect their customer’s credit and identity.

Reputation damage extends to your client.

 At this point, not only is your organization’s reputation is in jeopardy, but also the reputation of your client and your client’s customers. All of these expenditures may be a liability to your organization if the breach is on your side, especially if there is evidence that you didn’t take due care regarding your organization’s security posture.  

Conclusion

Defense-in-depth security program

Having a defense-in-depth security program such as those offered by CyberSecOp, cannot only save your business money but can also help you compete against other companies that have not implemented a security program.  Most organizations have implemented a vendor management program to mitigate their threat against a third-party risk. A security program that includes third-party risk management is critical to identifying and remediating internal and external threats.

Chrome and Edge Should Be Updated Due to a Zero-Day Vulnerability

Google and Edge has released an update to remediate a critical zero-day chrome exploit. The zero-day is a weakness in Edge and Chrome's JavaScript engine that can be used by hackers to inject their code into your browser. Google explains for zero-day exploit CVE-2022-1096, first reported to the company by an anonymous tip on March 23. As part of our commitment to continuous support in security monitoring and enhancement we advise all clients to update to Chrome version 99.0.4844.84 and Microsoft Edge 99.0.1150.55 of as soon as possible.

DETAILS AND REMEDY FOR MICROSOFT AND GOOGLE

At this time Microsoft and Google won't provide much more information other than admitting there have already been attacks leveraging this zero-day weakness and keeping some information away from the public as a safety measure, stating that full details on how the exploit worked won't be made public until most users have the fix. Fortunately, this time Microsoft and Google was apparently able to issue a patch before the exploit became widely known.

Normally Chrome updates happen in the background when you close and reopen your computer's browser.

Microsoft issued its own notice and said the issue was fixed in Edge.

Please follow the steps below to ensure you have the latest version of Chrome.

Remediation Efforts

On your computer, open Chrome.

Author: Tanvir Ahmed

CISA's 'Shields Up' Alert Highlights Foreign Cyberthreats

Cyberwarfare is the battlefield of today. Increased geopolitical tensions stemming from Russia's unprovoked attack on Ukraine has led to CISA (the Cybersecurity & Infrastructure Security Agency) issuing a "Shields Up" bulletin.  Every organization must be prepared to respond to disruptive cyber activity, especially those in critical infrastructure fields.

 Here are some tips to help you keep your organization safe in these trying times.

Reduce the likelihood of a damaging cyber intrusion

• Use MFA or Multi-Factor-Authentication everywhere.

• Ensure all Systems are patched and up to date.

• Consider increasing patch frequency if not already real-time.

Take steps to quickly detect a potential intrusion

• Run, update and monitor a strong Endpoint Protection Program.

• Consider increasing Spam and Phishing filter sensitivity.

• Disable any non-essential ports and protocols, specifically through external gateways.

Ensure that the organization is prepared to respond if an intrusion occurs

• Review your incident response plan and ensure it is up to date and all parties are clear on their roles.

Maximize your organization's resilience to a destructive cyber incident

• Ensure that you are taking regular backups and that your backups are encrypted and immutable.

• Test your backup and recovery procedures.

• Communicate with your users, the best and strongest defense is a well-educated and well-prepared workforce.

If you are a CyberSecOp customer today in either our vCISO or vSOC program your risk manager will be reaching out shortly to ensure this guidance is being implemented to the extent possible within your organization. 

If you are not currently enrolled in one of our plans and need assistance assessing your posture and capabilities, please feel free to reach out.

What Does Cybersecurity Compliance Mean?

Cybersecurity Compliance involves meeting various controls (usually enacted by a regulatory authority, law, or industry group) to protect the confidentiality, integrity, and availability of data. This is usually driven by a security consultant.

What is a Security Consultant?

A security consultant, also sometimes called a security analyst, pinpoints vulnerabilities in computer systems, networks, and software programs and identifies solutions to defend against hackers. This consultant role is a strong example of a highly specialized IT occupation.

What Does a Cybersecurity Consultant do?

Cybersecurity consultants assess an organization's security operations, computer systems, network, and software for vulnerabilities, then design and implement the best security solutions for the company. If a cyberattack does happen, the client will reach out to a security consulting firm, such as CyberSecOp, to seek expertise to respond and mitigate the damage. Cybersecurity consultants and risk managers can provide your organization with technology controls, policies, procedures and other management controls. 

What does a Risk Manager do?

While cyber security consultants/analysts are geared more towards the technology stack of an organization a Risk Manager takes it a level higher and focuses on the organization risk from a holistic view. A risk manager can help an organization understand how to formulate a documented Risk Management Framework (RMF) in which representation from key stakeholders and leaders take part in continuously assessing, identifying and mitigating risks for the organization. This goes beyond the security tools and into the realm of Policy, Culture, Procedure, Communication and continuous improvement. Risk Managers are skilled at organizational risk and are a key component of not only ensuring compliance, but risk reduction as a whole. It is important to remember that being compliant is not necessarily being secure, and risk mangers can bring that whole package together.

What are Cybersecurity Consulting Services?

Cybersecurity consulting helps organizations mitigate certain risks and prevent identity theft, hacking and data theft. A cybersecurity consultant can also help identify risks that the business may have previously overlooked. Cybersecurity consulting acts as an extension to your in-house security team.

Main Areas of Focus Will Be:

• Security management, governance and compliance

• Risk Management

• Security monitoring

• Security architecture

• Incident response

  • Remediation of attacks

  • Attack detection

Cybersecurity Consulting Service Benefits

1. Cybersecurity consulting acts as an extension to your in-house security team.

2. The professionals from CyberSecOp security consulting services can identify problems within the organization

3. Maximize your security investments with cybersecurity services.

4. Cybersecurity consulting management makes it easier to handle regulatory and compliance requirements.

5. Cybersecurity services provide you with experts who have the training, experience and qualifications needed to identify and manage risk all the while ensuring your business remains compliant.

CyberSecOp security consulting services help your organization achieve maturity within your security environment. CyberSecOp cybersecurity consulting firm has experience with diverse clients across many industries. A skilled group of security consultants will know the pitfalls and hurdles to avoid in relation to your security transformation or security compliance requirements.

What is Your Organization's Cybersecurity Game Plan?

What is Your Organization’s Game Plan for Optimizing Cybersecurity Management?

Like the teams prepping for Sunday's Big Game, cybersecurity and risk management require a playbook to efficiently manage multiple frameworks. Most organizations are going on the offensive with their defensive measures in regards to cybersecurity and risk management. CyberSecOp cybersecurity programs empower your security maturity and culture by utilizing multiple security frameworks to address expanding requirements.

 Why is Offensive Defense Important?

Threats like ransomware give attackers the ability to shut down your access to devices, databases and other data streams. While large corporations and government agencies are in attackers’ crosshairs to yield big payouts, small and mid-sized businesses (SMBs) are not immune to ransomware risks.

Which Security Framework Can Reduce the Risk of Ransomware?

CyberSecOp provides cyber risk and advisory programs to identify the right security framework for your organization and industry.   

How CyberSecOp Assists Our Customers:

To protect against ransomware, CyberSecOp assists clients to implement NIST Cybersecurity Framework and NIST SP 800-207, Zero Trust Architecture to help understand, manage and reduce your cybersecurity risks like phishing and ransomware attacks.

CyberSecOp assist our customers with:

Benefits

Reduce the potential of ransomware encryption  

• Experienced Security & IT leader

• Reduce risk

• Build risk assessment program

• Third-party risks, privacy compliance and data processing mapping.

• Response and mitigation strategies

• Security monitoring (SOC & MDR)

• GRC platform that incorporates all stages of processing in the risk operational workflow.

• Monitor and report on combines and individual frameworks

CyberSecOp cybersecurity experts have been involved in thousands of audit processes at organizations worldwide. Our team has experience with the following framework and regulatory requirements: NIST, PCI, HIPAA, GLBA, SOC, FISMA, GDPR, NYDFS, ISO 27000, SEC, FINRA and others.

Cyber Threats Require New Approach to Design Flaws and Risk

Now that the year is in full swing, and you’re only left with the distant memories, COVID, and cyber security, what are your business cyber objectives for 2022?

Ours goals are to continue helping businesses:

1. Improving security for everyone, by doubling the amount or organizations we helped last year (100% our client shows no evidence of a data breach)

2. Offer competitive pricing, to make security an attainable goal for every organization

3. Reduce cost and increase security by implementing more automation and artificial intelligence 

Cyber threats are a real threat to all modern businesses, with the evolution of technology in all sectors. Malicious cyberattacks in 2021 forced shutdown of many business operations at an average downtime of a month.  According to multiple reports, the amount of companies who ended paid hackers grew by 300% in 2020, and 200% in 2021. The businesses that were victimized had two options, pay the ransom or go out of business.

Email is the most popular attack vector

Email is still a top attack vector cybercriminal use. A majority of data breaches are caused by attacks on the human layer, but email hacking is much more than phishing.

Top 3 email attacks

1. Most wire frauds are successful over email communication; the focus trust, in most case the threat actor would be in the middle of a communication between two are more parties. This allows the threat actor to control the conversation, and change wire information.

2. Threat actor’s setup email rules to keep persistent connections and visibility to gain insight into the organization long after all passwords have been changed.

3. Threat actors add external emails to distribution groups to keep persistent connect and gain continuous insight into the organization in preparation for their next attack.

Double and Triple Extortion

Cybercriminal groups identified by the FBI responsible for most incidents are known for conducting aggressive “double/triple extortion” ransomware attacks once they have gained access to a network.

In double extortion attacks not only is the victim organization’s data rendered inaccessible until a ransom is paid but the criminals may further monetize the ransomware attack by coupling it with a Distributed Denial of Service (DDoS) attack or selling the stolen data onto other criminal groups.  In some cases, if the organization is not careful, hackers use email, phone, or text to deceive  employees into helping them commit wire fraud.  

Providing security is challenging in any industry, whether you’re talking about agriculture, automobiles, furniture, financial services, or educational. It requires special equipment and knowledge around how things can fail in the field, and a disciplined approach to executing tests that reflect real-world conditions as much as possible.

This is where CyberSecOp can help your organization

We are an independent third-party testing, and compliance readiness firm, operating only within the cybersecurity industry. With our comprehensive suite of services and solutions our team can provide continuous testing, security program development, security tabletop exercise, security awareness training to reduce risk and increase critical testing against sensitive systems, using real-world conditions.

Ransomware Protection with Zero Trust Security

Zero Trust Security Architecture: Why is the Zero Trust Security Model important?

Endpoints represent the most significant attack surface, according to IDC, with over 70% of breaches originating on the endpoint. Organizations have a diverse mix of endpoints connected to their network, whether laptops, mobile endpoints, servers, firewall, wireless hotspots, or IoT devices. Zero-trust architecture works to ensure that users, devices and network traffic are all verified and subjected to least-privilege rules when accessing trusted resources. This way, compromised assets are limited in their scope and an attacker is prevented from moving laterally across the network.

With the rise of remote endpoints and high-profile ransomware attacks, businesses face more cybersecurity threats than ever before. Traditional network security models which assume users and computing devices within the “trusted” network environment are free from compromise and cannot secure organizations. Businesses are also now recognizing that attacks are more sophisticated and that internal networks are no longer more trustworthy than what lies outside the firewall. CyberSecOp and the security community recognized that Zero-trust security is the ultimate protection against ransomware.

Zero Trust Security Optimization

Zero Trust Network (ZTN) concept follows the mantra of never trust, always verify. Through this approach, organizations can reduce their open attack surface and adopt enhanced security capabilities beyond traditional defenses. Zero Trust enables organizations to reduce risk of their cloud and container deployments while also improving governance and compliance. Organizations can gain insight into users and devices while identifying threats and maintaining control across a network.

Traditional – manual configurations and attribute assignment, static security policies, least-function established at provisioning, proprietary and inflexible policy enforcement, manual incident response, and mitigation capability.

Advanced – some cross-solution coordination, centralized visibility, centralized identity control, policy enforcement based on cross-solution inputs and outputs, some incident response to pre-defined mitigations, some least-privilege changes based on posture assessments.

Optimal – fully automated assigning of attributes to assets and resources, dynamic policies based on automated/observed triggers, assets have dynamic least-privilege access (within thresholds), alignment with open standards for cross pillar interoperability, centralized visibility with retention for historical review

10 Ransomware Prevention Best Practices

Below are 10 best practices to help security professionals improve endpoint management:

CyberSecOp Managed Zero Trust security services were built with a new approach that creates zero-trust connections between the users and applications directly to solve this unique challenge. As a scalable, cloud-native platform, it enables digital transformation by securely connecting users,

devices, and applications anywhere, without relying on network-wide access. This platform is delivered by five key architecture attributes, unique to the CyberSecOp Managed Zero Trust Security services that together enable organizations to provide strong security and a great user experience to their employees and customers.

1. Multi-Factor Authentication (MFA) is is an electronic authentication method in which a computer user is granted access to a website or application only after successfully presenting two or more pieces of evidence to an authentication.

2. Email Security is critical because 74% of organizations in the United States experienced a successful phishing attack. Implementing email security gateway, DMARC, SPF, DKIM, stronger encryption, and MFA can reduce email compromise by over 98%.

3. CyberSecOp endpoint management solution that supports application isolation and containment technology is a form of zero-trust endpoint security. Instead of detecting or reacting to threats, it enforces controls that block and restrain harmful actions to prevent compromise. Application containment is used to block harmful file and memory actions on other apps on the endpoint. Application isolation is used to prevent other endpoint processes from altering or stealing from an isolated app or resources. This can prevent ransomware from being deployed on devices.

4. CyberSecOp endpoint management solution support Protective DNS Service (PDNS) refers to a service that provides Domain Name Service (DNS) protection (also known as DNS filtering) by blacklisting dangerous sites and filtering out unwanted content. It can also help to detect & prevent malware that uses DNS such as URL in phishing emails and hiding tunnels to communicate attackers' command and control servers.

5. CyberSecOp endpoint management solution supports bandwidth throttling so that remote endpoints can be continuously patched and secured rather than having to periodically send IT resources to remote locations. Our solution delivers patch management over the internet without requiring corporate network access. This ensures that internet-facing systems are patched in a proactive, timely manner rather than IT having to wait for these devices to visit the corporate network before they can be scanned and remediated.

6. CyberSecOp endpoint management reduces administrative overhead of endpoint management solutions to accommodate tight budgets and future growth. Our solutions support many endpoints using a single management system.

7. Consolidate endpoint management tools. Use a single tool to patch systems across Windows, Mac and variations of Unix operating systems to simplify administration, minimize the number of open network ports, and reduce the number of active agents on endpoints.

8. Validate that the endpoint management solution provides accurate, real-time endpoint data and reports. End users make changes to endpoints all the time and information that is hours or days old may not reflect a current attack surface.

9. CyberSecOp endpoint management allows administrators to apply patches that address the highest levels of risk first based on current endpoint status. This gives the biggest impact from remediation efforts.

10. Make sure the endpoint management solution enforces regulatory and corporate compliance policies on all endpoints constantly to avoid unintended drift and introduction of new vulnerabilities.

To conclude

Ransomware protection needs to go beyond detecting and blocking an initial malware infection at the email perimeter. Malware can enter your organization by other means, and cyber attacks often use the web channel to contact command and control servers and download the encryption keys necessary to complete the cyber attack.

CyberSecOp Becomes A CMMC Register Provider Organization

CyberSecOp is a leading Cybersecurity Services Provider offering a comprehensive portfolio of Cybersecurity Maturity Model Certification (CMMC) advisory services and cyber security solutions.  

CyberSecOp is an CMMC Registered Provider Organization (RPO) listed on the CMMC-AB Marketplace. Our organization staff have passed the RP Exam, Background Check and signed the RPO agreement, indicating our commitment to comply with the CMMC-AB Code of Professional Conduct. CyberSecOp is also an ISO 27001-certified organization.

 What are CMMC-AB, CMMC, and the Responsibility of the RPO Designation?

 CMMC-AB authorizes RPOs to provide CMMC consulting services in support of government contractors, supply chain/DoD suppliers, and organizations seeking certification within the Defense Industrial Base (DIB).

The CMMC-AB is an independent accreditation body that manages the CMMC on behalf of the DoD. The CMMC framework is a set of mandatory cybersecurity requirements that all contractors within the DoD supply chain will be required to implement and, beginning this year, to have verified by an independent CMMC Third Party Assessment Organization (C3PAO). CMMC was created to address the ongoing theft of and unauthorized access to Controlled Unclassified Information (CUI) by foreign adversaries through the enforcement of good cyber hygiene and best practices. 

It initially launched in June 2020 and formally announced in August 2020 that it was accepting applications for five types of credentialed roles within the CMMC ecosystem. These include the following:

·         C3PAOs

·         Certified Assessors (CAs)

·         Certified Professionals (CPs)

·         Licensed Partner Publishers (LPPs)

·         Registered Practitioners (RPs)

·         Registered Provider Organizations (RPOs)

The CMMC framework establishes five certification levels with a defined security posture or maturity level an organization must achieve, determined by the sensitivity of the information they handle. These are outlined below:

How can CyberSecOp help your organization with CMMC?

CyberSecOp has created a suite of advisory services to help organizations effectively plan and prepare for an official CMMC assessment: CMMC Consulting, CMMC Readiness, Assessments, CMMC-RPO, CMMC Gap Analysis, DFARS, ITAR, VCISO, MSSP, NIST 800 53, and NIST Cybersecurity Framework (CSF), NIST 800-171, Security Services.

 CMMC Scoping Workshop – determine the type of data and the required CMMC maturity level needed. Identify how data is received, stored, shared and handled on all information systems.

CMMC Gap Analysis – identify discrepancies between current state and CMMC maturity levels as determined in the scoping workshop. The CMMC Gap Analysis will provide areas of weakness that need to be targeted to reach the desired maturity level.

 CMMC Remediation Strategy –assist the organization with remediation efforts, including resolving discrepancies identified in the CMMC Gap Analysis and creating a strategic plan for remediation. This process may include security control testing, polices, procedures and plan creation to close all known gaps related to the desired maturity level. 

VCISO (Virtual Chief Information Security Officer) – CyberSecOp provides a board-level security expert backed by a team of professionals to ensure continuous compliance and maintain the maturity level as threats, infrastructure and business objectives evolve. Services include the following.

•  Compliance Advisory Consulting Services

• CMMC Readiness

• Vulnerability and Penetration Testing Assessment

• Ransomware Response

• Forensic Analysis

• 24/7/365 Security Operations Center (SOC)

• Cyber Security Consulting

• CMMC Cybersecurity RP, RPO

• Incident Response & Incident Management

• Security Assessments

• Security Awareness

• Data Loss Prevention 

About CyberSecOp

 Cyber Security Operations Consulting (CyberSecOp) is an innovative cybersecurity firm, providing consultants and managed security services to empower businesses since 2001. Our IT & cybersecurity consulting services protect you from cyber criminals in myriad ways. From implementing individualized Cyber Security Programs, which include written Information Security Programs, Incident Response Policies and Plans, and Cybersecurity Assessments, to offering the best-in-class cybersecurity consulting, tools, and IT security solutions, we do it all.

CyberSecOp is an CMMC-AB RPO & ISO 27001 Certified Organization - join thousands of businesses by putting your security in our hands. For more information about CyberSecOp and CMMC, contact us at 866-973-2677, Sales@CyberSecOp.com or visit: www.CyberSecOp.com.

Microsoft Warns of Sneaky Phishing Campaign

Microsoft's Security Intelligence team sounds the alarm on a sneaky phishing email campaign with fake sender addresses. The phishing email also cleverly employs various detection evasion techniques to trick most automated filters and users in its attempt to garner Microsoft Office 365 credentials.

The alert was sent after observing an active campaign that was zoning in on Office 365 organizations with convincing emails.

In a statement by Microsoft, "An active phishing campaign is using a crafty combination of legitimate-looking original sender email addresses, spoofed display sender addresses that contain the target usernames and domains, and display names that mimic legitimate services to try and slip through email filters."

Microsoft notes that this campaign is sneakier than usual due to the convincing Microsoft logos with the link posing as a 'file share' request to access bogus reports. However, the main phishing URL relies on a Google storage resource that takes the victim to the Google App Engine domain Appspot. This results in hiding a second URL that directs the victim to a compromised SharePoint site, and thus allowing the attack to bypass sandboxes.

Researchers at Microsoft have published details

Researchers at Microsoft have published details regarding the architectures connected to the spoofed emails mimicking SharePoint and other products for credential phishing. "The operator is also known to use legitimate URL infrastructure such as Google, Microsoft, and Digital Ocean to host their phishing pages," Microsoft added.

Accounting to the FBI

According to the FBI's latest figures, phishing attacks have cost Americans more than $4.2 billion last year. Fraudsters employ business email compromise (BEC) attacks, which rely on compromised email accounts or email addresses that are similar to legitimate ones and are difficult to filter as they blend within normal, expected traffic. BEC attacks are far more costly than high-profile ransomware attacks.

Why Supply Chain Attacks Keep Happening, and How

Authored by Alison Stuart, Sales Lead at CyberSecOp

What Is a Supply Chain Attack? 

Supply chain attacks have crept to the top of the cybersecurity agenda after hackers alleged to be operating at the Russian government’s direction tampered with a network monitoring tool built by Texas software firm SolarWinds (CNBC), costing the company  $18 million in the first three months of 2021.

The hackers used a supply chain attack to insert malicious code into the Orion system. A supply chain attack works by targeting a third party with access to an organization's systems rather than trying to hack the networks directly. The third-party software, in this case, the SolarWinds Orion Platform, creates a backdoor through which hackers can access and impersonate users and accounts of victim organizations. The malware could also access system files and blend in with legitimate SolarWinds activity without detection, even by antivirus software. SolarWinds was a perfect target for this kind of supply chain attack. Because their Orion software is used by many multinational companies and government agencies, all the hackers had to do was install the malicious code into a new batch of software distributed by SolarWinds as an update or patch. (WhatIs.com)

Why Do Supply Chain Attacks Keep Happening, and How?

The short answer: ensuring the security of every single third-party vendor you interact with is complicated. Even if you require that your vendors are certified to be meeting some particular security standard such as NIST 800-171, that’s no guarantee that they can’t be compromised.

Why Does It Matter If My Vendors Are Secure, As Long As I Am?

Let’s look at what happened to Target. Target was pretty secure, but their HVAC supplier, Fazio Mechanical Services, was not. In 2013, Target was breached through the credentials hackers acquired from Fazio Mechanical Services, and malware was deployed to Target’s point of sale (POS) systems. Those systems collected credit card data from over 40 million shoppers who had visited Target stores during the 2013 holiday season. (NBC) 

So How Did the Breach Impact the Company? 

Not only did Target’s CEO, Gregg Steinhafle, step down within 6 months, but the company reported a 46% drop in profits in the fourth quarter of 2013 compared with the year before. (New York Times) Target spent 100 million dollars upgrading their payment terminals to support Chip-and-PIN enabled cards in response to the attack. Theoretically, that should protect them from future such incidents, right? Wrong. The number of customer cards that Chip-and-PIN-enabled terminals would have been able to stop the bad guys from stealing had Target put the technology in place prior to the breach is 0. Without end-to-end card data encryption, the card numbers and expiration dates can still be stolen and used in online transactions. (Krebs On Security)

Isn’t this Mostly Ancient History?

The Kaseya breach on July 2nd, 2021, left the private sector reeling most recently. A successful ransomware attack on a single company had spread to at least 200 organizations that the company provided software to (and likely far more, according to cybersecurity firm Huntress Labs). That number made it one of the single most enormous criminal ransomware sprees in history. Kaseya announced Friday afternoon (Kaseya) that it was attacked by hackers and warned all its customers to stop using its service immediately. Nearly 40 of its customers were already confirmed to have been hacked as of the evening of the press release.

Protecting your customers from potentially unsafe vendors is essential: 

Research shows that 2017 alone saw a 200% increase in supply chain attacks (DarkReading), and 56% of surveyed organizations had experienced a breach caused by one of their vendors. In Q1 of this year, The Identity Theft Resource Center (ITRC) said 137 organizations reported being hit by supply chain cyber-attacks at 27 different third-party vendors. The ITRC also indicated that the attacks in Q1 have affected seven million people.  Data breaches included high-profile cyber attacks on IT provider Accellion’s File Transfer Appliance (FTA), which impacted organizations including Shell, the Reserve Bank of New Zealand, Bombardier, and Kroger.

So How Can You Protect Your Company?

The easiest way to protect your company is to ensure you have an active vendor management program. CyberSecOp offers this service to companies of all sizes - contact us now to learn more or explore our Vendor Risk Management Services.

Three Reasons Why You Need an Incident Response Solution

Imagine the following scenario: you arrive early to work in the morning, plop down at your desk with coffee in hand, and log in to your computer. You’re excited to start working on a big project, but first you are greeted with this message:

Quickly, you dash over to a colleagues’ desk. They too, have the same message on their desk. You try dialing your IT department, but they don’t start until normal business hours.

What do you do? Where do you even start?

It’s easy to think that the above scenario would never happen to you. In reality, a 2020 survey of 600 businesses in the United States revealed that a staggering 78% had been infected with ransomware that year. The average cost of recovering from a ransomware attack has spiked to $1.85 million in 2021!

Ransomware isn’t the only threat to your business continuity. In February 2021, the state of Texas suffered massive power outages due to a severe winter storm. At least 151 people died as a result. Property damage has been estimated at more than $195 billion.

What do these scenarios have in common? They demonstrate the need to prepare for the worst; this is the essence of Incident Response.

What is Incident Response anyway?

Every organization needs to have an Incident Response Plan (IRP). The team that executes the IRP is the Computer Incident Response Team (CIRT). The most important feature of both the IRP and CIRT is that they are clearly defined before the incident takes place! Disaster recovery is hardest when preparation is lacking.

The Incident Response Plan details who does what if an incident does happen. This can include using alternate systems, notifying stakeholders, or restoring from backups.

Perhaps the most important part of the Incident Response Plan is the postmortem. Now that you’ve recovered, what will you do in order to ensure that attackers won’t attack again using the exact same methods? The Incident Response Team will identify what door the attackers used to get in and make sure it stays shut.

Why do I need Incident Response?

I’m so glad you asked. Here’s three reasons why you need Incident Response for your organization:

1.     The probability of an incident has never been higher.

Ransomware is pervasive. At this point, we need to ask ourselves not “will I get breached?” but “when will I get breached?”

A proper defense has multiple layers. Having a fence around your house is nice, but you’ll still have homeowners’ insurance. Incident Response is a way to mitigate the risks of ransomware that we can’t avoid.

2.     The cost of an incident has never been higher.

How much would it cost to replace your entire infrastructure? The nasty aspect of ransomware is that, in some cases, the only way to ensure that the attackers have been completely removed from your environment is to start from scratch. This means replacing every workstation and server in your organization.

Sometimes, there simply isn’t a price to pay; there may not even be new hardware available to purchase with a global silicon chip shortage.

3.     You can’t afford not to.

Every business owes itself to do a risk analysis of a ransomware attack. What would be the cost of not doing business for an hour? A day? A week? You will find that incident response is a necessary piece of the plan for protecting your assets and business continuity.

CyberSecOp is a leader in the Incident Response field. CyberSecOp consultants are cyber incident response subject matter experts who have collaborated on numerous security projects and operational improvement initiatives. We will support your security operational activities by helping to develop an incident response plan and work with your IT team to mitigate any potential risk. Our teams will create investigative processes and playbooks. In addition, we will be responsible for continuously identifying gaps and managing the improvements in the security response process, technologies, and monitoring. Working closely with internal architecture, engineering, and project management teams will ensure cyber-defense requirements are identified and communicated early in the project life cycle.

Security incident response services with CyberSecOp

• Support cyber incident response actions to ensure proper assessment, containment, mitigation, and documentation

• Support cyber investigations for large- and small-scale security incident breaches

• Review and analyze cyber threats and provide SME support

• Interact and assist other investigative teams within on time sensitive, critical investigations

• Participate as part of a close team of technical specialists on coordinated responses and subsequent remediation of security incidents

• Manage the security monitoring enrollment process to ensure adequate coverage and effectiveness of all new and existing cloud- and on-premise-based applications, services and platforms

• Maintain detailed tracking plan of all internal/external enrollment outcomes/recommendations and provide support through to implementation

• Act as a liaison between cyber-defense, engineering, security architecture, network & system operations, and functional project teams to ensure effective project implementation that meets incident response requirements

• Define baseline security monitoring requirements for all new projects, services, and applications joining your organization's network

• Facilitate the development and tuning of SIEM rules to support enrollments and ensure high fidelity alerting

 Don’t delay in ensuring that your business can survive any threat. Join CyberSecOp on your journey towards a safe and protected future.

Author: Josh Cabrera

What is a Zero Trust Security Architecture?

What is Zero Trust Security?

Zero Trust Security, also referred to as Zero Trust Networks or Zero Trust Architecture, is a security concept with one basic principle: don’t automatically trust anything to access your data, whether it’s connecting from outside your organization or within. Implementing Zero Trust involves various technologies, policies, and processes that help you better respond to the sophisticated approaches cybercriminals are using to gain access to sensitive data.

CyberSecOp’s Zero Trust Security service offers a comprehensive solution to secure all access to your applications and environment from any user, device, and location. Zero trust is a security model based on maintaining strict access controls.

With the recent and very public surge of cyber incidents affecting businesses and critical infrastructure, you may have heard the phrase ‘Zero Trust’ regarding cyber security and protecting business assets. So what is Zero Trust? Put Zero Trust is a model of thought that centers around never trusting any device, application, or person, regardless of whether they are attempting to connect from inside or outside the network. This methodology is gaining more and more traction as cloud application usage increases and the permanent shift to remote work is further implemented.

 Zero trust is a strategy where everything (People, Data, Sessions, Devices, Applications) is treated as suspicious regardless of whether it's inside or outside the network. Essentially it is a ‘default deny’ posture, even for users within the organization. Instead of ‘Trust, verify the organization ‘Never Trusts, Always Verify.’ This is not accomplished by one tool but rather by policy, procedure, and means. Zero trust also focuses on Least Privilege- a Methodology that states no user should have more rights and permissions than what is needed to perform their work.

Zero Trust focuses on 5 pillars

1.       Device Trust

2.       User Trust

3.       Transport and Session Trust

4.       Application Trust

5.       Data Trust 

CyberSecOp can transform your business into a Zero Trust model by focusing on the tools, policy, and procedures to protect these five pillars and substantially decrease the odds of a successful breach. 

ZERO TRUST SERVICES & ZERO TRUST PLATFORM

OVERVIEW: MANAGED SECURITY - MDR SERVICES - MANAGED COMPLIANCE

With Zero Trust network access for your private apps and systems, you no longer have to choose between user experience and security. CyberSecOp Managed Zero Trust services were built with a new approach that directly creates zero trust connections between the users and the applications to solve this unique challenge. As a scalable, cloud-native platform, it enables digital transformation by securely connecting users, devices, and applications anywhere without relying on network-wide access. This platform is delivered by five key architecture attributes unique to the CyberSecOp Managed Zero Trust services. Together, they enable organizations to provide strong security and a great user experience to their employees and customers.

ZERO TRUST SECURITY SOLUTION & SERVICES

When all employees have the same access privileges, the network is vulnerable. VPNs may provide adequate security for on-premise resources, but only Zero Trust solutions offer the user-based access rules required for proper cloud security.

Our Zero Trust solutions and services utilize multi-layered cybersecurity protection to transform your business with cybersecurity orchestration, automation, cybersecurity consulting, cloud, and managed security services. We implement a comprehensive approach to secure and protect businesses from cyber threats. Our cybersecurity services cover all the following areas needed for a zero-trust secure environment:  Cybersecurity Program Strategy, Risk Management, Risk Assessment, Threat Intelligence, Incident Response, Advanced Malware & Ransomware Protection,  Perimeter Security,  Application Assessment, & Security Monitoring Services. We know where you are and how to protect your organization with a cybersecurity gap analysis to identify a more precise road map and a more robust cybersecurity program.

Zero Trust Cybersecurity Benefits and More

Zero trust networks, of course, extend beyond security. They are also inherently agile, a vital benefit for an increasingly remote workforce. As massive remote crews put unprecedented strain on cloud resources, the more stability and resilience you can build into your architecture, the better. Rather than backhauling remote data to a static data center, zero trust applications connect directly into your network from outside the perimeter, which helps free up bandwidth for DevOps and access business-critical cloud services.

ADOPT OUR ZERO TRUST SECURITY MODEL DEFENSE APPROACH

AUTOMATED PKI LIFECYCLE MANAGEMENT ZERO TRUST

The automated PKI lifecycle management platform enables Zero Trust by utilizing  Public Key Infrastructure (PKI) certificates and key pairs, strengthening digital identities, and securing the connections between entities beyond the firewalled network architecture. In this age of digital transformation, the Zero Trust model increases the need for a consolidated, automated, and modern approach to PKI.

SECURE INTERNET GATEWAY

Control desktop, laptop, and mobile device access to malicious and inappropriate websites.

SECURE WEB GATEWAY

Protect against every kind of threat and ensure strict compliance with policies without slowing down your users.

ANTI SPAM & EMAIL GATEWAY

Secure Email Gateway protects organizations and employees from spear-phishing, malware, spam, and zero-day attacks. To ensure zero trust by removing spam and malicious email traffic before it enters your network to ensure zero trust.

ADVANCED ENDPOINT PROTECTION

Secure all your servers, desktops, laptops, and mobile devices from known and unknown malware–without requiring signatures or updates.

WEB APPLICATION FIREWALL

Powerful, real-time edge protection for

web apps and websites providing advanced

filtering, security, and intrusion protection.

SIMPLIFY COMPLIANCE REPORTING

Meet compliance requirements with no extra work. CyberSecOp Consultants have you covered, delivering streamlined reports of system access across the organization and zero trust technologies. 

CYBER SECURITY OPERATIONS CENTER

Your always-on certified cybersecurity professionals team provides 24/7/365 surveillance and remediation services to ensure zero trust.

DATA LOSS PREVENTION

Monitor and control the movement of sensitive and confidential data across the network. Implement a ‘zero-trust’ data loss prevention (DLP) strategy utilizing activity, system-access, schedule, and content-based rules to ensure zero trust.

SINGLE SIGN-ON

A secure cloud single sign-on solution that IT, security, and users will love. Single sign-on solutions can quickly connect to and sync from identity stores including AD, LDAP, HR systems, and other third-party identity providers to ensure zero trust.

MULTI-FACTOR AUTHENTICATION

Secure, intelligent access to delight your workforce and customers. Secure your accounts and apps with a robust multi-factor authentication solution to keep the right people in and the wrong people out. Protect all your resources, including customer-facing and enterprise apps that store your most sensitive data to ensure zero trust.

SECURITY INCIDENT EVENT MANAGEMENT

We are providing actionable intelligence leveraging current events and data. Our SIEM collects logs and circumstances of the network traffic and web assets, security devices, operating systems, applications, and databases and reviews the vulnerabilities using artificial intelligence to process to ensure zero trust.

REMOTE MONITORING AND MANAGEMENT

Remote Monitoring and Management (RMM) is remote monitoring software that allows you to remotely monitor and manage endpoints, computers, mobile devices, and networks from a centralized console to ensure zero trust.

MANAGED CYBERSECURITY SERVICES

CyberSecOp is a cybersecurity service provider offering a range of solutions related to protecting computer systems within an organization. Cybersecurity is a constantly evolving industry created in response to hacking, viruses, and other personal and business data threats. CyberSecOp-managed cybersecurity services will provide your business with expertise in the three stages of business cybersecurity protection services: assessment, security program implementation, and governance. We implement external and internal cybersecurity solutions with advanced IT security software and hardware solutions. CyberSecOp provides several cybersecurity tools to ensure end-to-end cybersecurity protection. We also offer IT outsourcing services to address your company’s information technology needs.

End to End Cybersecurity Services

We offer cybersecurity and strategic advisory consulting, incident response, design, and deployment services. We will implement a security program strategy to align information security policy, security controls, and plan with business goals.

LEADING MANAGED CYBERSECURITY SERVICE PROVIDER

CyberSecOp is a leader in managed cybersecurity services. Our cybersecurity team will implement a secure framework and constantly monitor and protect your business from cyber threats. Our cybersecurity experts integrate business context intelligence, threat data, and cybersecurity insights to protect your assets and data. The risk scene develops with rising rates; it takes more oversight with cybersecurity services to effectively ensure your organization is secure from cyber threats. Our team will work with your firm to identify any risks or threats it may face. We will deliver recommendations highlighting security flaws in your environment and the immediate steps to these issues.

CYBERSECURITY AS A SERVICE (CSAAS)

CyberSecOp offers proactive Cybersecurity as a Service (CSaaS) to mitigate cyber risk. Every business needs defense in-depth, includincludessecurity solutions and cybersecurity experts who can deploy and monitor them. 

Transform and strengthen your cybersecurity to become proactive, effective and resilient. Cybersecurity is a core business requirement, providing a secure foundation to transform your enterprise and support your business. Ready to see how CyberSecOp Cybersecurity Services can help?

Why a vCISO may be right for your organization cyber security

Since the start of the COVID19 pandemic, several societal changes have shaped how firms function in the current climate. Many firms have implemented a work-from-home model to help prevent the spread of the novel coronavirus and ensure employees are comfortable with their surroundings. What many organizations didn’t anticipate are the cyber security-related risks.

Once employees leave the security of their offices, they increase their attack surface and open themselves and their employer to attendant Information Security vulnerabilities that may come with working remotely. Remote work changes have prompted heightened instances of cyber attacks that have worsened in style and quantity over time. The pandemic has created the perfect environment for hackers to attack with more accuracy, and with greater cost to the firm, than ever. Learn more about remote working in relation to the pandemic. 

How a vCISO can help protect your firm from cyber attacks

A vCISO can function as an additional set of eyes that constantly monitors your firm’s security operations. The additional security will aid in preventing possible security breaches. A vCISO can also bring expertise to assist in developing a strategy to strengthen your firm’s security program.

The benefits of a vCISO: 

• A board-level cyber security consultant fulfilling the CISO responsibilities 

• A team of security risk assessment experts 

• Employee security awareness education 

• Dark Web Monitoring 24/7/365

• Full enterprise risk management for any required compliance 

• Comprehensive third party/vendor  management 

• Compliance support for NIST, ISO, GDPR, CCPA, NYDFS, PCI/DSS among others

• A more affordable approach as opposed to hiring a full-time CISO

• Eliminate internal training costs and have our seasoned experts handle your security 

CyberSecOp offers vCISO services. Click here to learn more.

Using Linux Won't Save You from Ransomware - Here's Why

"Ransomware attacks are becoming more targeted, sophisticated, and costly, even as the overall frequency of attacks remains consistent." (FBI, 2019)

Since early 2018, there has been a sharp spike in the cleverness, thoroughness, and precision of the security breaches we see in the ransomware landscape. Regardless of attack vector - whether it's from phishing, vishing, or the classic insider threat - once ransomware is on your computer, it's incredibly difficult to restore your files. It takes some serious intervention to stand a chance of recovering your business (or personal) data. 

The easiest solution is to get the appropriate key and decryption tool, and use them together to unlock your files...but typically you only receive those resources in exchange for paying the ransom, and many companies can’t afford the ransom at its original price. By that time, there's a good chance you've taken a catastrophic financial blow.  From hospitals, to insurance companies, to banks, there are plenty of highly valuable (and highly vulnerable) assets to be manipulated, and threat actors don’t hesitate to put lives at stake for the benefit of their wallets.

So how can we prevent these breaches? What is the key to staying safe from attackers?

The answer may be simpler than you think.

The three most impactful measures you can take to stay safe are as follows:

★    Quarantine

○     Take your computer off the network or wifi and reset your data by wiping the device entirely back to its factory settings (the way it came when you bought it) the moment you can confirm there has been a breach.

★    Have a backup

○     You can only take the first measure if you either don’t care at all about your data, or you have bothered to back it up so you have an unencrpted copy.

★    Get help negotiating your ransom down

○     If you need to pay the threat actor the ransom money to recover your data, there are many firms that can help you with this - don’t pay the full price of the ransom! Firms that can help with ransom negotiation and essential protections include CyberSecOp, which you can reach by using Our Contact Form.

So what’s so special about the threat of Linux-based malware? A Linux-based ransomware variant has the potential to take down any and every industry. Major cloud providers like AWS (Amazon Web Services), Oracle, and Microsoft base entire workloads on Linux; malware sweeping through those servers could bring down any company that uses a modernized cloud stack to host their sites and data.

And then there are hacktivists - hackers who hack to do activism for their cause (which can vary greatly in scope between organizations). Hacktivists have a history of using their ransomware attacks to make a point - whether it’s political or personal - and to incite fear in other companies or individuals who support the cause represented by the victim. While you might not think this presents a threat to you personally, or even to your business, the truth is that innovations in cyberattacks threaten us all. If the target were to have a Linux-based system, the hacktivist group targeting that individual would be devoted to finding a way to spread ransomware across Linux-based devices. When ransomware is evolved by perpetrators to this degree, we are likely to see major outages across all the cloud providers listed above, and it could cripple any business or personal account that is hosted therein.

To avoid such a catastrophic and monolithic problem, we should learn to govern our systems from a more ecosystem-centric approach, rather than depend on the classic signature-based antivirus alerts that have become standard. You may recognize Norton Antivirus alerts or even operating-system-based protection like Windows Defender presenting to you pop-ups about updating your signatures.

The truth is that we shouldn’t rely on the technical drivers of these updates, the people who hunt down and publish these known virus signatures, to keep us safe. We should be educating our employees, friends, and families, on the essentials of how to stay digitally secured and prevent breaches in the modern threat landscape. This concept is especially important as a mere tweak in the code of a virus and a quick recompilation of that code can cause the hash (or signature) of the virus to change, causing these famous signature-based antivirus softwares to completely miss the threat on your device.

A phenomenal example of how dangerous this variant-based workaround can be is what happened to the Colorado State Department of Transportation (CDOT) in early 2018.

“As CDOT’s Information Security group scrambled to contain the spread and impact of SamSam’s first wave, their efforts were quickly undermined by another variant of the same ransomware strain that was spreading throughout many of the newly sanitized zones of their network.”[1] (Richard Horne for the SANS Institute)

In an interview with the Denver Post, Brandi Simmons, a spokeswoman for the state's Office of Information Technology said, “The variant of SamSam ransomware just keeps changing. The tools we have in place didn't work. It's ahead of our tools.” The tools in question were signature-tracking antivirus software, like what many of us use on our home computers. In the end, Colorado's Office of Information Technology, the Colorado National Guard, and the FBI all had to collaborate to contain this threat, and by the time they had, over 2,000 computers running Windows and McAfee security software had been taken offline.

In conclusion, it seems inevitable that we will see Linux systems fall prey to the same types of ransomware we currently battle; it’s only a matter of time. Make sure you’re safe and you know how to protect your data: maintain a backup of all your files, be ready to quarantine in the event of a breach, and remember not to panic. We are here to help.

Sources:

https://www.sans.org/reading-room/whitepapers/tools/strings-me-linux-ransomware-39870

https://www.darkreading.com/attacks-breaches/second-ransomware-round-hits-colorado-dot/d/d-id/1331197

Authored by Alison Stuart

Pandemic & Post Pandemic Cyber Security Remote Workforce

The current pandemic gives cloud computing a push forward; our clients are taking advantage of CyberSecOp Alliance resilient cloud-based digital infrastructure for businesses of every size to protect their data. We have noticed 58% growth in our Cloud services, securing and protecting data while working remotely is one of the top concerns for most of our clients.

During the crisis, cyberattacks have increased worldwide, including against critical healthcare institutions, which have been the target of ransomware attacks. Private-sector data reveals a 350% surge in phishing websites since the start of the pandemic.

Our security professionals prepare for a new level of untrusted network activity and cyber attacks as remote working is expected to continue. What are the questions you should be asking, and what controls need to be in place?

Pandemic & Post Pandemic Cyber Security

While we are still very much on this transformation journey, we are working on the mindset of our clients to be prepared for quicker response to a crisis like COVID-19, by doing this we will increase business continuity and build-in security for all remote working processes. Removing legacy systems, introducing more automation, better identity and access management for remote systems, secure build for remote devices, extended security services such as Managed Detection and Response (MDR), IPS/IDS, Advanced Endpoint Protection, Application Firewall, DNS Filtering, Automated Virus Containment, and Filer Reputation Detection this will provide an additional layers of security for remote workforce, please see below for other recommendations.

Telecommuting is the only way of working for many

1. Adoption of virtual desktop will finally see an upswing:

With tele-working likely to become the norm, virtual desktops could become the security baseline for IT teams to enforce data management standards. Virtual desktops emulate a computer system so that IT can control access as such adding input/output devices as well as software and applications. This could become an important control point when remote workers are operating outside the safety of a corporate network.

To meet the stringent criteria of regulatory and corporate compliance regarding data security, many companies will see the adoption of virtual desktops as the go-to solution.

2. We will notice surge in adoption of decentralized cyber security:

Traditional cyber security controls dictate a centralized approach where data is consolidated from different sources to perform analysis and investigation. With swift digitization, security controls will shift to data sources, similar to the trend witnessed in IoT. We could start seeing a new wave of anti-virus, data loss protection, digital rights management and endpoint-based firewalls and other security controls gaining traction.

With millions of employees working from home, hackers’ focus has shifted from enterprise to remote working individuals. To handle the menace that exists in cyberspace, decentralized cyber security will rise where greater emphasis will be placed on data sources such as actual remote employees themselves.

3. Rise in bio metric way of authentication:

User access controls have largely revolved around one or two-factor authentication. These methods rely on “something you know (username)” and “something you have (password)” and given hackers’ interest in employees as the weak link to start a technical exploit, we will see cyber attacks directed towards individuals.

This means identity protection will be of priority and the best defense should focus on building authentication systems which focus on “who you are.” This would require advanced bio metric solutions such as fingerprint/thumbprint/hand print, retina, iris, voice, and facial recognition technologies.

With bio metrics, hackers’ attempt at impersonating you just got a lot harder than trying to break into passwords. 

New processes will govern our way of work

1. Global privacy regulation and policies will require a re-look:

The current state of privacy regulations is designed around the enterprise network and building the proverbial wall to keep sensitive data out of prying eyes. With remote working concepts taking center stage, re-evaluation of these policies is needed to address the new cyber threats.

From a risk management perspective, global privacy policies will need to encapsulate standard operating procedures regarding BYOD, GDPR, NYDFS, CCPA, SHIELD Act compliance and state privacy laws.

Governance around companies and employees’ social media profiles would also have to be included as these platforms are frequently trolled by hackers as they carry out reconnaissance before launching a cyber attack.

2. Cloud will become more important than ever before:

 The shift to cloud services offers employees, customers, suppliers, and everyone else across the ecosystem a seamless and frictionless access to data and applications. Remote access by various users would compound security challenges and presents many new potential attack vectors.

In the post-pandemic world, IT resources would shift towards data, particularly keeping data secure across cloud platforms.

3. Containerization technology will be extended beyond enterprise network to include endpoints:

IT architectures will extend containerization and zoning concepts to include not just systems, but also people, roles, and the level of sensitive data they possess. Containerization, thus, will be extended beyond enterprise networks to include endpoints such as remote worker machines and mobile devices.

This will facilitate cyber security teams to apply varied access controls and demarcate data storage to minimize risk of cyber intrusion and data breach.

Source: Cybersecurity Ventures

Home Routers Major Weakness in Work from Home Revolution

‘Prepping’ for Work from Home

For the past few years employees and employers alike extolled the virtues of working from home (‘WFH’). We’ve heard the stories of how it leads to a happier and more productive employee, less overhead for the employer, and just more flexibility overall. Most people knew a shift would come eventually – kind of like the shift to IPV6- but it stalled and stalled. Then the pandemic happened and WFH had been thrust upon us with such force that businesses were, and still are, scrambling to get the pieces in place for an effective remote staff.

It is no longer a secret that WFH is here to stay. Many businesses including Fujitsu and Twitter have just gone ahead and implemented WFH ‘forever’. With this change come challenges. One of those is the security of routers in the millions upon millions of homes that now serve as working offices.  According to a study by Germany’s Fraunhofer Institute for Communication, vendors have failed to fix hundreds of vulnerabilities in their consumer-grade routers, leaving hundreds of thousands of users exposed to a wide range of attacks. "Nearly all were found to have security flaws, some of them very severe," the Fraunhofer Institute said in a press release. "The problems range from missing security updates to easily decrypted, hard-coded passwords, and known vulnerabilities that should have been patched long ago."

 Advice on next steps

So what should we do? The first step is to know the make and model of your router. Research it for any known vulnerabilities, as there may be some cases where the device is so insecure that even patching it still leaves it vulnerable. Once you’ve decided if it is worth keeping the device make sure that it automatically installed firmware updates. If not you may need to manually update it. A task that is well worth the effort. Another task is to make sure that the administrator password for the router has been changed from the default admin password. Many routers now have unique default passwords for their routers- but there are still plenty out there that don’t.

WFH Users should use complex passwords on their routers including:

·         Uppercase and Lowercase

·         Numbers and Symbols

·         At least 8 characters long

You should also use the strongest Wi-Fi encryption your router supports. WPA3 (Wi-Fi Protected Access Version 3) is best.

You may have children working, playing, and streaming while you are home. Ensure they use their own devices and do not surf on your work devices.

Router configuration and device hardening are just one of the many layers of security that businesses need to adapt and expand to their remote workforce. We here at CyberSecOp would not be surprised if, sooner rather than later, companies begin purchasing, installing, and administering home routers to ensure a secure endpoint to endpoint networking. Until then remain vigilant and patch patch patch!

Author: Carlos Neto