Mitigating Risk: Understanding Vulnerabilities in the Ivanti Product Suite

In recent months, the Ivanti product suite has encountered several high-profile vulnerabilities, raising concerns within the cybersecurity community. Since the start of the calendar year, four critical vulnerabilities have been associated with Ivanti Connect Secure, Policy Secure, and Neurons. While the vendor has diligently addressed each vulnerability and deployed mitigations, the recurrence of vulnerabilities within a short timeframe underscores the importance of maintaining vigilance when managing Ivanti products.

Overview of Vulnerabilities

CVE-2023-46805: This authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x, and Ivanti Policy Secure allows remote attackers to access restricted resources by bypassing control checks.
CVE-2024-21887: A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) enables an authenticated administrator to execute arbitrary commands on the appliance through specially crafted requests.
CVE-2024-21893: A server-side request forgery (SSRF) vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x), and Ivanti Neurons for ZTA allows attackers to access restricted resources without authentication.
CVE-2024-21888: This privilege escalation vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) permits users to elevate privileges to that of an administrator.

These vulnerabilities, when exploited together, create a high impact attack chain. For instance, CVE-2024-21893 has been observed being leveraged alongside CVE-2024-21887, resulting in remote code execution. The unauthenticated SSRF vulnerability within CVE-2024-21893 can be used to perform an arbitrary HTTP GET request, which can then be modified to exploit the command injection vulnerability within the '/api/v1/license/keys-status' endpoint, potentially leading to the establishment of a reverse shell with an attacker's machine.

Additionally, CVE-2023-46805, an authentication bypass vulnerability, can be exploited via a path traversal vulnerability found in the "/api/v1/totp/user-backup-code" endpoint. Due to the lack of authentication on this endpoint, adversaries can access public-facing endpoints. This vulnerability has also been observed being exploited in conjunction with CVE-2024-21887, facilitating remote code execution.

Customer Call to Action

Upgrade to Secure Versions: Ensure that all known instances of Ivanti Connect Secure and Ivanti Policy Secure are updated to Ivanti Connect Secure version 22.5R2.2 and Ivanti Policy Secure version 22.5R1.1, respectively, to mitigate these vulnerabilities.
Legacy Instance Investigation: Identify any legacy instances of Ivanti Connect Secure or Policy Secure and engage with the Lumifi SOC for additional investigation to prevent exploitation.

Lumifi's Response

Proactive Detection: Following the disclosure of the proof-of-concept by Rapid7 on January 31st, Lumifi engineered a detection mechanism to identify potential exploitation attempts.
Continuous Threat Research: The Lumifi SOC conducts ongoing threat research to ensure that any updates regarding new indicators of compromise (IoCs) are reflected within their threat hunts in customer environments.
In conclusion, the recent vulnerabilities affecting the Ivanti product suite highlight the critical need for proactive security measures and prompt updates. By remaining vigilant and implementing recommended actions, organizations can mitigate risks and protect their environments against potential exploits. If you have any concerns or require assistance, please reach out to Lumifi for support.

Current Malware Trends: 5 Most Common Types of Malware in 2024

Threat actors are converging on similar tactics across the board.

Cybercriminals are inventive and opportunistic, leveraging any advantage they can to gain access to sensitive data and assets.

However, they’re not as individualistic as often portrayed. Threat actors invest time and energy into maintaining relationships with other hackers, ransomware gangs, and criminal organizations. This can give them an edge when the threat landscape changes and new opportunities arise.

Now, several factors are contributing to major changes in the way cybercriminals operate. This article will cover some of those trends and explain how they influence the five most common malware attacks happening in 2024 so far.

Threat actor operations are converging along similar themes

Malware developers and cybercriminal operators are leveraging a combination of emerging technologies, under secured device formats, and structural deficiencies in the security industry. Here are some of the main themes influencing the types of malware cybercriminals are relying on the most in 2024:

AI gives cybercriminals new capabilities and lets them refine old ones

Threat actors already know how to use generative AI to write malicious code. This helps less proficient threat actors improve their technical capabilities and allows ransomware gangs to scale operations more effectively. It also breaks down language barriers, leading to much more sophisticated phishing and social engineering attacks.

Voice simulation software has already been used to run elaborate scams on corporate leadership. One CEO transferred a quarter of a million dollars to a hacker who simulated the voice of the parent company’s leader. Emerging video capabilities will only make the problem worse in the short term.

Mobile devices with both personal and corporate data are valuable targets

For cybercriminals, a mobile device used purely for personal use isn’t nearly as valuable as a business device. The problem is that organizations typically secure their devices with robust prevention-based policies that keep attackers out.

Organizations with loose Bring-Your-Own-Device (BYOD) policies make a much more compelling target. Security teams don’t always have the same level of visibility into mixed-use employee mobile devices, making them high-value targets.

The cybersecurity skills shortage gives cybercriminals the upper hand

The longstanding cybersecurity skills gap still complicates security efforts for small businesses, large enterprises, and everyone in between. Demand for information security talent continues to outpace supply, straining teams that must address bigger workloads.

This is a strong tailwind for malware developers and operators. Talent shortages increase mean time-to-detect (MTTD) and mean time-to-respond (MTTR) metrics. Even relatively poor-quality malware can reliably evade detection long enough to execute on a victim’s network.

Top 5 most common types of malware in 2024

1.) Ransomware

The ransomware surge of the Pandemic era is a clear example of cybercriminals consolidating their tactics. After two years of reduced activity, ransomware began trending upwards again in 2023.

Several things have changed since ransomware first started making headlines, though. Instead of targeting large enterprises with highly involved attacks, cybercriminals are leveraging Ransomware-as-a-Service (RaaS) kits to carry out large-scale, high-frequency attacks against small businesses.

LockBit remains the most common ransomware tool set in use today by far. An international law enforcement operation seized 34 LockBit servers in February 2024, but it proved to be a short-lived setback for the threat actors in question. Only five days later, LockBit3.0 appeared.

What you can do:

Ransomware is a serious threat, but also one of the simplest risks to mitigate. Deploying a robust system of secure backups makes your organization resistant to almost all ransomware attacks. Organizations with high-quality backups can effectively ignore ransom demands and continue business as usual with no disruption.

2.) Spyware

Spyware can provide cybercriminals with login credentials, screenshots of sensitive data, and chat history data. In many cases, a successful spyware infection is all an attacker needs to gain entry to the network and become an insider threat.

Pegasus is an example of a popular spyware variant that collects data from Android and iOS mobile devices. It is well-suited for giving cybercriminals initial access to protected networks with BYOD policies, allowing them to conduct lateral movement and find more valuable assets to compromise.

Pegasus can exfiltrate emails, SMS messages, app data, location services, audio recordings, and photos. This makes it a powerful tool for cybercriminals who aim to gain privileged insider access to network assets. The ability to exfiltrate one-time-passwords from multi-factor authentication systems makes it particularly dangerous.

What you can do:

Safeguarding network assets against insider threats demands combining multiple technologies and approaches. Zero Trust architecture limits the damage associated with compromised accounts, while User Entity and Behavioral Analytics (UEBA) enables insider risk teams to detect malicious insiders based on their observed activity.

3.) Remote Access Trojans (RATs)

Trojans trick users into running malicious executions by disguising themselves as legitimate applications. RATs are a particular type of trojan that is gaining in popularity among cybercriminals. By granting remote access, they enable hackers to directly control endpoint devices.

This allows the attacker to carry out multiple types of cyberattacks with great flexibility. Attackers may even sell insider access to other hackers, or lay dormant for long periods of time while waiting for the opportune moment to strike.

Gh0st is a RAT (Remote Access Trojan) used to gain control over infected endpoints. Unlike many other common types of malware, Gh0st is manually dropped into victims’ networks as a payload. That means Gh0st victims are necessarily already compromised by at least one other type of malware.

What you can do:

Web application firewalls are the first line of defense against remote access trojans. Organizations must also implement Zero Trust security architecture and invest in comprehensive insider risk programs. Behavioral analytics enriched with detailed historical log data is vital for distinguishing between malicious remote access and false positives.

4.) Cryptojacking miners

Cryptojacking fell out of favor after the price of Bitcoin crashed in 2022. As of March 2024, the cryptocurrency has surged to new all-time highs — and made cryptojacking more profitable than ever.

Most cryptojacking malware does not mine Bitcoin, but lesser-known alternatives that are computationally easier to distribute. CoinMiner is an entire family of cryptojacking solutions that mine Monero and Zcash. They typically spread across networks by abusing Windows Management Instrumentation and establish persistence using WMI Standard Event Consumer scripting.

Cryptojacking is not often considered a high-priority threat because it steals processing power and bandwidth instead of data or money. However, cryptojacking forces organizations to increase IT expenditure and leads to unpredictable IT performance. This can lead to downtime, additional security vulnerabilities, and other negative outcomes.

What you can do:

Network detection and response (NDR) solutions can provide key insight into cryptojacking attacks. Analysis might show that certain devices are exhibiting poor performance and making unusual connections outside the network. Analysts can then investigate and check users’ web activity to find out if employees visited suspicious web pages.

5.) Multi-use malware

Not all malware is designed for a single use case scenario. Sophisticated variants like SocGholish can perform multiple actions in response to threat actor commands.

For example, threat actors can use SocGholish to redirect traffic, and deliver malware payloads masquerading as software updates, subsequently obtaining information from the victim’s system. They can force the system to download additional exploit kits and even ransomware.

These capabilities add to software bloat, making tools like SocGholish easier to detect than other types of malware. However, they can also make malware neutralization more difficult. This type of malware may structure its actions in multiple stages and use a variety of obfuscation and evasion methods.

What you can do:

Multi-use malware is easy to detect because it interacts with many different parts of your IT infrastructure. Connecting the dots between these interactions is key. Make sure your Security Information and Event Management (SIEM) platform provides complete visibility into your IT infrastructure so you can quickly piece together the chain of events that indicates a multi-use malware attack.

Stay ahead of the latest threats with Lumifi

Lumifi’s 24/7 managed detection and response solution provides comprehensive protection to organizations facing new and emerging threats. Gain visibility into your network and leverage our proprietary SOC automation service to safeguard your most valuable assets from cybercriminals.

What Does It Cost to Build a Security Operations Center (SOC)?

Your organization needs dedicated space and infrastructure for conducting security operations.

Introduction to Security Operations Centers (SOCs)

Your SOC is where most of your organization’s security processes take place. Those processes require specialized equipment and expertise. Consolidating that footprint into a single place makes economic sense and drives security performance.

That doesn’t mean every organization has to fill a windowless room with floor-to-ceiling flatscreen monitors and hire dozens of analysts. A small business SOC might be able to run with no more than two or three humans, though burnout becomes real as does single points of failure..

Achieving 24/7 alarm monitoring and coverage does require a significant investment in equipment, personnel, training, and maintenance. An effective SOC is more than the physical location where the security team works — it’s also the software and tech stack that team uses to detect and respond to security threats.

Taken altogether, they allow the security team to proactively address security threats and mitigate risks in real-time. Some of the activities that take place there include:

Continuous monitoring and threat detection
Incident response and containment
Threat intelligence analysis
Vulnerability scanning and management
Forensic analysis and incident reporting
Proactive security improvements and compliance

To achieve these goals, the organization must equip its SOC appropriately. Read on to find out how your organization can achieve that and what it might cost, depending on your security needs.

Components of a SOC

The Security Operations Center has three main components — people, process, and technology. The unit can only function when each of these three components works effectively in tandem.

Security leaders spend a great deal of time optimizing each of these three components and making sure they work together flawlessly. The SOC cannot function without all three components working together.

Component 1: People

The first and most important SOC component is its people. It’s also the one that is disrupted most frequently. There are currently 4 million unfilled roles in the cybersecurity industry, which means almost all SOCs work in a resource-strained environment.

The typical SOC has four roles:

SOC Managers lead security operations and take responsibility for key operational security decisions.
Analysts perform the day-to-day task of detecting security threats and responding to them when they occur. Most SOCs have multiple levels of analysts, with varying responsibilities.
SOC Engineers focus on installing new security tools, configuring those tools, and developing new SOC capabilities.
SOC Operators are complementary to engineers. They focus exclusively on maintaining tools installed by the engineering team, without worrying about building new capabilities or enhancing tools.

Component 2: Process

Processes are formalized policies that inform security operations. Without comprehensive written policies, SOC team members would be unable to communicate or collaborate effectively.

Successful SOCs have exhaustive sets of policies for addressing a wide range of security threats, technological issues, and more. Many establish policies according to an industry-wide cybersecurity framework like NIST or SANS. Most change and test policies frequently.

A few examples of formal processes you may include in your SOC include:

Incident triage determines the level of priority assigned to detected security incidents.
Incident reporting offers instructions on how security incidents are described and communicated to team members and stakeholders.
Incident analysis covers the process of identifying threats and investigating them appropriately.
Incident closure is a formal process for reporting that an incident no longer represents business risk.
Post-incident activities focus on gleaning insight from security incidents and finding ways to continuously improve performance.
Threat hunting is a proactive process for identifying potential network threats before they have a chance to cause damage.

Component 3: Technology

Your security tech stack determines the capabilities that your team has when detecting and responding to threats. Thousands of different security technologies exist, and every security leader equips the SOC according to its unique needs.

Many security architects build their organization’s capabilities around the SOC Visibility Triad:

Security Information and Event Management (SIEM) collects and security event logs from across the organization and provides in-depth visibility into security threats as they occur.
Endpoint Detection and Response (EDR) continuously monitors endpoint devices like mobile phones, desktop computers, and virtual machines, protecting them from malware and cyberattacks.
Network Detection and Response (NDR) provides complete visibility into network traffic across the organization’s IT infrastructure, giving threat actors nowhere to hide.

Factors that influence the cost of building a SOC

Building an effective SOC means accurately identifying the size, scope, and scale of your organization’s security needs. A small business requires a completely different approach than a multinational enterprise or a government organization.

The SOC model you choose will deeply impact the cost of building and maintaining it. Most security architects follow one of the six core SOC models:

Virtual SOC. This virtualized environment is staffed by part-time team members and offers limited protection.
Dedicated SOC. This in-house facility is staffed by professional analysts and enables proactive security operations.

Distributed SOC. This model involves both in-house security personnel and part-time team members. When combined with a managed service provider, it is also called the co-managed SOC model.
Command SOC. This type of facility focuses on coordinating with other SOCs, usually providing specialist expertise on an as-needed basis.
Network Operations Center (NOC). Some organizations combine security and network infrastructure operations into a single facility.
Fusion SOC. Facilities with extensive security technologies and deployments may combine operational security and threat intelligence functions into a Fusion SOC.

Cost breakdown: Personnel and equipment

Here are the costs you can expect to pay to build an SOC in 2024. These figures assume 24/7 security monitoring and alert coverage for a network supporting 5000 users, with a one-time implementation cost.

Personnel

Basic SOC staff includes eight analysts, the minimum for 24/7 coverage. According to the latest US Bureau of Labor Statistics payroll data, that means paying $1.2 million per year, including taxes and benefits.
Intermediate SOC staff may include twelve analysts, ensuring multiple levels of analysts and part-time product and IT support. This will cost at least $2 million per year, probably much more.
Advanced SOC staff includes specialist expertise for conducting proactive threat hunting and penetration testing, and additional engineering and operational staff. You should not expect to pay anything less than $5 million per year for this level of performance.

Equipment

Basic SOC equipment will cost at least $300,000 to implement. This figure assumes hardware workstations equipped with detection solutions and limited investigation capabilities.
Intermediate SOC equipment will cost closer to $500,000 to implement. This includes implementing a SIEM equipped with UEBA capabilities and building out the necessary product support capabilities.
Advanced SOC equipment includes advanced automation, AI-powered workflows, and in-depth customization. Licensing, implementation, and infrastructure will probably cost more than $1 million.

Considerations for budgeting and planning

Personnel and equipment are not the only costs associated with building an SOC. You will also have to invest in training, maintenance, and additional support for security operations. This is especially true if your organization is large, complex, or operating in a regulated industry.

Also, you should consider the impact of skills scarcity on your in-house security staff over time. Cybersecurity professionals know that their skills are in high demand, and will ask for better compensation at every opportunity. If you delay raises too long, you may find yourself understaffed when competing organizations offer them a better deal.

Outsourcing vs. in-house SOC — pros and cons

Choosing to build an in-house SOC comes with challenges, but many security leaders feel it is the best way to ensure top security performance. Here are some of the pros and cons associated with building and staffing your own dedicated SOC:

Outsourced SOC

Pros:

Much lower staffing costs
Specialist expertise included in the service
Implementation included in the service
Able to attract and retain more experienced talent
24/7 coverage available with predictable low monthly cost
Scalability is built into the service

Cons

Limited direct control over analysts
May not know your organization’s security needs well.
Not all vendors and technologies may be supported
Individual analysts are not dedicated to your company alone
You may not be able to make direct changes to security policies at any moment

In-house SOC

Pros:

Direct control over analysts’ activities
Deep knowledge of internal security program
You choose which technologies you want to implement
Your security team does not divide its team between multiple clients
You retain control over your security program, policies, and technologies

Cons:

High operating costs
Hard to find specialist expertise
Successful implementation requires specialist expertise
Your team has less experience handling a wide range of security issues
24/7 coverage requires managing full-time employees, with constantly increasing costs
Scalability means hiring new full-time employees and buying new licenses

Cost-effective solutions for building and maintaining your SOC

The cost and complexity of building a fully in-house dedicated SOC makes it infeasible for all but the largest organizations. Given that an industry-wide cybersecurity talent shortage exists, small businesses and enterprises will have to outsource some of their security capabilities to managed service providers.

For many security leaders, the key question is deciding how to split their security program between internal and external solutions. Working with reputable security vendors on value-generating initiatives can make the difference between building a successful SOC or wasting huge amounts of time and resources on implementation projects that don’t succeed.

Your organization may benefit from freeing its internal security team to focus on high-impact strategic initiatives like crafting new policies and improving processes. Bringing in a reputable managed detection and response vendor like Lumifi to mitigate attack risks allows you to make the most of your SOC while leveraging world-class expertise and technology in a sustainable, scalable way.

Lumifi Offers Free Cybersecurity Assessments in Wake of Multibillion-Dollar Cyberattack

The SANS Incident Response Framework

Incident response plans give security teams a standardized set of procedures for mitigating the risks associated with security incidents. They make cyberattacks less disruptive, reduce operational downtime, and contain data breaches.

Since every organization is unique, it needs to create a set of incident response playbooks designed to fit its security risk profile. It also has to ensure employees, users, and key stakeholders can communicate effectively about security incidents as they happen.

The SANS Incident Response Framework provides a standardized set of operational security best practices when handling security incidents. Organizations that adopt the SANS framework are equipped to quickly mitigate cyberattack risks and protect sensitive assets effectively.

What is the SANS Incident Response Framework?

The SANS Institute is the world’s largest and most reputable cybersecurity research and training organization. Its name stands for “SysAdmin, Audit, Network, and Security”, and its incident response framework is one of the most trusted options in the industry.

In 2012, the SANS Institute published the Incident Handler’s Handbook, which defines its approach to addressing security incidents in real-time. The SANS approach enables analysts to methodically assess cyberattack damage, take action to contain threats, and help the organization recover.

Here is a brief summary of the six-step approach outlined in the SANS Incident Response Framework:

Preparation. Establish organization-wide security policies, perform risk assessments, and define security risks. Build a Computer Security Incident Response Team (CSIRT) with well-defined roles.
Identification. Monitor systems for unusual behavior and indicators of compromise. Investigate security events and escalate the ones that suggest a potential security breach. Collect evidence, categorize threats, and document everything.
Containment. Take decisive, short-term action to isolate potential threats and protect the network from attack. Then perform long-term containment tasks and rebuild impacted systems.
Eradication. Remove malware from affected systems, perform root-cause analysis, and implement solutions to prevent similar attacks in the future.
Recovery. Bring impacted production systems online, taking care to mitigate the risk of additional attacks. Test and verify newly recovered systems to ensure they are working properly.
Lessons Learned. Create a retrospective report detailing the security incident no more than two weeks after it took place. Document the incident entirely and identify opportunities to improve operational security.

SANS Incident Response Framework vs. NIST Cybersecurity Framework

The SANS Incident Response Framework is often compared with the other leading framework for addressing security incident risks — the NIST Cybersecurity Framework.

The two share a lot in common, but they have key differences that set them apart. In general, the SANS Incident Response Framework is more technically oriented, with a strict focus on detecting and responding to suspicious behavior on protected networks.

The NIST Cybersecurity Framework provides an in-depth explanation of the communication structures organizations should have in place when handling security incidents. The SANS framework provides a broader overview of this aspect of incident response, but provides deeper guidance on how security team members should contain and eradicate threats.

This doesn’t mean that one framework is “better” than the other. It simply reflects the scope for which each framework was designed. Security leaders must choose the framework that best suits the specific needs of their organization and its security capabilities.

Who should Implement the SANS Incident Response Framework?

Since the SANS framework offers more concise operational guidance for addressing security incidents, it is well-suited to organizations with well-developed security capabilities.

It’s particularly well suited to smaller, more agile organizations with dedicated security teams. That’s because the NIST Framework includes a more generic approach to securing data against a wider range of incidents, such as natural disasters and physical security breaches.

Where the NIST Framework provides wide-ranging guidance suitable for large, complex organizations, the SANS Incident Response framework focuses on improving the capabilities of individual security practitioners and their teams.

Adopt the right incident response framework for your organization

The SANS Incident Response Framework can provide a consistent and structured approach for handling security incidents. It gives security teams a common terminology, a clear set of best practices, and useful metrics for improving security performance over time.

However, it can also lead to challenges. You may need to customize your security tech stack to meet SANS guidelines, and you’ll have to update your policies regularly to maintain the framework as your organization grows.

Maintaining a comprehensive security framework can significantly improve your organization’s risk management capabilities, but only with the right approach. Merely checking all the boxes won’t provide the security results you need — only a comprehensive, expert-led approach can do that.

5 Most Overlooked Elements of Incident Response Plans

Learn how to establish robust, standardized security controls for handling any kind of incident.

Data breaches and security incidents are tense, high-pressure situations where every second counts. In that scenario, having a clear and detailed incident response plan ready can mean the difference between success and failure.

In an environment where one hour of downtime can cost more than $100,000 — and sometimes much more than that — fast, confident decision-making can make or break the entire process. Having a strong incident response plan helps ensure your team is ready to mitigate risks, neutralize threats, and restore normal operations quickly.

But planning ahead for every possible contingency isn’t feasible. Cybercriminals can be incredibly creative, and even the best security practitioners can be caught by surprise.

Having a comprehensive and well-documented incident response plan helps keep security teams prepared for unexpected scenarios and additional complications. With some foresight and planning, your incident response plan can accommodate these factors and significantly reduce overall risk exposure.

Take these steps to improve your incident response plan

Well-detailed incident response plans are crucial to operational security excellence. They provide guidance and documentation that allows security teams to communicate better and avoid inefficiencies during critical, time-sensitive security scenarios.

Here are some of the things you can do to improve your incident response capabilities:

Define and categorize different security incidents
Make sure everyone has a well-identified role
Don’t forget about external stakeholders
Test your incident response playbooks frequently
Gather data and conduct after-action reports

1. Define and categorize different security incidents

The first thing that distinguishes a documented incident response plan from an ad-hoc series of suggestions is the incident itself. There are many different kinds of cybersecurity incidents, and they don’t all have the same risk profile.

MITRE ATT&CK has 14 different threat categories, with more than 140 individual subcategories in total. Any single cyberattack could use multiple categories and subcategories simultaneously.

That doesn’t mean you need to create an extensively documented playbook for every single MITRE ATT&CK subcategory, but you should have an extensive, well-documented process for distinguishing between different attack types and their severity.

To accurately gauge the severity of an attack type, you need to know your organization’s security risk profile. Conducting vulnerability assessments and identifying security gaps can help you pinpoint which types of incidents need the highest priority.

2. Make sure everyone has a well-identified role

Security incidents don’t happen in isolation. They can impact many different parts of the organization — often at the same time. A successful response requires coordinated action from security practitioners, IT team members, and non-technical employees alike.

It might take a serious internal communications campaign to convince users and employees that security incidents aren’t just a problem for the security team. In a modern enterprise environment, every position is a cybersecurity position, and everyone has a role to play responding to data breaches and other events.

Here are some examples of the typical roles non-security team members can play in a cyberattack scenario:

Human resources can assist with investigations into insider threats and provide context into employee data that might be compromised.
The legal team can assist with regulatory frameworks that guide business operations, like PCI-DSS or GDPR. They may need to arrange communication with regulatory and law enforcement agencies, as well.
Media/communications team members can help the organization communicate with external stakeholders and the media, guiding the conversation between each interested party.
Information security leadership has to provide strategic direction towards operational recovery. Leaders also play an important role keeping different business units focused on prioritizing high-impact objectives.
Executives and board members can only engage in effective risk management when they understand ongoing response efforts. They can also improve outcomes by approving budget expansions or hiring external vendors to assist.

3. Don’t forget about external stakeholders

Many organizations make the mistake of leaving key stakeholders out of the loop while responding to security incidents. Often, they have to do this because gathering accurate data on the incident takes time.

However, external stakeholders don’t always understand or accept the fact that they have to wait. Your cybersecurity incident may attract the attention of law enforcement, regulatory agencies, third-party service providers, and even the media. If you can’t tell them what’s happening, they’re likely to make their own assumptions.

Your incident response plan should include a designated spokesperson for each impacted department or business unit. These individuals would be responsible for communicating incident response progress to external stakeholders.

For example, you may appoint an IT administrator to handle communications with external vendors because they probably already have a direct relationship with your vendors. The same person would probably not be the best choice for keeping regulators or the media up-to-date.

4. Test your incident response playbooks frequently

It’s surprisingly common for organizations to invest in creating incident response plans and then neglect to test them. According to a 2022 Wall Street Journal research survey, nearly three-fourths of respondents reported having an incident response management strategy in place, but only one in four tested their plan at least twice a year.

Even if your incident response plan is operationally perfect right now, your organization is constantly changing. New hires, new systems, and new business units can lead to significant changes in your incident response capabilities.

Managing those changes effectively requires testing your plan against a wide variety of attack types and scenarios. There are many ways to do this, from simple tabletop exercises to penetration testing and full simulated attack drills.

Your incident response playbook is more than a checkbox to be filled on a compliance report. It is a core element of your cybersecurity posture with a deep impact on your overall risk management profile.

5. Gather data and conduct after-action reports

Your incident response team must carefully detail every action they took from the moment they first noticed an unusual security event. If the team jumps right into containment and control actions, you’ll end up having to piece together their actions manually later on. This can be time-consuming and expensive.

If your incident response plan includes policies for documenting security incidents and retaining log data effectively, you can easily create in-depth reports on how your team handled the incident. This will tell you who responded, what actions they took, and how that impacted the ultimate outcome.

Regulators, insurers, and law enforcement may want these data for themselves. However, they also provide significant value to your team. Use these insights to identify what went wrong, what went right, and what opportunities to improve operational security you have in front of you.

It’s no coincidence that both the NIST and SANS incident response frameworks stipulate a final post-incident report phase. Don’t neglect this opportunity to improve your security posture against the next incident.

The NIST Cybersecurity Framework

Every organization wants to improve its information security capabilities. Part of a security leader’s job is identifying the best way to do that.

However, no two organizations are exactly alike. Various stakeholders may have different ideas about what high-impact security excellence looks like in practice. Achieving meaningful security goals means getting everyone on the same page first.

The National Institute of Standards and Technology (NIST) publishes a voluntary cybersecurity framework so that security leaders and organizations can better understand, manage, and reduce cybersecurity risk. The NIST Cybersecurity Framework provides a uniform starting point for organizations to develop their information security capabilities.

What is the NIST Cybersecurity Framework?

The NIST Cybersecurity Framework provides a comprehensive outline of best practices for organizations investing time and resources into cybersecurity initiatives. It is designed to be applicable in many different contexts — small businesses, mid-sized enterprises, and multinational organizations can all follow this framework.

It is a voluntary framework, which means there is no legal or regulatory punishment for failure to comply. However, there is significant overlap between NIST’s voluntary standards and the legally mandated regulatory standards used in many industries. Organizations that adhere to ISO 27001, CIS, or PCI-DSS compliance can (and often do) also pursue NIST CSF.

Since it is a voluntary framework, security leaders aren’t under pressure to adopt the entire framework all at once. Some security leaders choose to implement individual parts of the framework, or to deploy the recommended controls only in certain business processes.

The framework itself describes five functions that are critical to security programs. Each function contains 23 unique categories, which are further broken down into more specific subcategories.

The five NIST Cybersecurity Framework categories are:

1. Identify

The Identify category is all about visibility. In order to protect business assets, security teams need to understand where those assets are located, how they interact with one another, and what policies govern their use.

In this context, “asset” means anything from endpoint devices like laptops and servers to user accounts created for employees and vendors. It can also include cloud computing workloads and applications, as well. Anything that has value to the organization can be an asset.

Here are some of the subcategories included under the Identify category:

Asset management. Create and maintain an inventory of all devices, software, and other assets that need to be secured.
Business environment. Understand the organization’s overall scope and mission, and determine how that impacts its security risk profile.
Establish policies that support cybersecurity risk management and provide standard operating procedures to security teams.
Risk assessment. Conduct assessments that provide insight into the way IT assets may respond to known risks.
Risk management strategy. Deploy a strategy to address security risks based on the organization’s capabilities and tolerance levels.
Supply chain risk management. Assess and manage security risks associated with third-party partners and vendors.

2. Protect

The Protect category prevents attackers from exploiting vulnerabilities and contains the damage that may result from a successful breach. This category covers a wide range of technologies and policies, from technical implementations to employee training initiatives.

These framework elements work together to safeguard critical assets from the risks identified previously. NIST recommends establishing multi-layered security policies that ensure assets enjoy decent protection even if attackers bypass one or more security controls.

Here are some of the subcategories included in the Protect category:

Identity management and access control. Deploy authorization policies that verify users and applications when they move between networks or attempt to access sensitive data.
Awareness and training. Develop an organization-wide security training policy that ensures every user does their part to maintain the system’s integrity.
Data security. Protect information at rest and in transit with policies and procedures enforced by properly configured security tools.
Information protection processes and procedures. Define the roles and responsibilities associated with information security processes and create formal policies for disposing of electronic files, old devices, and other systems.
Conduct routine preventative maintenance on systems, equipment, and applications to ensure they remain secure.
Protective technology. Deploy purpose-built security tools like firewalls and configure them appropriately. Make sure security tools logs are properly obtained and stored.

3. Detect

The Detect category provides guidance on how to monitor different aspects of the organization’s security posture. This helps security teams detect threats early, making it much easier for them to contain threats before they cause serious damage.

The NIST Cybersecurity Framework provides some high-level guidance on identifying activities that deviate from expected norms. It also describes methods for continuously monitoring for threats and ensuring the integrity of threat detection workflows.

Some of the subcategories included in the Detect category include:

Anomalies and events. Deploy systems capable of detecting unusual activity on network assets. Find ways to prioritize security events and log data so that the organization can address high-severity threats first.
Security continuous monitoring. Maintain 24/7 alarm monitoring and response capabilities that ensure threats and vulnerabilities can be addressed the moment they arise.
Detection processes. Develop processes that ensure security teams discover relevant events fast enough to act on them quickly. Deploy detection processes that support response and recovery workflows.

4. Respond

The Respond category focuses on minimizing the impact of a threat once it is detected. That requires building a comprehensive action plan that includes notifying stakeholders of security breaches, taking decisive actions against threat actors, and conducting investigations to assess the extent of the damage.

This category also provides guidance into threat mitigation and remediation. When taken altogether, these actions can make the difference between a minor security incident and a catastrophic data breach.

Some of the subcategories included in the Respond category include:

Response planning. Develop comprehensive incident response plans that detail the organization’s strategy for handling security incidents.
Ensure timely, effective policies for communicating with security teams, internal users, and external stakeholders during a security incident. Establish a plan for notifying customers, employees, and regulators of data breaches.
Conduct investigations into security incidents to understand what kinds of mitigation strategies are likely to provide the best outcomes.
Take immediate action to neutralize security threats and contain the damage they have already done.
Review cybersecurity incidents after they occur and find ways to improve security performance and reduce overall risk.

5. Recover

The Recovery category emphasizes the importance of returning to normal business activity as soon as possible after a security incident occurs. It includes policies for restoring systems, implementing lessons learned, and preventing future threats.

When properly implemented, these policies help reduce the costs associated with downtime. It provides core guidance on restoring damaged equipment and communicating with customers, employees, and stakeholders throughout the recovery process.

Some of the subcategories included in the Recovery category include:

Recovery planning. Establish a series of recovery plans that optimize the organization’s return to normal operations after a security incident occurs.
Learn from security incidents and establish new policies designed to reduce the risk of future incidents.
Create a plan for ensuring transparency and trust between internal teams and external stakeholders during the recovery process

What does NIST compliance achieve?

Organizations use the NIST Cybersecurity Framework to increase their security awareness and improve their level of preparedness against unexpected threats. Because every organization pursues the NIST standard in a different way, it can be used for a variety of goals.

Some of the ways organizations enhance security using the NIST CSF include:

Creating risk profiles that communicate the organization’s current level of cybersecurity preparedness in a standard format that external stakeholders can easily engage with.
Identifying new standards, policies, and other opportunities that can improve the performance of existing security controls.
Developing new cybersecurity initiatives and meeting new requirements, including requirements stipulated by third-party vendors or partners.
Communicating security requirements throughout the organization in a consistent, uniform way.

Note: Since NIST is a voluntary framework, organizations do not generally achieve “NIST CSF compliance”. Technically, security teams “leverage” NIST framework categories towards optimizing their security processes. All NIST CSF controls are internally developed and self-assessed.

What about NIST SP 800-53?

Many security practitioners use “NIST” as an interchangeable catch-all term for compliance initiatives based on NIST standards. However, NIST is a large organization with more than a thousand published reference materials. More than one of these have applications in the information security space.

NIST Special Publication 800-53 is the most common example. This is a set of security standards developed by the same institution, but specifically for use by federal government information systems. This helps government agencies and their vendors comply with the Federal Information Security Management Act (FISMA).

Key differences between the NIST Cybersecurity Framework and NIST SP 800-53

Different use case scenarios. The NIST Cybersecurity Framework is a voluntary set of standards and policies that help organizations manage security risks more effectively. NIST SP 800-53 is a set of security controls specifically designed for federal government information systems.
Broad vs. specific scope. The NIST Cybersecurity Framework provides a high-level overview of risk management best practices. It is designed to be used in a wide variety of contexts. NIST SP 800-53 is a detailed set of security controls designed for a particular context — working with US government federal agencies.
Different technical formats. One is a framework, while the other is a set of standards. Standards have much more precise applications than frameworks and provide strict technical metrics for demonstrating compliance.
Organization size and structure. The NIST Cybersecurity Framework is designed for all types of organizations, from small businesses to global enterprises. NIST SP 800-53 is meant specifically for government agencies and the commercial organizations they do business with.
Only one is voluntary. Any organization can choose to follow the NIST Cybersecurity Framework. Federal agencies are required to adhere to NIST SP 800-53 by law.

Why comply with the NIST Cybersecurity Framework?

Every organization has its own reasons for pursuing the NIST Cybersecurity Framework.

In some cases, security leaders and executive decision-makers simply agree that establishing a consistent, industry-standard approach to addressing cybersecurity risk is worth the effort.
In other cases, third-party partners stipulate the adoption of NIST CSF controls as a condition for exposing their assets to a potential vendor’s network.
Sometimes pursuing NIST CSF standards is a stepping stone towards achieving more complex compliance goals, since many regulated frameworks overlap significantly with NIST CSF.

Since the NIST Cybersecurity Framework has a wide-ranging scope, it is a relatively accessible objective for organizations making their first foray into information security compliance. It is not a replacement for in-depth customization or industry-specific regulation — but pursuing NIST CSF can improve compliance outcomes down the line.

Exabeam Americas Technical Person of the Year | Grant Leonard | Lumifi

The Future of AI in Cybersecurity: How to Plan Ahead for AI Disruption

Find out how AI is likely to impact the cybersecurity industry in the next decade.

Artificial intelligence has been an integral part of the cybersecurity industry for several years now. However, the widespread public adoption of Large Language Models (LLMs) that took place in 2023 has brought new and unexpected changes to the security landscape.

LLMs like OpenAI’s ChatGPT, Google’s Bard, and others have opened new capabilities — and new threats — across the global economy. Security leaders in every sector and industry will need to change their approach to accommodate this development.

It’s almost certain that new AI-powered tools will increase the volume and impact of cyberattacks over the next few years. However, they will also enhance the capabilities of cybersecurity leaders and product experts. Lumifi’s Research and Development uses the latest AI tools to refine our MDR capabilities every day.

These developments will likely occur at an uneven pace, typical of a global arms race. Cybercriminals may gain a temporary advantage at some point, only to be subdued by new cybersecurity deployments, and then the cycle will repeat.

This volatile environment should inspire cybersecurity professionals to increase their AI proficiency. Individuals with broad experience, product expertise, and a successful track record will be highly sought after in the industry.

What exactly do LLMs do? Cybersecurity use cases explained

LLMs enable anyone to process large amounts of information, democratizing the ability to leverage AI. This offers significant advantages to people and organizations who want to improve the efficiency, intelligence, and scalability of data-centric workflows.

For cybersecurity practitioners, that means more efficient vulnerability management, faster incident detection and response, and improved security alert handling.
For cybercriminals, LLMs enhance exploit automation and vulnerability scanning capabilities while removing language barriers characteristic of many phishing attacks.
AI systems themselves are susceptible to misuse and abuse. Unintentional data leakage risks will increase as AI becomes more commonplace.

When the cybersecurity industry was dominated by hardware products, security leaders only changed products when the next version of their preferred hardware was available. Now, AI-powered software can update itself according to each individual use case, requiring security teams to continuously evaluate LLM systems for safety and compliance.

Let’s look more closely at each use case and how it’s likely to evolve as AI technology advances.

How new AI technologies will enhance cybersecurity workflows

There are two major advantages to leveraging LLM capabilities in cybersecurity.

Better detection workflows with more accurate data enrichment. High-quality labeled data are vital to AI-powered detection workflows, but good data is hard to come by. LLMs are good at gathering and synthesizing initial data from large datasets, allowing security teams to configure new detection rules without limiting their scope to strict field data.
Better security alert and incident response automation. Talent scarcity is still a major problem in the cybersecurity industry, and LLM-powered automation can optimize workflows for individual analysts to increase their capabilities.

These two benefits will certainly improve over time and lead to new AI capabilities for security teams. SOC analysts may soon be able to read thousands of incident response playbooks at once and identify security gaps and inconsistencies in near real-time.

This will require the creation of a domain-specific cybersecurity LLM capable of contextualizing incident response playbooks at the organizational level. AI-powered SIEM platforms like Exabeam already provide in-depth behavioral analytics for users and assets, and in time we’ll see similar capabilities expanding into threat response and recovery workflows as well.

Threat actors will leverage AI to break down operational barriers

LLMs are invaluable for threat actors, especially when it comes to gaining initial access to their victims’ assets. By practically eliminating language, cultural, and technical communication barriers between people communicating, they’ve made it much harder for people to reliably flag suspicious content.

Cybercriminals are already using AI to enhance and automate operations in four key areas:

Automated phishing. Cybercriminals can now send out automated emails, texts, and other communications that mimic the style of legitimate organizations. These messages are easy to personalize at scale without telltale spelling and grammar mistakes.
Social engineering. LLMs enable social engineering by providing accurate scripts for initial access brokers to follow. With no more than a few quick prompts, a cybercriminal can create a believable character with a realistic backstory designed to fool even the most diligent targets.
Impersonation attacks. Impersonation attacks are becoming more commonplace, and not just using LLMs. AI voice-cloning technology is already capable of producing convincing deepfakes, and full video capabilities are right around the corner.
Fake customer support chatbots. These already exist, but they haven’t yet become a widely popular threat vector. As legitimate organizations increasingly adopt AI chatbots into their support workflows, the risks of chatbot spoofing will increase.

According to one report, phishing attacks have surged more than 1200% since ChatGPT was first released in November 2022. Credential phishing attacks have risen by an astonishing 967% in the same time frame.

Adjusting to a security landscape dominated by AI means understanding its limitations

It’s no secret that influential tech leaders and investors are pouring significant resources into AI. Some thought leaders warn that the emerging technology will change every aspect of our lives — going so far as to say we’re charging headfirst into an AI apocalypse fueled by the development of Artificial General Intelligence (AGI).

While the technology is new, exaggerating the danger of disruptive technology is a familiar cycle. Plato was famously skeptical of writing, and 16th century Europeans destroyed printing presses out of fear. It’s normal to be anxious about new technology.

Like writing, printing, and every other technology before it, artificial intelligence has limitations. Security leaders who understand those limitations will be able to navigate the challenges of a society increasingly reliant on AI-powered technologies.

Some limitations include lack of contextual awareness, high operating costs, perpetuated consensus and amplified bias, and lack of moral agency. Let’s explore these further.AI cannot grasp context independently
Current AI models struggle to comprehend the broad context of situations users present to them. Some perform better than others, but none currently demonstrate the contextual awareness necessary to navigate real-life problems without guidance.

Many tech leaders think this is an engineering problem and believe that eventually LLMs will contextualize information with human-like accuracy.

This may not be true. We still don’t know how the human brain contextualizes information and articulates it into language. Contextualizing insight by combining data with real-world experience remains a task best-suited to human experts.

1. AI-powered workflows are resource-intensive

According to the International Energy Agency, training a single AI model uses more electricity than 100 US homes consume in a year. A typical ChatGPT query consumes 2.9 watt-hours of electricity — about the same amount of energy stored in a typical AA battery.

By comparison, the human brain consumes about 300 watt-hours of energy per day. Yet it accomplishes significantly more during this time than even the most efficient LLMs.

This suggests that there’s more to improving neural network performance than simply adding more nodes and introducing more parameters. It also places an upper limit on the feasibility of increasingly energy-intensive AI processes. At some point, the costs will outweigh the benefits.

2. I models have difficulty contradicting consensus

AI training models operate on consensus. If a significant majority of parameters suggest that a certain LLM response is likely to be correct, the LLM will confidently declare the corresponding answer. If the training set data is not accurate, the answer won’t be either.

When it comes to pure facts, overcoming this limitation may be technically feasible. But when it comes to opinions, values, and judgements, AI-powered tools are not equipped to offer anything but the most basic responses.

This means that even highly advanced future AI tools may not be able to make convincing arguments against popular consensus. It’s easy to see how this can lead to severe security consequences, especially in cases where popular wisdom turns out to be wrong.

3. You can’t credit (or blame) AI models for the decisions they make

AI ethics remains a challenging issue for technology experts, cognitive scientists, and philosophers alike. This problem is deeply connected to our lack of understanding of human consciousness and agency.

Currently, there is no real consensus about the moral status of artificially intelligent algorithms. This makes it impossible to attribute moral decisions to AI-powered tools or claim they know the difference between “right” and “wrong”.

We can’t treat AI algorithms as moral agents without also attributing some form of “personhood” to them. Most people strongly doubt that LLMs like ChatGPT are “people” in that sense, which means someone else must take responsibility for the decisions that AI algorithms make — including their mistakes.

Where will AI take the cybersecurity industry?

Security leaders are beginning to distinguish between generative AI and predictive AI. While people are understandably excited about generative AI, the true information security workhorse is predictive AI, which is a must-have technology in today’s security operations center environment.

As the stakes of AI-powered cybercrime get higher, leaders will become increasingly risk averse. Few executives or stakeholders will be willing to risk their livelihoods on unproven security solutions and vendors.

In this scenario, security leaders who entrust their detection and response workflows to reputable product experts with proven track records will be rewarded. If your detection and response provider doesn’t leverage proven AI expertise in its blue team operations, it will eventually fall behind.

Positive security incident outcomes may become difficult to achieve, but guaranteeing them will be crucial. Learn more about how Lumifi achieves this critical goal by combining AI-enriched data with human expertise and best-in-class automation. Secure your spot for our webinar, Unveiling ShieldVision's Future & New Series of Enhancements, taking place on February 14th to learn more.

Lumifi is a managed detection and response vendor with years of experience driving consistent results with the world’s most sophisticated AI technologies. Find out how we combine AI-enhanced automation with human expertise through our ShieldVision™ SOC automation service.

Lumifi Seeking to Acquire MDR Cybersecurity Firms to Accelerate Growth: Lumifi Is on Fast Track to Expand Cybersecurity Footprint Worldwide

Scottsdale, AZ (October 24, 2023) Lumifi, a cybersecurity industry leader, is embarking on a strategic expansion plan by targeting cybersecurity firms. This strategic direction gains its foundation from Lumifi's recent landmark acquisition, Castra, valued at $14 million, which further fortifies the SOC Visibility Triad, a concept initially introduced in a Gartner® research report titled "Apply Network-Centric Approaches for Threat Detection and Response"¹ We believe that Lumifi has followed this path diligently followed for 15 years.

By integrating top-tier cybersecurity analysts with cutting-edge systems, Lumifi steadfastly maintains its gold standard in safeguarding its esteemed clientele. This development comes in the wake of Lumifi's $30 million acquisition of Datashield from ADT in April 2022. The company is now primed to secure 2-4 more acquisitions within the next 6 to 18 months, bolstering its position in the cybersecurity landscape.

According to Gartner® “The renewed focus on the human element continues to grow among this year’s top cybersecurity trends,” says Gartner Senior Director Analyst Richard Addiscott. “Security and risk management leaders must rethink their balance of investments across technology, structural, and human-centric elements as they design and implement their cybersecurity programs.”²

Each day brings new threats and challenges, further compounded by artificial intelligence (AI). Cybercriminals have become more sophisticated, and thus, the detection and mitigation of security threats must be thorough. Lumifi’s approach to cybersecurity integrates system, network, and device monitoring with human expertise. The company’s advanced security framework is monitored 24 hours a day/7 day a week by a team of U.S.-based cybersecurity analysts and former military and DoD experts.

Lumifi/DataShield is the pioneer in managed detection and response (MDR), and has established itself as a prominent industry leader. With over 15 years of experience, initially focusing on packet captures and forensics, Lumifi/Datashield gained recognition in its early stages from Lumifi/Datashield for their instrumental role in shaping the current MDR landscape. Today, Lumifi stands as a premier outsourced service, dedicated to equipping organizations with specialized threat-hunting capabilities and swift responses to emerging security risks.

“We are experiencing increasing demand for our comprehensive and proactive MDR services,” said Michael Malone, CEO of Lumifi. “Keeping our customers out of harm’s way 24/7 requires the perfect combination of breakthrough yet highly reliable and proven technology solutions and qualified human expertise. Now, our next steps for expansion necessitate finding and acquiring the best MDR companies that complement and expand upon all that we are presently offering.”

While many cybersecurity solutions necessitate regular oversight, Lumifi sets itself apart by providing a cutting-edge Managed Detection and Response (MDR) service. This unique approach synergizes the capabilities of our Security Operations Center with our in-house developed platform, ShieldVision™. Recognized as a top-tier Security Orchestration Automation and Response (SOAR) solution, ShieldVision™ stands out in threat detection, proactive hunting, and immediate automated interventions. As Lumifi pursues acquisitions of firms like Castra, the company’s focus is not just on expanding our tech arsenal, but also on deepening it’s engineering expertise.

David Norlin, CISO at Lumifi, notes, “Our strategic partnerships with technology frontrunners like Palo Alto Cortex, Extrahop, and Exabeam highlight our dedication to pushing boundaries and strengthening our industry leadership.”

Lumifi's growth strategy has garnered unwavering support from its investors, who eagerly anticipate expanding its technology stack and human capital. The recent success of the Castra acquisition has further fueled investor excitement as they eagerly look forward to Lumifi surpassing customer expectations across diverse industries, including Fortune 500 companies, prominent government agencies, and discerning legal firms. Castra recently was recognized for the second year in a row as one of CRN’s fastest growing technology vendors in North America.

“We are amazed about the high caliber of protection technology and services provided by Lumifi,” said Chris Graber, Managing Director, Corporate Investments & Acquisitions at BOK Financial. “They have a winning combination of human and cybersecurity integrated solutions that effectively detect and thwart cyberattacks. The Lumifi cybersecurity services are resonating with top-tier clients.”

Staying ahead of cybercriminals is no easy task, but Lumifi continues to evolve and innovate. The strategic initiative to acquire new MDR partners is another game-changing move that further strengthens Lumifi’s capabilities to provide unparalleled defense of critical customers.

“Lumifi is defining the future of cybersecurity,” said Frank Mora, Senior Partner of HCAP Partners. “The company is well positioned to acquire additional MDR partners and will fortify their customers with the best possible system, network, and device monitoring capabilities.”

For cybersecurity firms looking to explore collaborative opportunities and consider becoming a part of the Lumifi family, contact Matthew Decker at [email protected]. We are eager to engage with partners who share our vision and commitment to excellence.

1 Gartner, “Top Strategic Cybersecurity Trends for 2023,” Lori Perri, published April 19, 2023.

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

2 Gartner, “Applying Network-Centric Approaches for Threat Detection and Response,” Augusto Barros et al., March 18, 2019, ID G00373460

About Lumifi

Lumifi, headquartered in Scottsdale, is a vanguard in the cybersecurity industry, dedicated to protecting digital assets and fortifying cyber defenses for businesses across the board. With a team of experts and state-of-the-art technology, Lumifi is shaping the future of cyber safety.

About SkySong, The ASU Scottsdale Innovation Center

SkySong, The ASU Scottsdale Innovation Center is one of the premier economic engines in the Valley of the Sun. The project’s success is a direct result of a focus on innovation and technology that attracts companies ranging from some of the world’s best known brands to one-or two-person startups.

###

Copyright ©2023 Lumifi. All rights reserved. Lumifi and ShieldVision are trademarks or registered trademarks of Lumifi. Trademarks of other companies mentioned appear for identification purposes only and are property of their respective companies.

Lumifi Acquires Castra to Deliver Next-Generation Managed Detection and Response

Chapel Hill, NC and Scottsdale, AZ — October 4, 2023 — Lumifi’s recent acquisition of Castra Managed Services aims to expand its capabilities and reinforce its commitment to the Gartner Visibility triad. With Castra’s expertise in Exabeam, the SIEM capabilities will reach new heights.

Lumfi®, a leading innovator in managed detection and response (MDR), proudly announced its acquisition of Castra Managed Security. Castra is a revered enterprise-level MDR firm specializing in Exabeam, a security information and event management (SIEM) platform.

The partnership between Lumifi and Castra amplifies the Gartner SOC Visibility Triad, enhancing visibility through combined expertise in network detection and response (NDR), endpoint detection and response (EDR,) and SIEM within their security operations centers. This collaboration powers a 24/7/365 cutting-edge Security Operations Center (SOC), merging Lumifi’s innovative ShieldVision™ software with Castra’s distinguished MDR services. ShieldVision ™ an advanced multi-tenant platform that excels in threat hunting, detection, and swift automated responses. At the same time, Castra’s expertise in the Exabeam infrastructure ensures top-tier security at cost-effective rates for businesses of all scales.

Grant Leonard, co-founder of Castra, emphasized the value of partnerships, saying, ” I am excited about the immediate synergies between Lumifi and Castra. We are excited to bring honed Castra services to a much larger audience and scale.”

David Norlin, CISO of Lumifi, expressed his enthusiasm for the partnership, stating, “We’re thrilled to join forces with Castra. This collaboration strengthens our SIEM capabilities, offering our clients more choices and control in designing their security architectures. We remain committed to providing diverse technological options that guarantee unparalleled service quality, and the Castra acquisition exemplifies this commitment.”

Tony Simone, co-founder of Castra, emphasized the value of partnerships, saying, “Castra’s journey has been about forging valuable collaborations. Our partnership with Lumifi allows companies to elevate their SIEM capabilities and adopt next-generation programs, enabling security leaders to enhance their infrastructure while aligning with their business objectives.”

Michael Malone, CEO of Lumifi, highlighted the broader impact of the collaboration, stating, ” With the escalating threats across all areas of cybersecurity, many companies find themselves vulnerable. Partnering with Castra is a decisive step, leveraging our recent growth capital to realize our broader vision. Together, we’re bridging the cybersecurity skills gap, ensuring businesses are fortified against the diverse and evolving threats of today.”

To provide peace of mind against the latest cyber threats, Lumifi offers a turn-key cybersecurity monitoring and management solution at an affordable monthly price. This solution delivers advanced levels of security to businesses of all sizes across regulated industries, including energy, manufacturing, healthcare, finance, and more.

About Lumifi:

Lumifi is a leading provider of managed detection and response (MDR) services, offering Fortune 500-level security solutions to support security-conscious teams. Their approach integrates system, network, and device monitoring with human expertise, following the Gartner Visibility Triad principles, to create a robust protective shield for businesses of all sizes. Lumifi’s exclusive software, ShieldVision™, delivers state-of-the-art attack simulation, automated remediation, and continuous threat monitoring. This advanced security framework is monitored around the clock by a team of US-based cybersecurity analysts and former military and DoD experts, ensuring businesses are always secure. To discover how Lumifi can safeguard your business, visit lumificyber.com.

About Castra Managed Services:

Since its inception in 2012 by co-founders Tony Simone and Grant Leonard, Castra has been a beacon in managed detection and response services, serving over 2000 organizations globally. This year, Castra ranked 104th on the top 250 global MSSP/MDR list, marking its 3rd appearance on the prestigious list. Additionally, Castra secured the second spot in the “fast-growth” top 150 from CRN and received multiple “Partner of the Year” awards from Exabeam. With unmatched SIEM and SOAR expertise, Castra ensures customers maintain a security edge without compromising transparency. Catering to a diverse clientele—from Fortune 50 giants to nimble startups—Castra’s services span various industries. Learn more at castra.io.

For press inquiries, contact:

Brittany Kent

Growth Marketing Lead

Lumifi

Email: [email protected]

Advanced HTTP Flood Attacks Are Becoming Commonplace: Make Sure Your Organization is Prepared

Cybercriminals are now leveraging attack vectors previously only available to well-funded nation-state actors.

Security professionals know the dangers associated with distributed denial-of-service attacks (DDoS). These attacks typically target the core data transmission protocols that form the foundation of every organization' internet services.

(more…)

Lumifi Cyber’s Success Propels Expansion Plans at Scottsdale’s SkySong Tech Hub

Scottsdale, AZ (September 13, 2023), Lumifi Cyber, a leading player in the cybersecurity arena, proudly announces its significant long-term commitment through 2030 at SkySong, The ASU Scottsdale Innovation Center. This strategic move is an endorsement of Scottsdale’s burgeoning tech community and a testament to Lumifi Cyber’s commitment to growth, innovation, and community development.

Unlike other cybersecurity solutions that require constant management and oversight, Lumifi Cyber delivers Managed Detection and Response (MDR) services that actively hunt and assess threats while keeping costs low and working with existing cybersecurity toolsets. Lumifi Cyber’s team of cybersecurity professionals defend large and small organizations all over the world. The company has clients in nearly every industry with a long history of supporting mission-critical assets for institutions in government, healthcare, financial and legal sectors.

Jim Sadler, LOCATE AI broker responsible for the SkySong corporate services solution for Lumifi Cyber, expressed great excitement about this development, saying, “LOCATE and our technology and real estate services team are thrilled to support the industry leading cybersecurity firm and Lumifi Cyber’s significant growth trajectory. They’re at the forefront of redefining our city’s tech landscape and their operation fits nicely with SkySong, The ASU Scottsdale Innovation Center.”

Michael Malone, CEO of Lumifi Cyber, shared his enthusiasm: “This commitment marks a pivotal moment in Lumifi Cyber’s journey. Not only does it reflect our relentless pursuit of excellence in cybersecurity, but it also signifies our belief in Scottsdale’s potential to be a global tech powerhouse. Our commitment to our customers remains unwavering as we grow – to provide top-tier solutions and service. Furthermore, by deepening our roots here, we aim to contribute positively to the local economy and community.”

“We’re proud to be working with both Sadler and Lumifi Cyber again on this important phase of growth at SkySong,” said Sharon Harper, Chairman and CEO of Plaza Companies, the master developer of SkySong. “Michael Malone’s entrepreneurial growth and industry leadership exemplify the enterprise growth and path towards accelerating technology transfer at SkySong that we strive to embody.”

Plaza Companies is the master developer of SkySong, in partnership with University Realty, the City of Scottsdale and Holualoa Companies.

Lumifi Cyber’s Expansion will bring these Key Highlights:

Lease Commitment: Lumifi Cyber has signed a robust lease through 2030, reflecting its long-term dedication to the Scottsdale tech ecosystem.

Future Expansion Plans: Lumifi Cyber is postured for significant expansion and growth and consequently has sights on similar expansion at SkySong. When completed, Lumifi Cyber will expand its existing Security Operations Center into SkySong’s larger space in the new building, estimating its growth to be up to 25,000 square feet in the next 3 years. This move will nearly triple the company’s size and solidify its consistent growth trajectory.

Space Modernization: The current expansion enables Lumifi Cyber to redesign and modernize its workspace, fostering a more collaborative environment for its growing clientele and employee base.

Commemorating a 15-Year Journey in Cybersecurity: Lumifi Cyber’s remarkable impact in the realm of MDR services within cybersecurity is highlighted by numerous pioneering innovations. ShieldVision™ is an advanced multi-tenant cybersecurity platform. This platform showcases exceptional proficiency in threat hunting, detection, and rapid automated responses, significantly enhancing efficiency across a diverse range of cybersecurity solutions. Lumifi Cyber’s operational distinction is further validated by the company’s cutting-edge SOC 2 Type II certified Security Operations Center (SOC), where a dedicated team of analysts and threat-mitigation specialists work tirelessly 24/7.
Job Creation: With this expansion, Lumifi Cyber aims to onboard another 75 to 100 new personnel, significantly focusing on high-paying cybersecurity roles. A notable point is that 85% of Lumifi Cyber’s staff earn over $100K annually.

In-house Centric Approach: Lumifi Cyber is adopting an in-office-centric model, facilitating better internal and external partnerships. This decision aligns with the company’s belief in fostering a tight-knit community for better collaboration and innovation.

Strengthening SG&A: By creating additional non-security roles in the Sales, General and Administrative domains to ensure the company’s holistic growth.

Tech Acquisitions: Lumifi Cyber will enhance its technological capabilities through targeted acquisitions as part of its growth strategy. Lumifi Cyber’s second acquisition is to be completed in the next 45 days.

HCAP Partners, a California-based private equity firm and Tulsa, Oklahoma-based BOK Financial Corporation are investors.

In conclusion, the expansion underscores Lumifi Cyber’s commitment to growth, community engagement, and innovation. Positioned within the SkySong hub, which serves as a nexus for technology, research, education, and entrepreneurship, Lumifi Cyber is perfectly poised to drive forward ASU, Greater Phoenix, and the global knowledge economy.

About Lumifi Cyber

Lumifi Cyber, headquartered in Scottsdale, is a vanguard in the cybersecurity industry, dedicated to protecting digital assets and fortifying cyber defenses for businesses across the board. With a team of experts and state-of-the-art technology, Lumifi Cyber is shaping the future of cyber safety.

About SkySong, The ASU Scottsdale Innovation Center

About Plaza Companies

Plaza Companies is the developer of the project in partnership with University Realty, the City of Scottsdale and Holualoa Companies. Lee and Associates provides the brokerage services and Plaza Companies provides the property management and construction services.

Scattered Spider, Oktapus, UNC3944, Scatter Swine – MGM Resorts Compromise

Threat Summary:
On September 11th, 2023, MGM Resorts suffered a crippling ransomware attack that resulted in 10 days of computer system downtime as well as an estimated overall loss of $80,000,000. The threat actor, dubbed Scattered Spider, is claiming ownership of this hack and alleges to have ties with the infamous ALPHV/BlackCat ransomware gang. In this threat brief we will detail the events that occurred from initial access to recovery of MGM’s systems, common TTPs observed from this threat actor and other affiliated groups, as well as review detection, prevention, and mitigation options that would have been crucial to MGM’s security in all stages of this attack.

Lumifi’s Analysis:
To fully understand this attack, we need to look back into the previous operations of this threat actor. Throughout 2022 and early 2023, this threat actor primarily targeted systems that would provide access to SIM swapping attacks, as well as performing privilege escalation through BYOVD attacks (CVE-2015-2291.) Performing a SIM swapping attack would allow the threat actor to gain access to any data sent to the victim’s phone number. By establishing pre-requisite access to these systems, the threat actor already had the infrastructure in place to receive MFA codes sent to the target’s phone number via SMS, as well as masquerade as the target when making outbound calls.

Fast forward to September 8th, 2023; The threat actor places a call to MGM Resort’s internal IT helpdesk impersonating a legitimate employee (whose information was likely located on social media such as LinkedIn or Facebook.) Once connected with a helpdesk agent, a password reset is requested and processed for the impersonated user account, with MFA being bypassed via SIM swapping, resulting in initial access for the attacker. Currently, this is all the information that has been confirmed in regard to the MGM compromise, however, the rest of the attack chain is predictable based on previous activity from this threat actor.

After gaining initial access, this threat actor has been observed using a VPN or local proxy to geolocate to the local area where the attack is occurring, in an attempt to blend in with the regular traffic and evade detection. Then the threat actor installs legitimate remote access software such as TeamViewer or AnyDesk as a persistence mechanism into the compromised environment. In the past, this threat actor has also been observed creating publicly accessible VMs in the victim’s cloud environment as a means of persistence.

Once persistence is established, this threat actor will spend significant time reviewing internal documentation, resources, and chat logs in an attempt to help with privilege escalation and long-term persistence. Additionally, this threat actor often achieves privilege escalation by targeting password managers and PAM systems as well as utilizing tools such as Mimikatz, Trufflehog and GitGuardian. After gaining escalated privileges, this group will begin to move laterally in the environment and performing internal reconnaissance to identify critical infrastructure.

After successfully gaining access to critical infrastructure, this threat actor will begin performing exfiltration of sensitive data via tools like RClone and DropBox. After the desired data is exfiltrated, the Volume Shadow Copy service is stopped and all shadow copies are deleted or corrupted. Finally, this threat actor will deploy the ALPHV ransomware variant resulting in the encryption of critical systems and leave threatening notes in text files, contact executives via email and text, as well as infiltrating communication channels used to respond to incidents.

Lumifi’s Current Coverage and Mitigation Recommendations:

The Scattered Spider APT is also known to have overlap and ties to a number of other ransomware groups and APTs as demonstrated via the below screen capture from a Mandiant threat researcher at Sleuthcon 2023. Considering the wide array of connections and overlap between these groups, there is also a high likelihood of the tactics observed by one group being utilized by others.

Link between Threat Actors (Lapsus, Oktapus, Scattered Spider)

Source: Jake Nicastro, Mandiant, at Sleuthcon 2023

Lumifi currently has a broad content library that covers a wide variety of moments in the known attack chains of these actors. Some examples are:
LMFI – Powershell Exploitation Framework Activity – detects tools such as Mimikatz, ADRecon, Bloodhound, and other enumeration and credential theft tools.
LMFI – ALPHV / BlackCat Ransomware Process Creation – detects creation of a process tied to ALPHV and BlackCat ransomware attempted deployment.
LMFI – VSS Admin Delete Shadow Copies – detects deletion of shadow copies via VSS Admin

Mitigation for the threats posed by this APT would include:

Employee awareness training on social engineering, as this is the main vector this adversary gains initial access.
- Organizations can utilize Lumifi’s MDR service for this via Proofpoint and Iron Scales or look towards their current email security provider for user awareness training.
Ensure that MFA is set to not allow verification via text or phone call, this can be done by only setting the ‘Notification through mobile app’ as the only checked box in the MFA verification options.
- Office 365, Force Microsoft Authenticator (Not Call or Message) – Microsoft Community
Ensure MFA and SSPR registration is secure by requiring the users to authenticate from a trusted network location and/or ensuring device compliance.
- Control security information registration with Conditional Access – Microsoft Entra | Microsoft Learn
Help desks should implement a form of video verification to ensure the person requesting the reset is the user whose password is being reset. This can be performed via cross referencing with an HR system or having the employee present a form of identification such as a company badge or government issues ID.

Flax Typhoon APT

Threat Summary:
Flax Typhoon is a suspected China-based, nation-state threat actor whose TTPs appear to be closely aligned with espionage objectives and extended persistence. Despite activity tracing back to mid-2021, this APT's final objectives are unknown and they have been observed mostly targeting government, education, and critical manufacturing organizations in Taiwan; Though a small subset of attacks have occurred in North America, Africa, and Southwest Asia. The tactics and techniques utilized in these attacks are easily modified for use against a broad range of networks and industries and could have disastrous outcomes if carried out against an organization. With minimal "out-of-the-box" coverage by traditional security vendors, Lumifi aims to break down the attack methods of this threat actor as well as provide coverage and mitigation guidance for potential attacks following a similar attack chain.

Lumifi's Analysis:
Flax Typhoon has been observed utilizing tools such as Mimikatz, China Chopper Webshell, Metasploit, and the SoftEther VPN client in the past, however they primarily specialize in hands-on keyboard activity as well as Living-off-the-Land techniques.

This threat actor gains initial access by exploiting known vulnerabilities in public-facing servers across a variety of services, including (but not limited to) VPN, SQL, Java, and web applications with the goal of dropping a web shell allowing for remote code execution (RCE) against the targeted server. Once the server is compromised, if the threat actor doesn't have administrative permissions, they will run a piece of malware such as Juicy Potato to obtain local system permissions to gain access to WMIC, Powershell, or Command Line with local administrator permissions.

Once full system access is achieved, Flax Typhoon disables network-level authentication for RDP and modifies the sticky keys binary to launch Windows Task Manager as a debugger, giving the threat actor access to launch a Windows command interface and create memory dumps with system level permissions. While RDP is typically running only on an internal-facing network interface, the threat actor will also install a legitimate VPN bridge to call back to the network infrastructure under their control, giving them long-term system level access to a compromised host.

To deploy this VPN, the threat actor uses one of many LOLBins, such as Powershell, BITSAdmin, or CertUtil, to download the executable for SoftEther VPN from their infrastructure. Once this file is downloaded, a service or scheduled task is created to automatically launch the VPN bridge upon startup of the compromised machine. In order to make detection more difficult, the file's name is changed to 'conhost.exe' or 'dllhost.exe' to imitate legitimate Windows components. The actor also utilizes a VPN over HTTPS mode built-in to the VPN to blend in with legitimate HTTPS traffic and helps evade most network security controls.

At this point, a foothold is established on a compromised host and an unusual pattern emerges. In some cases, LOLBins such as WinRM and WMIC will be used to move laterally to other systems on the network, or the threat actor will attempt to dump LSASS and access the SAM registry hive in order to access account password hashes to access other resources on the network via password cracking or pass-the-hash attacks. However, in most cases minimal activity occurs after persistence is established on a network. Due to this behavioral pattern and the lack of data-collection/exfiltration objectives, it is suspected that these attacks are part of a larger espionage campaign, though final objectives of this campaign have not been observed.

Lumifi's Current Coverage and Mitigation Recommendations:
Lumifi currently has a number of detections in our content library that would successfully detect this threat actor at multiple points in their attack chain. The usage of tools such as Metasploit and Mimikatz would be detected via our rule 'LMFI - Powershell Exploitation Framework Activity'. Usage of BITSAdmin or CertUtil to download a malicious file would be detected by our rules 'LMFI - Persistence using BITSadmin' and 'LMFI - Suspicious Certutil Usage' respectively. Along with these detections, we have also created detections specifically focused on this attack chain, which detect the persistence mechanisms associated with disabling NLA for RDP and spawning any suspicious processes from accessibility functions such as command-line consoles and task manager. These rules are titled 'LMFI - NLA for RDP Tampering' and 'LMFI - Suspicious Process Spawned from Accessibility Functions'.

As for mitigations and defending against Flax Typhoon, this starts with vulnerability management, especially on any systems exposed to the public internet. Additionally, registry auditing should be enabled so that any registry changes made to critical registry keys is logged and can be used for threat hunting and event correlation. RDP usage should be reduced to a minimum and any systems that are not expected to maintain RDP connections should generate an alert. Finally, utilize MFA on all accounts and regularly change passwords.

Transforming Cybersecurity: Lumifi’s Journey with Azure Sentinel in the Accounting Industry

Description of Pain or Challenge:
An accounting company’s internal IT strategy prompted the move to a colo data center, which offered security monitoring services. While the accounting team initially favored our service, they were not given the option to retain it. After observing another partner’s attempt to manage a SIEM (now required to use Azure Sentinel), they found the newly mandated service lacking in knowledge, security expertise, and consultative guidance. Consequently, the accounting company initiated internal efforts to return to Datashield (Lumifi).

Solution Overview:
With previous experience in NetWitness, the organization transitioned to Azure Sentinel, necessitating thorough onboarding. Lumifi, supporting Sentinel as a monitored SIEM solution, expedited the adoption process, achieving operational status within weeks, a significant improvement from their previous provider.

Leveraging Lumifi’s Sentinel expertise, the organization swiftly embraced logging best practices and operational monitoring. This laid a robust foundation for further development, encompassing custom content creation, parsing, and dashboard development. Lumifi’s contributions enhanced SIEM maturity. Beyond technical implementation, Lumifi delivers continuous threat hunting, content development, and insights into emerging cybersecurity threats and events

Technology Description:
Formerly NetWitness, Migration to Azure Sentinel, Lumifi Managed Security Services

Enhancing Healthcare Security: A Success Story

Challenge: An existing RSA customer, a hospital, recognized the need for enhanced security operations despite using a Government, Risk & Compliance (GRC) solution.

Solution: We proposed RSA NetWitness as a comprehensive solution, seamlessly integrating with their current SIEM, EDR solution, firewalls, and existing network infrastructure. Our 24/7/365 Managed Detection and Response (MDR) services provided improved visibility. Partnering with a dedicated MDR provider who communicated regularly and acted as an extension of their security team was crucial. This allowed the hospital's security team to focus on proactive, strategic initiatives, boosting efficiency and achieving GRC goals.

Technology Description: RSA NetWitness for Packets and Logs, Lumifi Managed Security Services, Lumifi ShieldVision

Optimizing Security Infrastructure for a Logistics Company: A Success Story

Security Tools: Palo Alto XSIAM

Description of Pain or Challenge: The client had deployed RSA NetWitness and Palo Cortex but was unsatisfied with the deployment's progress. They sought to consolidate into a single solution, eliminate the need for multiple systems, and required custom ingest and alert content for their proprietary solutions. Staffing a 24/7 SOC proved challenging, and they lacked the expertise to manage the technology effectively.

Solution Overview: Lumifi provided a solution that replaced multiple legacy SIEM deployments, enhancing visibility and enabling the SOC to take additional actions during incidents. This consolidation streamlined their technology stack onto the Palo Alto Networks platform. XSIAM, deployed via SaaS, granted remote access to employees.

Lumifi's expertise and differentiators expanded account services, delivering a positive customer experience through exceptional service quality.

Technology Description: Content Development, Palo Alto XSIAM, In-depth knowledge of the client's environments, and understanding of specific vertical needs.

Ivanti/MobileIron Sentry Authentication Bypass Vulnerability (CVE-2023-38035)

Threat Summary:

CVE-2023-38035 allows an unauthenticated attacker to access sensitive admin configuration APIs on versions 9.18 and prior of Ivanti Sentry over port 8443. These configuration APIs are then used by the MobileIron Configuration Service (MICS), which upon successful exploitation, could lead to remote code execution with root permissions and configuration changes to MICS.

Lumifi's Analysis:

Exploiting this vulnerability is only possible via internal access by a threat actor or if the MICS is configured on a port exposed to the internet. If the threat actor does not have access to this service initially, then this vulnerability can be chained with two other vulnerabilities in Ivanti Endpoint Manager Mobile (CVE-2023-35078 and CVE-2023-35081) to lead to the successful exploitation of this Ivanti Sentry authentication bypass.

Lumifi's Recommendations:

While the Lumifi content library contains many detections that would alert on a variety of theoretical attack paths that could spawn from this vulnerability, there currently isn't enough information regarding the exact mechanism of exploitation to reliably detect this vulnerability. As such, Lumifi recommends restricting access to Ivanti Sentry to a management network only IT administrators can access and ensure that the System Manager Portal (on port 8443 by default) is not exposed to external networks. Additionally, any vulnerable versions should be patched via the RPM scripts available on Ivanti's KB (https://forums.ivanti.com/s/article/KB-API-Authentication-Bypass-on-Sentry-Administrator-Interface-CVE-2023-38035?language=en_US).

AI-powered Ransomware: AI is Now a Critical Piece of Today' Security Puzzle

As ransomware groups enhance their capabilities with generative AI and sophisticated automation, security leaders need to extend their detection and response capabilities more than ever.

(more…)

MDR Cybersecurity: Strengthening Defenses Against Modern Threats

In our interconnected world, the specter of cyber attacks casts a formidable shadow. With each technological advancement, cybercriminals adapt their tactics and strategies, posing new challenges for organizations. To effectively counter these ever-evolving threats, robust cybersecurity measures are essential. Among these measures, Managed Detection and Response (MDR) has emerged as a pivotal component in fortifying defenses against modern cyber threats. In this blog, we will delve into the pivotal role of MDR in cybersecurity and its profound impact on strengthening an organization's security posture.

Common Cybersecurity Challenges and the Need for MDR

Cybersecurity challenges have become increasingly complex, with attackers employing sophisticated techniques such as ransomware, zero-day exploits, and advanced persistent threats (APTs). Traditional security measures often fall short in detecting and responding to these threats effectively. This is where MDR comes into play. MDR combines advanced threat detection technologies with skilled analysts who actively monitor and respond to security incidents, helping organizations stay one step ahead of cybercriminals.

Understanding the Threat Landscape: Emerging Risks and Trends

The threat landscape is constantly evolving, making it crucial for organizations to keep up with the latest risks and trends. From nation-state attacks to supply chain vulnerabilities, new threats continue to emerge. This section will delve into some of the emerging risks and trends in the cyber threat landscape, including the rise of insider threats, the increasing sophistication of phishing attacks, and the impact of the Internet of Things (IoT) on cybersecurity.

How MDR Enhances Cybersecurity Defense

MDR enhances cybersecurity defense by providing continuous monitoring, threat hunting, and incident response capabilities. Unlike traditional cybersecurity solutions that rely primarily on preventive measures, MDR takes a proactive approach. It leverages advanced technologies such as machine learning, behavioral analytics, and threat intelligence to detect and respond to threats in real-time. This section will highlight the key components of MDR and how they work together to bolster an organization's security posture.

Collaborative Approach: MDR and Security Operations Centers (SOCs)

Effective cybersecurity requires collaboration between different teams within an organization. MDR teams work closely with Security Operations Centers (SOCs) to ensure a holistic approach to cybersecurity. This section will explore the collaborative relationship between MDR and SOCs, emphasizing the importance of information sharing, incident response coordination, and threat intelligence exchange. It will also discuss the benefits of integrating MDR capabilities into existing SOC infrastructure.

Case Studies: MDR Success Stories in Countering Cyber Attacks

To illustrate the effectiveness of MDR, this section will present real-world case studies showcasing successful outcomes achieved through MDR implementation. These case studies will highlight different industries and the specific threats they faced, demonstrating how MDR detected, analyzed, and neutralized cyber attacks. By examining these success stories, readers will gain a deeper understanding of MDR's practical applications and its impact on cybersecurity.

The Future of MDR in Cybersecurity

MDR is a vital component in fortifying an organization's defenses against contemporary cyber threats. By combining advanced technologies, skilled analysts, and collaborative efforts with SOCs, MDR offers a proactive and effective approach to cybersecurity. As the threat landscape evolves, MDR must adapt accordingly. This section explores the future of MDR, including the integration of artificial intelligence and machine learning, the impact of regulatory changes, and the importance of ongoing training in the MDR field.

As organizations strive to protect their sensitive data and digital assets, MDR remains an indispensable part of their cybersecurity strategy. By leveraging advanced technologies and human expertise, MDR enables proactive threat detection and response, mitigating potential damages. In the dynamic realm of cybersecurity, MDR serves as a steadfast beacon of defense, providing organizations with the assurance they need to navigate the digital landscape securely.

Managed Detection Response Solutions: Enhancing Cybersecurity Defense

Today’s rapidly evolving digital landscape, organizations face an ever-growing threat of cyber-attacks. The traditional reactive approach to cybersecurity is no longer sufficient to protect sensitive data and critical systems. Managed Detection Response (MDR) solutions have emerged as a proactive and effective approach to enhance cybersecurity defense. In this blog, we will explore the core components, benefits, key features, and best practices for evaluating MDR providers, along with real-world examples of successful MDR implementations. By the end, you will have a comprehensive understanding of MDR solutions and be equipped to make informed decisions when choosing an MDR provider.

Understanding the Core Components of MDR Solutions

Managed Detection Response (MDR) solutions integrate advanced technologies and expert human analysis to monitor, detect, and respond to cyber threats in real-time. The core components of MDR solutions typically include:
Continuous Monitoring: MDR solutions provide 24/7 monitoring of an organization's network, endpoints, and cloud environments. This proactive approach enables early threat detection and faster response times.

Threat Intelligence: MDR solutions leverage threat intelligence feeds, both internal and external, to stay updated on the latest attack vectors, malware signatures, and emerging threats. This information enhances the accuracy and effectiveness of threat detection.

Advanced Analytics and Machine Learning: MDR solutions utilize advanced analytics and machine learning algorithms to identify patterns, anomalies, and suspicious activities within the network. These technologies enable the detection of sophisticated and previously unknown threats.

Incident Response and Investigation: MDR solutions include incident response capabilities to mitigate and contain detected threats. They provide detailed reports, forensics analysis, and remediation guidance to assist organizations in responding effectively to security incidents.

Benefits of MDR Solutions for Organizations

Implementing MDR solutions offers several benefits for organizations seeking to enhance their cybersecurity defense:

Proactive Threat Detection: MDR solutions actively monitor and detect threats, significantly reducing the time between detection and response. This proactive approach minimizes the potential impact of cyber attacks and helps prevent data breaches.

Expertise and Scalability: MDR solutions provide access to a team of skilled security professionals who specialize in threat detection and response. This expertise is particularly valuable for organizations lacking in-house security resources. MDR solutions are also scalable, allowing organizations to adapt to changing security needs as they grow.

Cost-Effectiveness: Building an in-house security operations center (SOC) with similar capabilities to MDR solutions can be expensive. MDR providers offer cost-effective alternatives, leveraging economies of scale and sharing the cost across multiple clients.

Enhanced Visibility and Reporting: MDR solutions provide organizations with comprehensive visibility into their security posture. Detailed reports and dashboards offer insights into threats, vulnerabilities, and security events, enabling informed decision-making and regulatory compliance.

Key Features and Capabilities of Effective MDR Solutions

When evaluating MDR providers, it is essential to consider the following key features and capabilities:

Real-time Threat Detection: Effective MDR solutions leverage real-time threat detection capabilities to identify and respond to threats as they happen. Look for providers that offer advanced analytics, machine learning, and behavioral analysis techniques for accurate and timely detection.

Incident Response and Remediation: MDR solutions should have well-defined incident response processes to minimize the impact of security incidents. Evaluate the provider's incident response capabilities, including the availability of skilled analysts, playbooks, and coordination with your internal incident response teams.

Continuous Monitoring and Alerting: MDR solutions must provide continuous monitoring of your environment, including network traffic, endpoints, and cloud services. Look for providers that offer proactive alerts and notifications for potential threats, enabling prompt action.

Threat Intelligence Integration: MDR solutions should integrate with relevant threat intelligence feeds to stay updated on the latest threats and attack techniques. This integration enhances the accuracy and effectiveness of threat detection.

Evaluating MDR Providers: Considerations and Best Practices

When evaluating MDR providers, consider the following best practices:

Determine your specific requirements and objectives for implementing MDR solutions. Understand your organization's security needs, compliance requirements, and budget constraints.

Assess the provider's experience and expertise in the cybersecurity field. Look for certifications, client testimonials, and case studies to validate their capabilities.

Evaluate the provider's technology stack and the effectiveness of their threat detection and response capabilities. Request a demonstration or proof-of-concept to assess the solution's performance.

Understand the provider's incident response processes, including the availability of skilled analysts, their response times, and the quality of their incident reports.

Real-World Examples of Successful MDR Implementations

Several organizations have successfully implemented MDR solutions to enhance their cybersecurity defense. One notable example is Company X, a global financial institution. By partnering with an MDR provider, Company X achieved real-time threat detection, reduced incident response times, and enhanced their overall security posture. As a result, they experienced a significant decrease in security incidents and improved compliance with industry regulations.

Recommendations for Choosing MDR Solutions

Managed Detection Response (MDR) solutions offer a proactive and effective approach to enhance cybersecurity defense. By leveraging advanced technologies, expert analysis, and real-time threat detection capabilities, MDR solutions enable organizations to stay ahead of cyber threats. When choosing an MDR provider, carefully consider their core components, benefits, key features, and incident response capabilities. Evaluate the provider's experience, technology stack, and integration with threat intelligence. Real-world examples of successful MDR implementations can provide valuable insights and guide your decision-making process. Implementing an MDR solution can significantly strengthen your organization's cybersecurity defense and mitigate the risks associated with modern cyber threats.

Storm-0558 Unleashes Authentication Token Forgery

Threat Summary:

Storm-0558 is suspected to be a China-based, nation-state threat actor whose TTPs are closely aligned with espionage objectives. This threat actor managed to compromise an inactive MSA signing key which was then used to sign fabricated authentication tokens. Authentication tokens are short-lived credentials that are used to authenticate users to a service. They are typically generated by a server and then passed to the client. The client then presents the token to the server to prove that it is authorized to access such service. Storm-0558 acquired an inactive Microsoft account (MSA) consumer signing key, and then the key was used to sign MSA authentication tokens. The group was then able to use this key to forge authentication tokens for Azure AD enterprise and MSA consumer accounts. These forged tokens allowed Storm-0558 to access OWA and Outlook.com. Microsoft has since invalidated all MSA keys that were active prior to the incident.

Lumifi's Analysis:

We've concluded that the specific exploit utilized in this attack isn't reliably detectable due to the attack being performed by compromising an MSA key and signing a fabricated authentication token. However, this threat actor has been observed performing specific activities shortly after exploitation which are reliably detectable.

Lumifi Current Coverage:

Lumifi currently has a number of detections in our content library that would successfully detect this threat actor's exploitation attempts and attack chain. Our foreign login-based rules would detect this attack upon successful authentication of the threat actor. Additionally, we have developed and tailored a number of rules around suspicious O365 and email activity ranging from potential exfiltration detections to logins from a new IP.

The Evolution of Managed Detection Response: A Comprehensive History

Introduction to Managed Detection Response (MDR):

Managed Detection Response (MDR) has emerged as a crucial component in the field of cybersecurity, providing organizations with enhanced threat detection and response capabilities. In this blog, we will delve into the history of MDR, exploring its origins, advancements, and its current role in the modern cybersecurity landscape.

Early days of MDR (Origins and Influences):

The concept of MDR can be traced back to the early 2000s when organizations started recognizing the limitations of traditional security measures. The rise of sophisticated cyber threats necessitated a more proactive approach to threat detection and incident response. Influenced by the principles of Managed Security Service Providers (MSSPs), MDR began to take shape as a comprehensive solution that combined technology, expertise, and proactive threat hunting.

Advancements in Threat Detection and Response:

As cyber threats continued to evolve, so did the techniques and technologies used in MDR. The introduction of advanced threat intelligence platforms, machine learning algorithms, and behavioral analytics revolutionized the way threats were detected and analyzed. Real-time monitoring and continuous threat hunting became the norm, allowing organizations to detect and respond to threats faster than ever before.

Rise of Managed Security Service Providers (MSSPs):

The rise of MSSPs played a pivotal role in the evolution of MDR. These specialized service providers offered organizations the expertise, technology, and 24/7 monitoring required for effective threat detection and response. MSSPs leveraged their experience and knowledge to build robust MDR solutions, ensuring that organizations of all sizes could benefit from enhanced cybersecurity capabilities.

MDR in the Modern Cybersecurity Landscape:

In today's rapidly evolving threat landscape, MDR has become an essential component of an organization's cybersecurity strategy. With the increasing complexity and frequency of cyber-attacks, organizations are turning to MDR providers to augment their security operations. MDR offers a comprehensive approach that combines threat detection, incident response, and continuous monitoring, providing organizations with the peace of mind they need to protect their sensitive data and critical assets.

Key Milestones and Innovations in MDR:

The history of MDR is marked by several key milestones and innovations. From the introduction of cloud-based MDR platforms to the integration of artificial intelligence and automation, each development has brought new levels of efficiency and effectiveness to the field. Notable milestones include the adoption of proactive threat-hunting techniques, the incorporation of threat intelligence feeds, and the development of threat containment strategies.

Future Outlook of MDR Solutions:

As the cybersecurity landscape continues to evolve, MDR will play an increasingly vital role in safeguarding organizations against sophisticated threats. The fusion of human expertise and advanced technologies will continue to drive innovation in MDR, enabling organizations to detect and respond to threats in real time. Looking ahead, we can expect further advancements in machine learning, automation, and collaborative threat intelligence sharing, empowering MDR to stay ahead of emerging cyber threats.

In conclusion, the evolution of Managed Detection Response has been a remarkable journey, driven by the need for robust cybersecurity in the face of ever-evolving threats. By understanding its origins, advancements, and current role, organizations can appreciate the importance of MDR and make informed decisions to protect their digital assets in an increasingly complex threat landscape.

Strengthening State and Local Government Cybersecurity

Security Tools: Microsoft Sentinel, Microsoft Defender for Endpoint, RSA Netwitness Packets

Description of Pain or Challenge: Various agencies using different security tools, leading to technology sprawl and no centralized SOC. Concerns arose due to diverse attack types and the lack of a central SOC to handle alerts and remediation tasks.

Solution Overview: Lumifi deployed a central security technology stack with Microsoft Defender for Endpoint and Microsoft Sentinel. A central SOC was established to migrate various technologies into this unified stack, ensuring comprehensive alert management and investigations. Lumifi recommended retaining Netwitness for packets to maintain network visibility.

Agencies were consolidated under a unified security instrumentation, resulting in increased response and reduced visibility gaps. The experienced SOC provided invaluable support, avoiding task shortfalls and negative outcomes. Lumifi's expertise and tools, including Shieldvision and Microsoft Security tools, along with seasoned Packet experts, played a pivotal role in achieving success.

Technology Description: ShieldVision, Microsoft Security tools expertise, and Packet experts with over a decade of experience.

Enhancing Accounting Firm's Cybersecurity with Lumifi's Expertise

Security Tools: Microsoft Sentinel, Defender for Endpoint

Description of Pain or Challenge: An accounting firm invested in Microsoft E5 licensing but encountered difficulties in fully implementing Defender for Endpoint. Moreover, they lacked the expertise to deploy Microsoft Sentinel or efficiently manage either tool to their maximum potential.

Solution Overview: Lumifi collaborated closely with the client to fine-tune Defender for Endpoint, expanding the environment review to encompass both the endpoint tool and SIEM (Security Information and Event Management) capabilities. Providing industry best practices tailored to their organization, Lumifi successfully completed the onboarding process for the tools. This was particularly appealing to the small business, as it offered 24/7 monitoring without the need for an extensive in-house team with graduated resource capabilities.

The onboarding process was executed seamlessly, and the client expressed widespread positive feedback. Their overall security posture saw a significant improvement through the successful tool onboarding and knowledge sharing with key roles within the client organization. Consequently, this client became a valuable reference for Lumifi's future engagements with industry-specific clients or those requiring expertise in specific technologies.

Technology Description: Microsoft Sentinel, Defender for Endpoint, Dedicated Onboarding Team.

Overcoming Security Challenges in the Aerospace and Defense Sector

Security Tools: RSA Netwitness

Description of Pain or Challenge: Our aerospace and defense client had deployed RSA Netwitness, a powerful security tool. However, they encountered dissatisfaction with the deployment's progress and completion. The main pain points were the lack of readily available custom content to address their specific needs and the inability to establish a 24/7 Security Operations Center (SOC) due to resource constraints. Furthermore, their existing staff lacked the necessary expertise to effectively onboard and manage the new SIEM technology.

Solution Overview: Recognizing the significance of CMMC (Cybersecurity Maturity Model Certification) compliance in the aerospace and defense sector, our team brought a wealth of expertise in this area during the sales process. This expertise played a crucial role in their decision to choose our services. Additionally, our team's extensive experience with RSA Netwitness and our proficiency in creating tailor-made content, conducting threat-hunting operations, and overall security management proved to be key advantages that set us apart from the competition. Furthermore, we fulfilled their requirements for staffing, ensuring they had the necessary resources to maintain their security posture effectively.

Since the engagement began, our team quickly identified several issues in their existing administrative processes. We efficiently addressed these concerns and demonstrated our exceptional services, impressing the client. As a result, they decided to redirect their spending from other professional vendors to further invest in our services. This transition allowed our team to take the lead and steer the project towards success.

Technology Description: Our solution encompassed comprehensive content development, leveraging the capabilities of RSA Netwitness, and utilizing our profound compliance knowledge, particularly in CMMC. This combination of technological prowess and expertise empowered us to provide an effective and tailored security solution for our aerospace and defense client.

How to Detect and Mitigate Compromised Credential Attacks

Most security technologies are ineffective against unauthorized users with stolen credentials.

Cybersecurity vendors spend a great deal of time and money warning against technical exploits and ransomware attacks. These are undoubtedly serious threats, but they are not nearly as complex or dangerous as compromised credential attacks.

In fact, although ransomware dominates headlines in the cybersecurity industry, Verizon’s 2022 Data Breach Investigations Report states that compromised credentials are behind half of all attacks. Stealing login credentials is quickly becoming the fastest, easiest way for hackers to gain access to victims’ networks.

Unlike technical exploits, credential compromise attacks often leave very few traces, if any. When hackers gain access to a legitimate user’s login credentials, they become invisible to most detection solutions. SIEM 1.0 platforms are designed to detect external threats, not internal ones. The same goes for many enterprise-level firewalls and endpoint solutions.

"Pay attention to those 'that’s odd' moments."

Tony Simone | Vice President Lumifi

Even among solutions that can detect insider threats, it is often a complex, time-consuming, and error-prone task. In a scenario where malicious insiders are rapidly gaining access to increasingly sensitive data sources in your organization, you can’t afford to waste time or resources this way.

User Entity and Behavioral Analytics (UEBA) Technology is Key

Modern SIEM platforms like Exabeam utilize UEBA technology to dive deeper into the actions of authenticated users. This provides a level of visibility that other detection technologies cannot match. Without this degree of visibility, tracing the activities of a compromised account requires running dozens of painstaking search queries manually – with no guarantee you’ll get accurate results.

Exabeam’s UEBA technology leverages machine learning to establish a baseline for each individual user in your network. Each user’s baseline accounts for the applications they access, the files they modify, the privileges they have, and more.

When an individual user starts to deviate from that established baseline, Exabeam takes notice and begins to rate their behavior against a pre-established threat threshold level. The more an individual user deviates from their established routine, the higher their score becomes. The SIEM assigns priority to each alert based on how severely the user is deviating from their established behavior.

This way, each alert represents a collection of suspicious behaviors instead of one single action. This dramatically decreases the number of false positives analysts encounter and streamlines incident investigation.

This capability is not limited strictly to users, either. As suggested in its name, UEBA technology also analyzes the behaviors of routers, servers, and endpoints throughout your network.

Preassembled User Activity Timelines Optimize Event Response

In a SIEM 1.0 environment, analysts conduct investigations by reviewing user activities using a complex sequence of search queries. This lets them assemble the data they need to understand the incident scenario they are facing. However, this process can take hours to complete and becomes more demanding as the environment grows in size and complexity.

One of the most practical benefits of the UEBA approach is that it enables the SIEM to automatically create a timeline of user activity. Analysts can drill down into the individual actions that contribute to a particular user’s risk score and make decisions based on that data. Instead of taking hours to build a narrative, the entire scenario is evident from the very beginning.

This means that incident response can happen in mere minutes. Analysts can immediately tell if malicious insiders are responsible for suspicious activities, or if benign organizational assignments – like job role or department changes – are at fault. There is no need for gathering evidence using the tedious point-click-and-pivot method, so analysts can respond quickly and decisively to security events.

Combine UEBA SIEM Technology with On-Demand Expertise

Highly automated UEBA technology provides accurate, curated data on security events, but it cannot mitigate those events on its own. Human expertise remains the cornerstone of effective information security. The experience and availability of analyst talent is a critical element of your overall security posture.

Lumifi provides managed detection and response services that cater to UEBA-enabled enterprises in need of scalable security expertise. By entrusting detection and response to our team of highly trained US-based security analysts, you gain both an in-depth visibility into the effectiveness of your security posture and a scalable solution for addressing security incidents even in high-volume environments.

These capabilities allow us to address credential compromise risks effectively and consistently.

Contact us to find out how your organization can leverage Lumifi MDR services to protect itself against these types of attacks.

Celebrating Managed Detection Response: Join Our Exciting Journey!

We're thrilled to announce our momentous milestone as we start our journey of 15 years in the managed detection response field. Reflecting on our achievements, we express our appreciation for our outstanding team and valued industry partners. To honor this occasion, we're introducing Lumifi Day, a special celebration dedicated to our team members.

Lumifi Day is a heartfelt tribute to our team's unwavering commitment and expertise. Their contributions have shaped our success and positioned us as leaders in the industry. Join us in celebrating, and stay tuned for engaging content highlighting our journey and showcasing our team's connection to the industry.

Throughout Lumifi Day, we'll share behind-the-scenes glimpses and how we've contributed to the innovation of managed detection response (MDR) in cybersecurity. Our partnerships have played a vital role in our growth, and we believe collaboration and knowledge-sharing drive advancements in our industry.

Lumifi Day isn't just about the past; it's about the future. We're energized by the opportunities ahead and remain committed to being at the forefront of innovation. By investing in research, development, and top talent, we aim to shape the industry's future.

We sincerely thank our employees, clients, partners, and stakeholders for their unwavering support. Your trust has been the driving force behind our accomplishments. Stay tuned for captivating content that showcases our journey, team expertise, and industry developments.

Let's celebrate 15 years of managed detection response and the incredible people who made it all possible. Together, we'll forge ahead into an exciting future.

An interview with Michael Malone: The evolution of Managed Detection Response (MDR)

Q. Can you share with us the journey of Datashield/Lumifi and how it has evolved in the field of Managed Detection and Response (MDR)? What were the key milestones and challenges along the way?

Datashield/Lumifi has come a long way in Managed Detection and Response (MDR). Our journey began as an investment by myself and EMC Ventures (now Dell) when we recognized the immense potential in this space. We did not anticipate that we would become one of the pioneering MDR companies in 2010! Throughout our evolution, we have encountered significant milestones and challenges that have shaped our growth and expertise in providing top-notch MDR services to our clients.

Q. MDR has rapidly transformed the cybersecurity landscape. How did Datashield/Lumifi identify the potential of MDR early on, and what were the key factors that influenced the decision to focus on this particular area?

It was easy! We recognized the potential of Managed Detection and Response (MDR) early on by closely monitoring the evolving cybersecurity landscape and observing the increasing sophistication of cyber threats and the growing need for comprehensive security solutions. Several key factors influenced our decision to focus on MDR.

Firstly, the acquisition of Netwitness packet technology by EMC/RSA presented a game-changing opportunity for real-time forensics, enabling us to better serve our customers by swiftly identifying and mitigating threats. Additionally, the demand for proactive threat detection and response solutions, combined with our expertise in cybersecurity, further solidified our belief in the value of MDR as a crucial area to concentrate our efforts on.

Q. As a leader in the MDR space, what advancements do you foresee Datashield/Lumifi making in the near future? Are there any specific areas or technologies that you believe will have a significant impact on the future of MDR?

I foresee significant advancements from Lumifi in the next year. Our ongoing investment in Shieldvision and Backquery, which allow seamless integration with various EDR and SIEM tools, will be a game changer.

With this technology, we aim to provide our customers with a comprehensive and user-friendly platform, offering a single pane of glass access to all the necessary data for forensic analysis and proactive incident response. This innovative approach will enhance our ability to help customers effectively mitigate threats and stay ahead in the ever-evolving MDR landscape.

Q. In your opinion, what sets Datashield/Lumifi apart from other MDR providers in the market? How does the company differentiate itself in terms of technology, expertise, or approach?

Our extensive experience of 15 years in the cybersecurity industry distinguishes us from other providers. Unlike them, we have a proven track record of delivering Managed Detection and Response (MDR) services. We understand that despite technological advancements, human expertise remains crucial. Our approach combines advanced software technology with highly skilled teams to effectively address security issues in diverse customer environments. We strongly focus on customer satisfaction and customize our solutions to cater to specific needs and industries. This combination of human intelligence and cutting-edge technology enables us to deliver comprehensive and reliable MDR services that outperform our competitors.

Q. Looking ahead, where do you see Datashield/Lumifi positioned in the advancements of MDR in the next 5 years? What specific goals or targets has the company set for itself in terms of growth and innovation?

In the next five years, Lumifi aims to establish itself as the dominant player in MDR, driving significant advancements in the field. We have set ambitious goals to drive growth and foster innovation, focusing on our customers' success and security. Our primary objective is to expand our market share by acquiring new customers and enhancing our offerings through continuous technological advancements.

We understand that achieving success in this industry relies on the synergy between people, processes, and technology. To this end, we remain committed to nurturing a skilled and dedicated workforce. We will continue to invest in intelligent and talented individuals who ensure our customers' ongoing success and security.

Q. Looking even further into the future, how do you envision the MDR landscape evolving in the next 10 years? What major trends or changes do you anticipate, and how is Datashield/Lumifi preparing to stay at the forefront of these developments?

Looking ahead to the next ten years, I foresee a remarkable transformation in the Managed Detection and Response (MDR) landscape, driven by technological advancements, particularly in automation and AI. These innovations will revolutionize MDR solutions, enabling faster threat detection, more accurate incident response, and improved overall security outcomes.
Lumifi is fully committed to embracing these advancements and harnessing their potential to stay at the forefront of the industry. By leveraging automation and developing AI capabilities, we aim to optimize our detection and response processes, empower our analysts with intelligent tools, and deliver enhanced protection to our clients.

Moreover, as the MDR market evolves, we anticipate a significant consolidation. Current MDR providers cannot scale and will need to keep pace with technological advancements, ultimately causing them to lose profitability. We will continue to maintain a proactive approach to technical integration, and our unwavering commitment to continuous innovation positions us well to navigate these changes and maintain our leadership position in the MDR space.

Micheal Malone | CEO of Lumifi

Malicious Insiders in Healthcare: The Moment UEBA was Made For

With UEBA-powered platforms like Exabeam, you can catch threat actors who already work within your network.

External threats aren't the only kind of threat security leaders need to prepare for. Insider threats often pose an even greater risk.

(more…)

How to Leverage UEBA to Address Your Organization' Unique Risk Profile

You can make UEBA technology work right out of the box – but custom configuration is needed to unlock its real value.

User Entity and Behavioral Analytics (UEBA) technology is a game-changing addition to any security tech stack. UEBA-enhanced insights allow security teams to detect sophisticated attacks that other technologies often miss.

Compromised credentials and malicious insiders are excellent examples. Static rules-based SIEM platforms are not well-suited to detecting these kinds of attacks because their rules often rely on authorization credentials.

In most cases, these systems automatically extend trust to authorized users even if they do suspicious things – like encrypting mission-critical files and directories. UEBA technology addresses that risk by monitoring the activities of authorized, validated users for signs of compromise.

But how do UEBA solutions know how to triage alerts effectively? Why do they prioritize some activities over others?

The answers to these questions will help security leaders optimize UEBA implementation in ways that directly address the risks unique to their organizations.

How Default UEBA Configurations Work

UEBA platforms identify suspicious behavior by looking at user and asset activity and assigning a baseline risk score to each one. The more a user, server, or application deviates from their routine, the greater the severity of the alert triggered.

In a default plug-and-play configuration, this baseline risk score is arbitrary. It simply represents whatever activities were being carried out on the network at the time of implementation. It doesn't "know" anything about the organization' risk profile, security processes, or other activities.

Sophisticated UEBA solutions use self-evolving machine learning solutions to fine-tune their models over time. This essentially means triggering alerts and observing whether analysts categorize them as false positives or real attacks.

It also means that any security risks present prior to UEBA implementation may be perpetuated from that moment forward. If you happen to deploy UEBA in the middle of a sophisticated "low and slow" cyberattack, it might assume that things like privilege escalation and lateral movement are perfectly normal.

Security leaders who prioritize getting UEBA up and running as soon as possible may ultimately normalize threatening behavior in ways that undermine the technology' most valuable features. If the platform in question doesn't provide deep visibility into how its risk assessment algorithms actually work, problematic assumptions can embed themselves throughout the organization' security posture.

Custom Configurations Enhance UEBA Performance from Day One

When an organization takes time to measure its exposure to real-world security risks, it earns the ability to address those risks more effectively using UEBA technology. Custom rules and playbooks are a vital part of this process.

UEBA platforms like Exabeam can leverage custom rules to analyze user and asset behavior. These custom rules allow the system to accurately process false positives, meaningfully prioritize high-severity alerts, and take the organization's unique security architecture into account.

For example, consider an organization with users who travel frequently and log on remotely. Custom UEBA configuration allows the security team to monitor high-risk activities without waiting for the system to learn how to categorize those activities as high-risk on its own. That might mean focusing on VPN usage, server locations, and other characteristics that violate the company' specific remote work policies.

Those policies are unique to the organization itself. They aren't going to be part of any default UEBA configuration. Custom rules enable the organization to align its UEBA-powered detection platform with its own assessed security risks.

Custom playbooks offer many of the same benefits. Although there are broad similarities in the ways individual organizations remediate active cyberattacks, no two organizations are perfectly alike. Custom configurations provide improved visibility and allow security professionals to detect, address, and mitigate risk more effectively than default deployments.

How Lumifi Uses Custom Rules to Improve Risk Management

Lumifi has spent years developing more than 1,800 unique custom rules for Exabeam. These rules are templates that take unique characteristics of the organization' security posture into account, allowing analysts to quickly build a robust foundation for improving risk management using UEBA technology.

These are not plug-and-play rules. Custom rules like the ICMP Unequal rule must be configured by an expert who can determine the ideal threshold between normal and suspicious activity.

Security leaders who entrust Lumifi with the development and implementation of these rules gain visibility into processes that their security tech stack would otherwise overlook. Every organization can maximize the benefit of UEBA technology with Lumifi product experts leading the way.

Why Aren't Security Experts Talking About Public Administration?

Government agencies are quietly suffering a significant uptick in security incidents and data breaches – but the cybersecurity industry doesn't seem to have noticed yet.

One insight stands out among the many contained in Verizon' 2023 Data Breach Investigation Report.

(more…)

Top 5 Takeaways from Verizon's 2023 Data Breach Report

Cybercriminals are adopting new, more sophisticated tactics. Security leaders can't depend on purely technical solutions that ignore the human element.

If there is one broad theme to Verizon's 2023 Data Breach Report, it's that the arms race between cybercriminals and cybersecurity professionals hinges on the human element more than ever. The report declares this clearly in its opening summary, saying that:

(more…)

Use Automation to Enhance the Value of Human Expertise in the SOC

Automation isn't always a replacement for human expertise. The two must work together to generate lasting security value.

Security Operations Centers have struggled with workforce shortages for years. Experts were already alarmed at the growing cybersecurity talent gap back in 2017.

(more…)

Cyberattacks on Banks: 5 Growing Threats in 2023

Cyberattacks against banks and financial institutions continue to rise as cybercriminals develop new tactics.

The global financial sector is one of the biggest cybercrime targets in the world. The volume and sophistication of cyberattacks on banks surged in 2022, spiking considerably at the very end of the year.

(more…)

Remote Work: Hidden Evils Revealed

Remote work is seemingly here to stay, with many workers forgoing their commute to work for a nice stroll to their in-home office. The WFH movement provides great flexibility but comes with even greater challenges for cybersecurity.

A 200% increase in cyberattacks has been witnessed following the remote working surge, leading to a greater emergency than most experts expected. Prying eyes understand the immense vulnerability working from home represents as we log into unprotected Wifi networks, access servers away from the safety net of the office, and even take our private data with us on the go. This ability for greater work flexibility works to expand and increase the attack surface for cybercriminals, enabling easier access to potential private data through a multitude of unprotected endpoints. Gartner called this expanded attack surface and increase in public cloud use, a major threat in 2022.

Remote Work's Impact

Remote work can dramatically increase the potential attack surface and according to Gartner, “These changes in the way we work, together with greater use of public cloud, highly connected supply chains and use of cyber-physical systems," Gartner warned, "have exposed new and challenging attack 'surfaces.'“

Working from home increases the use of new technology which may not be detected or equipped with proper security solutions. Many workers now rely on their emails for primary communication, resulting in private information potentially being sent via mobile devices, unsanctioned laptops, etc. Moving this equipment away from the in-office defense can leave unsuspecting users helpless in the event of a cyberattack.

"Those had been protecting the castle, but now, people aren't working inside the castle," said Ed Skoudis, president of SANS Technology Institute. "They're out in the field, so those defenses don't protect them there. We've been saying for years that the network perimeters we built were dissolving because of things like wireless and cloud, but then, COVID came and blew it all up."

Cybercriminals understand the increased opportunity for hacking that WFH brings, as many users are under the impression it won’t or can’t happen to them, even though they had been under an umbrella of security protocols, firewalls, and other solutions to block attacks and thwart criminals for years while in-office.

Most Common WFH Risks

1. Expanded attack surfaces

Security teams are already stretched incredibly thin these days, and the expanded attack surface of remote work can make it impossible to secure each endpoint.

2. Less oversight

Workers are more in the dark than ever before when it comes to remote work, as they don’t have security teams or experts on their home network, to keep an eye on anything suspicious.

3. Poor data practices

Sending unencrypted emails containing sensitive files can be a recipe for disaster and most remote workers aren’t thinking about this layer of protection when they are downloading or sharing private data.

4. Phishing attacks

Phishing continues to see stratospheric growth as sophisticated threat actors become more creative with their attempts at garnering link clicks. Remote workers rely heavily on their emails potentially increasing the likelihood of accidentally clicking on a phishing email disguised as a pertinent request from your boss, for example.

5. Unprotected Networks

The use of unprotected networks for work purposes can be a costly mistake, as unprotected networks, to a skilled threat actor, can be like putting all of your information out for the world to see. The U.S. Cybersecurity and Infrastructure Security Agency (CISA), highlighted the risk of nation-states attacking home routers in 2022, proving that some attacks may very well be out of your control if you do not possess the technical know-how. VPNs are critical, especially if you choose to use public wifi.

6. Cloud misconfigurations

As we all know, the cloud is an essential component to our lives and especially remote work, but still does not go without challenges. Misconfigurations present massive liability on the grounds of failed access controls and accidental provision of too much access to certain users. The “2022 Cloud Security Report” highlighted more than one-fourth of all security professionals experienced cloud security incidents within the past year.

7. Webcam hacking

At one point, the odds are you have used Zoom or Microsoft Teams for a video conference, interview, chat with friends, etc. but even these platforms can be hacked. Cybercriminals have reportedly sabotaged and disrupted online video chats, some even undetected enough to crawl around, stealing data and corporate emails for future use.

First-Line Defense

1. Keep Your Devices Updated

Any device that connects to the internet is vulnerable to risks. The best defense is to keep device security software, web browsers, and operating systems up to date.

2. Use an Antivirus

Antivirus software acts a shield for your computer against incoming threats such as viruses, ransomware, spyware, and other malware.

3. Separate Work and Personal Devices

The more devices containing private, company specific information, leads to greater vulnerabilities and gaps in protection. Limit your personal devices for just as it sounds, your personal life. It may be tempting to take work "on-the-go" but refrain from this mentality when you can.

4. Enable Multi-Factor Authentication

No matter how strong your password is, a breach is always possible. Make it harder for cybercriminals to access your account by enabling multi-factor authentication which adds another step for access.

Adding MFA to an account greatly increases your security. It may include:

A code emailed or texted to an account
A biometric identifier like a fingerprint
A unique number, yes or no prompt, generated by an authenticator app

Closing Thoughts

Working from home has been a life-saver for countless individuals across the country, but understanding the risks that lie beneath the surface could be the difference between you becoming a victim of cybercrime. Your organization retains a great deal of responsibility for providing adequate training and implementing security protocols across all sanctioned equipment and servers, but the weakest link can break the chain. Be vigilant and be smart.

Phishing: The World's Top Cyber Threat

What is Phishing?

Phishing is a type of online fraud which aims to steal personal and financial information by impersonating reputable companies.

Phishing can be done through email, websites, and social media. One of the most common ways phishers try to get your information is by sending you an email from a company you do business with or from someone you know.

The email may ask for your account number or other personal information. It might even say that there's a problem with your account and that you need to update your personal information immediately.

How to Spot a Phish

The best way to spot a phish is by looking for red flags such as typos, spammy subject lines, poor grammar and spelling mistakes. If you are unsure about something, it is always best to contact the company directly via phone or email rather than click on any links provided.

How to Protect Yourself from Phishing Attacks

Phishing scams are becoming more sophisticated and harder to spot every day. It’s not always easy to tell if an email is legitimate or not, which is why it’s important for everyone to know how to protect themselves against these attacks.

The first thing you should do when you get an email from your bank, credit card company or any other service provider is to make sure it’s actually them by looking at the sender’s address in your inbox. A phishing email will often have the name of a well-known company such as “Bank of America,” but the sender's address may be “[email protected]” or “BbccoDc3H6sLfI8MCJpAAABXyh43. A golden rule is to simply use common sense, and truly think of the motive behind the email. It’s better to be speculative than to be gullible.

The Current State of Phishing

Cybercriminals are becoming more skilled and cunning with phishing methods every year, while using tried-and-true strategies to trick their victims and steal from them. The COVID-19 epidemic allowed hackers to increase the frequency in which fraudulent emails were distributed as part of cyberattacks, according to data from Verizon. As our world shifted predominately online, phishing attempts rose drastically as many of us rely on email to communicate within the online work place.

It might be challenging to discern a phishing attempt from a legitimate email, sms, or information request since phishing attempts can take many various forms. As a result, phishing simulations are a great approach to gauge user knowledge and raise phishing awareness across the board in your business.

Examples of Different Types of Phishing Attacks

Phishing has developed over the years to become increasingly complex, alluring, and difficult to detect. This means there is not a one-size-fits-all approach to identifying spam.

Phishing Email

The annual list of catastrophic data breaches in the globe still includes a sizable percentage of phishing emails. Phishing emails are made to look like they are from a reputable source, such as PayPal, a bank, Amazon customer service, or another well-known company. Cybercriminals conceal their presence in minute details like an email link or the URL of the sender.

Spear Phishing

The information that a cybercriminal has previously gathered about the victim or the victim's company is the foundation of this more focused phishing email assault. Spear phishing emails frequently utilize urgent and well-known language to persuade its victims to take rapid action.

Link Manipulation

This assault uses carefully crafted phishing emails and contains a link to a well-known website. This link directs users to a fake version of the well-known website that is made to resemble the genuine one and requests that they confirm or change their account credentials.

Fake Websites

Phishing emails are sent by online criminals that contain links to bogus webpages, such as the registration login screen for a well-known mail provider, and urge the target to input their login details or other details into the false website's interface. In order to fool consumers, malicious websites frequently employ a small alteration to a well-known URL, such as using mail.update.gmail.com rather than mail.gmail.com.

CEO Fraud

An email address that the victim is acquainted with, such as the CEO's, the HR manager's, or the IT support department's, is used in this illustration of a phishing assault. The email begs the recipient to take immediate action and provide money, change employee information, or download a new program on their computer.

Content Injection

A cunning cybercriminal will hack a well-known website and add a phony authentication server or pop-up that drives users to a false website.

Session Hijacking

With the help of this sophisticated phishing operation, thieves are able to enter a firm's web server and steal the sensitive data that is kept there.

Malware

Clicking an unsolicited email is all it requires to download dangerous malware on a PC or corporate network. These files may even be presented as humorous cat videos, Ebooks, or animated images while still appearing to be legitimate.

OpenSSL 3.0.7 Released: Everything You Need to Know About the High-Severity Vulnerability

OpenSSL originally warned this patch would fix a critical vulnerability impacting all OpenSSL 3.0 installations.

OpenSSL has released a patch fixing the headline-making vulnerability it first announced on October 27th, 2022.

(more…)

OpenSSL Critical Vulnerability: Everyone Must Update to Version 3.0.7

The open-source cryptographic library is an industry-standard found in an enormous range of applications.

In late October, the OpenSSL Project announced it would release a patch for a critical security vulnerability on November 1st, 2022. The organization did not share any details about the vulnerability itself, other than the fact that it impacts all OpenSSL versions 3.0 and above.

(more…)

Ransomware Attacks and How to Protect Yourself

What is Ransomware?

An organization or user's access to data on their computer is restricted by malware known as "ransomware." Cybercriminals put businesses in a situation wherein paying the ransom is the quickest and least expensive option to recover access to their data by encoding these files and requesting a ransom demand for the decryption key. For increased motivation for ransomware sufferers to pay the ransom, several variations have included other capabilities, such as data stealing.

The first known ransomware attack was called "AIDS" or "PC Cyborg", which surfaced in 1989. Today, there are many different types of ransomware including Cryptolocker, CryptoWall, CTB-Locker, Locky, and TeslaCrypt. Some ransomware variants even go so far as to disable anti-malware software on infected systems so they cannot be removed by other means.

Emergence of Ransomware

The 2017 WannaCry attack marked the start of the current ransomware mania. This widespread and well reported assault proved that ransomware was both feasible and possibly lucrative. Numerous ransomware variations have since been created and utilized in numerous assaults.

The recent rise in ransomware was also influenced by the COVID-19 epidemic. Gaps in firms' cyber security emerged when they quickly shifted to remote labor. These flaws were taken advantage of by cybercriminals to spread ransomware, which led to an increase in ransomware assaults. When compared to the first half of 2020, ransomware assaults climbed by 50% in the third quarter.

Popular Ransomware Variants

There are several ransomware variants, each with specific features. However, certain ransomware organizations have been more active and profitable than others, setting them apart from the competition.

1. Ryuk

A very targeted ransomware variant is Ryuk. It is frequently sent by spear phishing emails or by utilizing stolen user credentials to access business systems over the Remote Desktop Protocol (RDP). After infecting a system, Ryuk encrypts some file types (but ignoring those that are essential to a computer's functionality), then demands a ransom.

One of the most costly ransomware variants in use is known as Ryuk. The average ransom demanded by Ryuk is above $1 million. As a result, Ryuk's cybercriminals mostly target businesses who have the means to satisfy their demands.

2. Maze

Because it was the first ransomware strain to combine file encryption and data theft, the Maze ransomware is well-known. When victims started declining ransom demands, Maze started gathering private information from their PCs and encrypting it. This data would either be made publicly available or sold to the highest bidder if the ransom demands were not satisfied. A further inducement to pay up was the prospect for a costly data leak.

The organization that created the Maze ransomware has formally ceased operations. This does not, however, imply that ransomware is any less of a concern. The Egregor, Maze, and Sekhmet varieties are said to share a same origin, and some Maze associates have switched to utilizing it.

3. REvil (Sodinokibi)

REvil started out as a conventional ransomware strain, but it has since developed. Now, it uses the Double Extortion method to steal data from organizations while also securing the files. This implies that attackers may threaten to reveal the hacked information if a second payment isn't received in conjunction with demanding a fee to unlock the data.

4. Lockbit

The ransomware-as-a-service LockBit has been active since September 2019 and encrypts data (RaaS). This ransomware was created to swiftly encrypt huge enterprises in order to avoid being immediately discovered by intrusion detection systems and IT/SOC teams.

5. DearCry

Microsoft issued remedies for four Microsoft Exchange server vulnerabilities in March 2021. A new ransomware version called DearCry is intended to exploit four previously discovered vulnerabilities in Microsoft Exchange.

Some file formats are encrypted by the DearCry ransomware. After the encryption process is complete, DearCry will display a ransom notice telling users to email the ransomware's operators to request instructions on how to unlock their data.

6. Lapsus$

A South American ransomware group known as Lapsus$ has been connected to cyberattacks on prominent targets. The cyber gang is well-known for extortion, threatening the publication of private data if its victims don't comply with its demands. The organization has claimed of getting into companies including Nvidia, Samsung, and Ubisoft. The gang masks malware files as legitimate ones by using stolen source code.

How to Protect Against Ransomware

Utilize Best Practices

An effective plan may significantly reduce the cost and effects of a ransomware attack. Adopting the recommended practices listed below can lessen an organization's vulnerability to ransomware and lessen its effects:

Cyber Awareness Training and Education: Phishing emails are a common method for spreading ransomware. It is essential to educate people on how to recognize and prevent possible ransomware attacks. User education is frequently seen as one of the most crucial defenses a company can employ, since many modern cyber-attacks begin with a focused email that does not even include malware but merely a socially engineered communication that tempts the user to click on a harmful link.

Continuous data backups: According to the definition of ransomware, it is software created so that decrypting encrypted data requires paying a ransom. A company may recover from an assault with little to no data loss and without having to pay a ransom thanks to automated, secured data backups. A crucial procedure for preventing data loss and ensuring data recovery in the case of contamination or disk hardware failure is maintaining frequent backups of data. Organizations may recuperate from ransomware attacks with the assistance of functional backups.

Patching: In order to guard against ransomware attacks, patching is essential since hackers frequently search the patches for the most recently discovered exploits before launching assaults on unpatched systems. Because fewer possible vulnerabilities exist within the company for an attacker to exploit, it is crucial that firms make sure all systems have the most recent fixes deployed to them.

User Authentication: Attackers using ransomware frequently exploit stolen user credentials to access services like RDP. A strong authentication process can make it more difficult for an adversary to utilize a password that has been guessed or stolen.

How NDR Is Revolutionizing Cybersecurity

Network Detection and Response (NDR) is an exploding field of cybersecurity, providing network-wide monitoring and advanced detection of potential malicious threat actors and suspicious activity, that other tools may miss. An NDR solution continuously scans all entities of network traffic while creating a baseline of normal network activity, creating an incredibly difficult environment for attackers to hide within.

NDR stands out in the market due to its advanced suite of technologies used for detecting suspicious and malicious traffic, such as deep learning, AI, heuristic analysis, and machine learning.

Gartner created the NDR category in 2020, changing the name from its previous, “Network Traffic Analysis” due to the ever-increasing size and scope of data expansion across the cloud. The larger the networks, the longer threat actors can remain hidden without triggering alerts. NDR can detect and contextualize these problems via analytical techniques such as machine learning for threat detection, from the collection of telemetry data. NDR solutions create a resilient shield against zero-day attacks while utilizing sophisticated software to spot and anticipate potential threats before they surface, by analyzing all traffic flows at once.

The Beginning

Network traffic has been monitored for quite some time, but as the sheer amount of data dramatically increased, many organizations could not quite reel in the same insight they once relied on, leading to a new set of issues.

As technology evolved and systems began to manage the seemingly never-ending waterfall of data, Network Traffic Analysis (NTA) was utilized to provide analysis and behavioral tracking of network traffic for computer security. While NTA is still in-use within Security Operations Centers (SOCs), the market has evolved to open up to more advanced necessities and capabilities, such as those that NDR provides.

Advanced behavioral analytics, machine learning, and AI all form the primary backbone of NDR solutions enabling improved detection abilities, accurately determining threat risk levels, and automating manual tasks routinely performed by analysts, allowing them to focus on triage and rapid response maneuvers. Machine learning gives way to sophisticated detection of “known unknown” cyber threats and new zero-day threats “unknown unknown”

known-unknown: dangers that the company is aware of but whose extent and impact are unknown.

unknown-unknown: threats that the business is not even aware it is unaware of.

Why do I need Network Detection and Response?

Security Information & Event Management (SIEM) and Endpoint Detection and Response (EDR) are crucial tools, but not the end-all-be-all to protecting your organization. NDR fills the gaps to augment and help provide a fully comprehensive security monitoring platform, especially with IoT and cloud computing enticing threat actors to make their move now more than ever.

More traditional detection-focused solutions are using signature-based detection methodologies, which work to identify a threat while a security analyst is alerted. Next, incident response is performed, but only after the attack is successful, which could leave your network compromised by quick-moving, seasoned threat actors. These solutions alone, place your organization at major risk, relying on reactive measures rather than proactive approaches. NDR uses machine learning and automated response to accurately predict and remediate incoming intrusions before an attack has been fully launched, potentially saving your data.

According to ExtraHop, “What's more, while attackers may be able to fool firewalls and traditional IDS by masquerading as legitimate users and services and avoiding signature-based detection, they can't escape NDR. That's because it's almost impossible for them to avoid certain key activities on the network, which NDR can detect. It enhances rules-based detection with machine learning technology to model the behaviors of entities on the network and contextually identify anything that resembles known attack techniques. That means even legitimate-seeming processes may be flagged if their appearance seems unusual.”

Proactive Approach

Cybercriminals have more advanced tools at their disposal than ever before, even accessing nation-state-level tools.

“Tools developed by nation-states have made their way onto the black market many times. An infamous example is the Eternal Blue exploit, which was used by the WannaCry hackers,” comments Ian Pratt, Global Head of Security, Personal Systems, HP Inc. “Now, the return on investment is strong enough to enable cybercriminal gangs to increase their level of sophistication so that they can start mimicking some of the techniques deployed by nation-states too.

NDR provides a safety net against highly pervasive and sophisticated threat actors, providing a deeper level of security than EDR & SIEM together.

Logs and Endpoint Security Aren’t Enough

SIEMs and other endpoint tools are showing glaring weaknesses in detecting threats that are not simply malware-oriented, leaving lateral movements, such as stolen credentials, potentially undetected.

Furthermore, SIEM reporting can be unbelievably frustrating and complex, leaving only trained SIEM specialists with the ability to accurately determine actionable insights. Non-tech-savvy members of your organization would have immense trouble understanding reports which make for confusing strategies and communication gaps.

According to a NetWrix national survey, 63 percent of survey respondents said that they had difficulty understanding the reports output by their SIEM and a further 53 percent reported that they had to manually tweak their SIEM reporting so that non-tech stakeholders could understand.

IoT Needs Sophisticated Protection

IoT devices do not possess the computing ability or just are too small, like your Nest Thermostat, to run security protocols. Cyberattacks on these devices could lead to critical losses because of immediate physical concerns, such as the loss of front-door lock access or home-security take-over. Many of these devices are used in healthcare for patient vital monitoring and other high-risk situations. IoT devices are generally used throughout a large, interconnected network, with many also being portable, leading to the potential exposure of multiple networks.

Many users possess 10 or more interconnected IoT devices, challenging analysts and professionals in managing the complex web of connected features and configurations. NDR empowers organizations to manage these devices by overseeing their network activity, rather than focusing on each individual device’s software.

Context Matters

NDR solutions provide context-rich insights into your network, painting a full picture of all activity, including important questions:

Which users are on your site?
What devices are they using?
Where are they accessing from?
What data are they sharing?

NDR forms a powerful team when used in conjunction with a SIEM to provide rich context and validation to detections made within each tool.

Final Thoughts

NDR can be a lighthouse to organizations struggling to maintain a coherent, complete picture of their cyber environment, due to its state-of-the-art ability to detect incoming threats and anomalies that other tools inevitably miss. From behavioral analytics and machine learning to threat response automation, with the addition of NDR, your organization is better protected from evolving threats.

How Do Biometrics Affect Cybersecurity?

Biometrics 101

Biometrics utilize your physical characteristics to assess identification matters such as fingerprint scans, facial recognition, retina scans, etc. as a more advanced sector of security. Biometrics is simply defined as a biological measurement or a unique physical characteristic that not even your twin would share. Think of it as you, yourself, being the password.

The biometrics industry has experienced massive growth and momentum over the last decade as more and more cyber-attacks have placed companies in a position to think through more advanced, alternative security measures such as biometric identification. Totaling upwards of $68 Billion in just five years, this industry doesn’t show signs of slowing.

Let’s dive deeper into the benefits but also the potential hidden dangers of biometrics in cybersecurity.

Three Types of Biometric Security

Biometric security can be grouped into three main subcategories such as:

Biological biometrics
Morphological biometrics
Behavioral biometrics

Biological biometrics are exactly what they sound; using your biological makeup to use as identifiers for security purposes such as your DNA, tested through fluid samples.

Morphological biometrics are most commonly used via your laptops, phones, tablets, etc. which include your physical traits like fingerprints and eye/facial shape, which are mapped through different types of security scanners.

Behavioral biometrics include your walk, speech, and other purely behavioral traits exhibited on a daily basis that give way to succinct patterns. Similar to how interrogators use small microaggressions such as the twitch of a nose, or the quiver of a lip for hints of false testimony.

Examples of Biometric Security

While there are many different forms, here are some more common examples:

Voice Recognition
Fingerprint Scanning
Facial Recognition
Iris Recognition
Heart-Rate Sensors

Odds are, you have run into many, if not all these biometrics at one point or another, whether that be at the hospital or just using an electronic device. Biometric security can be used in a plethora of different applications from a simple fingerprint scan to access a phone, to the protection of nuclear systems via multiple advanced biometrics such as retina/iris scans.

Biometrics has seen a stratospheric rise in adoption over many different industries recently, such as:

Government
Border Control
Identity Management
Education
Private Sectors
Call Center Facilitation
Health Care
Pubs & Clubs

While the adoption rates rise, the costs begin to drop for biometrics as to allow mid to small business use and even individual applications are being seen in the market. In days past, only the most high-end phones were equipped with fingerprint scanners but now even the $75 models come fully equipped with this setup. Biometrics are becoming an integral part of everyday life and it seems only inevitable that most businesses will adopt this ideology as well, even on the smallest scale.

But, Are They Safe?

Passwords are forgotten every day, subsequently, they are changed just as often, but biometrics stay with you for your lifetime and are unable to be “changed”, so does this mean they are foolproof? Well, not exactly, but extremely close.

A biometric such as your handwriting or signature can not be stolen, but it can be learned by someone willing to take the time. Similarly, a physiological biometric like face mapping can be stolen through a photograph or some other illegally obtained means of duplication, while this is just a copy, it could still pose potential issues. Even though these biometrics can, in theory, be “stolen”, that does not mean instant access for your attacker since most systems use what’s called “liveness tests”. These tests help prevent and reject any samples of duplicated information such as fingerprints obtained on a piece of tape, or using a photograph of your target to gain entry.

Many devices and systems have taken extra precautions against the examples listed above; take LG for example. They combine facial and voice recognition along with a heartbeat sensor to ensure a copy of a fingerprint can not be used in the same manner as a live person. The real challenges lie in solely facial scanners which have been successfully tricked by researchers and attackers alike.

Researchers at the University of North Carolina set up an experiment to hack into facial recognition systems by downloading social media images of the volunteers and using them to construct 3D models of their faces, ultimately breaking into 4 out of 5 systems; a 90% success rate.

Cloning fingerprints can be done reliably, cost-effectively, and rather quick as a demonstration at the Black Hat Cybersecurity conference showed duplicating a fingerprint using molding plastic or wax in as little as 10 minutes. Biometrics may be the way of the future, but that certainly does not expel risk.

One more example of that aforementioned risk presented itself after the release of the Iphone 5, when members of the group, Chaos Computer Club, successfully bypassed the new fingerprint scanner by simply photographing the target fingerprint on a glass surface and then using it to unlock the phone. Obviously, technology has well evolved since the Iphone 5’s release, but with that comes the evolution of hackers and attackers hoping to create new ways to slip by these biometric systems.

Biometric Data Security Concerns

The more mainstream adoption of biometrics comes with a few data security concerns attached to it. Cybercriminals aim to get their hands on as much personal data as possible and these biometric systems host exactly the kind of information that attackers seek. In 2015, the US Office of Personnel Management was hacked, exposing upwards of 5.6 million fingerprints of official government employees, essentially leaving their identities unlocked for anyone to steal.

Best practices for storing this type of data result in housing this information on a single device rather than a database no matter the level of encryption, as hackers can breach a system and take any and all data that is not properly secured, whereas breaching a single devices information is much more difficult.

Ways to Protect Biometric Identity

Biometric authentication should not be your sole means of protection as multiple means can dramatically increase the safety of your information, such as “liveness tests” like blinking that aren’t able to be duplicated or machined.

Even more advanced systems have begun implementing add-on features for enhanced security such as age, gender, and height to increase the difficulty of obtaining all of this information legally.

Two-factor authentication layered with biometric initial access can be a powerful combination and one that is recommended for secured internet devices as to lessen vulnerability.

Takeaways on Biometrics

Overall, biometrics continue to dominate the market and look to drastically increase security of systems through combinations of physical/behavioral scans along with other authentication. Utilizing simple, character-based passwords, are becoming a thing of the past as biometric technology continues to evolve.

Do you trust biometrics and the new realm of biometric tech? Let me know in the comments.

Cybersecurity Awareness Month | October 2022

Starting 18 years ago, cybersecurity awareness month has magnified into a global effort to educate, inform, and empower everyone to protect themselves online as cyberthreats continue to see dramatic increases over the past decade. As our livelihoods shift predominately online, we become more vulnerable to prying eyes and malicious threat actors. This collaboration between the National Cybersecurity Alliance (NCA) and The Cybersecurity and Infrastructure Security Agency (CISA) helps to limelight crucial tips and steps to remain vigilant wherever you go online.

Here is an excerpt from CISA on this year’s CAM theme:

“This year’s campaign theme — “See Yourself in Cyber” — demonstrates that while cybersecurity may seem like a complex subject, ultimately, it’s really all about people . This October will focus on the “people” part of cybersecurity, providing information and resources to help educate CISA partners and the public, and ensure all individuals and organizations make smart decisions whether on the job, at home or at school – now and in the future. We encourage each of you to engage in this year’s efforts by creating your own cyber awareness campaigns and sharing this messaging with your peers.”

This year’s theme centers on the individual rather than just large companies and organizations to place importance on the role we all play in creating safer online environments. Here are 4 steps that EVERYONE can take, no matter your expertise in cybersecurity:

1. Enable Multi-Factor Authentication
2. Use Strong, UNIQUE passwords
3. Report Suspicious Emails and Activity
4. Keep Your Software Updated

What YOU CAN Do

“When we say See Yourself in Cyber, we mean to see yourself in cyber no matter what role you play.” - CISA

You may not have a role in IT or cybersecurity whatsoever, and you may be the least technologically savvy person in your family, but you still have the ability to safeguard your personal and private data!

Here are some tips from the U.S Securities & Exchange Commission:

• Be Careful What You Download. When you download a program or file from an unknown source, you risk loading malicious software programs on your computer. Fraudsters often hide these programs within seemingly benign applications. Think twice before you click on a pop-up advertisement or download a "free" game or gadget.

• Use Your Own Computer If You Can. It's generally safer to access your online brokerage account from your own computer than from other computers. If you need to use a computer other than your own, you won't know if it contains viruses or spyware. If you do use another computer, be sure to delete all of the your "Temporary Internet Files" and clear all of your "History" after you log off your account.

• Don't Respond to Emails Requesting Personal Information. Legitimate entities will not ask you to provide or verify sensitive information through a non-secure means, such as email. If you have reason to believe that your financial institution actually does need personal information from you, pick up the phone and call the company yourself - using the number in your rolodex, not the one the email provides!

Security Tip: Even though a web address in an email may look legitimate, fraudsters can mask the true destination. Rather than merely clicking on a link provided in an email, type the web address into your browser yourself (or use a bookmark you previously created).

• Be Smart About Your Password. The best passwords are ones that are difficult to guess. Try using a password that consists of a combination of numbers, letters (both upper case and lower case), punctuation, and special characters. You should change your password regularly and use a different password for each of your accounts. Don't share your password with others and never reply to "phishing" emails with your password or other sensitive information. You also shouldn't store your password on your computer. If you need to write down your password, store it in a secure, private place.

• Use Extra Caution with Wireless Connections. Wireless networks may not provide as much security as wired Internet connections. In fact, many "hotspots" reduce their security so it's easier for individuals to access and use these wireless networks. Unless you use a security token, you may decide that accessing your online brokerage account through a wireless connection isn't worth the security risk.

• Log Out Completely. Closing or minimizing your browser or typing in a new web address when you're done using your online account may not be enough to prevent others from gaining access to your account information. Instead, click on the "log out" button to terminate your online session. In addition, you shouldn't permit your browser to "remember" your username and password information.

Use your voice this October to advocate for a better understanding of safe, online practices, whether that be to your family, via social media, co-workers, etc. YOU can make a difference in the safety of others online.

Machine Learning and AI in Cybersecurity

Artificial intelligence (AI) and machine learning are positioned to assist today's enterprises as they fight to defend themselves against the rising number of cyber attacks.

Real-time learning and analysis of potential cyber risks is made feasible by AI and machine learning. Additionally, they use computers to create behavioral models, employing these models to forecast cyberattacks as new information becomes available. By accelerating and improving cybersecurity responses, these technologies work together to help businesses strengthen their security defense.

An Effective Tool for Combating Cyber Attacks

Cyberattacks have increased as more firms adopt digital transformation strategies. According to the Identity Theft Research Center, 2021 has been a record-breaking year in the U.S., with the number of data breaches at the end of the third quarter surpassing all of 2020 by 17 percent. Likewise, ransomware assaults have been rising alarmingly, with the typical incidence costing businesses over $700,000. Today, a ransomware assault occurs every 11 seconds, causing a 21-day company outage average.

AI and machine learning can guard against these advanced threats, which hackers are using to shut down business networks. In fact, these technologies are rapidly advancing into commonplace tools for cybersecurity experts in their continuing battle with malicious actors.

61 percent of firms said they won't be able to recognize major risks without AI, and 69 percent think it would be vital to counteract cyberattacks, according to a survey by Capgemini Research Institute. In fact, it is predicted that the market for AI in cybersecurity would reach $46.3 billion by 2027.

Finding anomalies: To find abnormalities that could be signs of an assault, AI and machine learning employ behavioral analysis and constantly changing parameters.
Future data breaches can be predicted thanks to AI and machine learning, which allows for the processing of vast volumes of data of various kinds.
Real-time data breach response: AI and machine learning can deliver notifications when a cyber danger is discovered, or they may act independently without human assistance by automatically generating protective patches as soon as an assault is discovered.

Benefits of AI and Machine Learning

AI and machine learning are having a significant positive impact on cybersecurity programs at organizations. These consist of:

Increasing the speed of detection and response: AI and machine learning are far faster at identifying dangers than humans because they can quickly examine vast volumes of data. Furthermore, they may rapidly improve reaction times by applying fixes and removing threats in almost real-time. Todays cyberattacks may swiftly infiltrate an organization's infrastructure; thus, success depends on having razor-sharp detection and reaction times.
Lowering IT costs: AI and machine learning are efficient technologies because they need less work to detect and address cyber risks. According to the Capgemini analysis, the average cost reduction is 12 percent, with some firms achieving cost reductions of more than 15 percent.
Increasing cyber analyst effectiveness: By reducing the amount of time needed to manually go through data logs, AI and machine learning lighten the strain for cyber analysts. These systems can notify cyber analysts of an assault while categorizing the attack's nature, better enabling them to respond appropriately. Cyber analysts are more capable of handling even the most complicated risks with less manual work when behavior patterns are continuously and thoroughly analyzed.
Improving your overall security posture: As more data is reviewed and these systems learn from previous patterns, cybersecurity grows stronger with time as they become more adept at spotting questionable activities. Additionally, they safeguard an organization's infrastructure on both a global and micro level, erecting barriers that are more effective than those made by manual techniques.

Potential Uses

Although there are risks associated with AI and machine learning, their usage is only anticipated to grow in the future. These technologies have already shown themselves to be quite successful in a variety of application scenarios. The following are some typical use cases where businesses are effectively utilizing AI and machine learning:

Rapidly detect intrusions: AI is now being used by businesses to automatically and precisely identify criminal activities. Organizations are responding to incursions as soon as they happen because to machine learning's capacity to identify, evaluate, and defend against cyber threats in real-time.
Identifying suspicious behaviors: To identify questionable user activity, AI and machine learning are also applied. Organizations use machine learning to differentiate between typical behavior and aberrant behavior that may be the sign of a cyber attack in order to fix vulnerabilities until a data breach occurs. This is done by monitoring users' unexpected actions, such as when they log in at odd hours of the day or download an unusually high volume of data.
Detecting fraud: Many businesses use machine learning algorithms to anticipate anomalous client behavior in order to protect themselves against financial fraud. These technologies are assisting companies in identifying potential fraud risks before they materialize, hence minimizing their financial losses. They do this by having the swift capacity to identify if client behavior is abnormal.
Discovering malware: Organizations are using AI and machine learning to forecast malware outbreaks in the future. Cyber analysts can foresee malware assaults and quickly mitigate the danger using machine learning, which uses patterns discovered in past infections.

Planning Your Implementation

It may be tough to know where to begin when integrating AI and machine learning into one's cybersecurity strategy, which is why many firms find it problematic. As you start implementing your implementation strategy, keep the following advice in mind to get the greatest results:

Employ competent cyber analysts who are well-versed in the use of AI and machine learning and decide which jobs you want to automate and which you'd rather have handled by people.
Ascertain that you have the data sets required to start employing AI algorithms, that this data is accurate and current, and that it is properly linked with your applications and infrastructure.
Set defined success criteria for these test projects, starting with just one or two use cases that are simple to deploy and provide real value for your business.
To validate, rank, and assess possible risks, create a clearly defined methodology.
Create control mechanisms to aid you in recognizing when an AI system deviates from expected behavior so you can quickly resolve any problems.
As you integrate AI and machine learning into other aspects of your cybersecurity strategy, evaluate the outcomes of your test projects and make any required adjustments.

Powerful Tools for An Escalating Problem.

AI and machine learning are potent tools that may aid firms in becoming more prepared as the volume and sophistication of cyberattacks rise. Your firm can identify and respond to cyberattacks in real-time with the correct technologies in place, while also resolving potential risks before they become major problems. As a consequence, you can better manage the pace and scope of today's risks and discover threats sooner, for less money, and with a security posture that is stronger.

How Lumifi Can Help

We not only utilize the industry’s leading threat intelligence platforms, but also deliver personalized security recommendations through scheduled calls with a dedicated Engagement Manager. Our suite of services allows you peace of mind knowing your organization is being monitored around the clock by an industry leading SOC which takes pride in its customers' security.

NetWitness Announces New Managed Detection and Response Service

Small to mid-size enterprises can now leverage more comprehensive threat detection & response technology delivered remotely.

September 21, 2022 09:00 AM Eastern Daylight Time

BEDFORD, Mass.--(BUSINESS WIRE)--NetWitness, a globally trusted provider of threat detection and response technology and incident response services, today announced the availability of a new Managed Detection and Response (MDR) service to enable companies to leverage NetWitness for expanded cybersecurity in a fully outsourced model. The new NetWitness MDR Service helps customers address the ongoing cyber skills shortage while keeping their organizations well-protected from attacks by combining technology, planning, training, and managed detection into a single, complete offering.

“It’s a natural evolution to offer an MDR service that assures effective detection and response 24/7, so customers receive the maximum benefit of the NetWitness Platform XDR solution, all the time.”

Ultimately, the success of cybersecurity depends on the availability of skilled security analysts and threat hunters, a major challenge due to an ongoing skills shortage. According to the (ISC)2 Cybersecurity Workforce Study, 2021, there’s a worldwide gap of over 2.7 million cybersecurity professionals.

“NetWitness delivers outstanding security visibility, threat detection and response,” said Tod Ewasko, Chief Product Officer at NetWitness. “Yet, cybersecurity also requires experienced and skilled professionals, especially for powerful tools like NetWitness XDR. As customers struggle with the current staffing and skills shortages, trusted services like NetWitness Managed Detection and Response and Incident Response offer a winning strategy.”

“We’ve worked shoulder-to-shoulder with NetWitness customers for decades, helping them respond to ever-more-dangerous incidents,” said David Gaik, Senior Director, NetWitness Professional Services. “It’s a natural evolution to offer an MDR service that assures effective detection and response 24/7, so customers receive the maximum benefit of the NetWitness Platform XDR solution, all the time.”

Customers increasingly request an MDR service that works closely with NetWitness XDR. In this focused model, NetWitness provides customized offerings that deliver whatever organizations need: skilled security analysts who connect directly to a NetWitness Platform XDR infrastructure to perform critical functions including threat hunting, incident management, even system administration and upgrades. Internal staff are freed to do strategic activities like planning and systems hardening.

The NetWitness MDR service is an ideal solution for mid-size or smaller enterprises that seek to partner with trusted analysts and threat hunters that deliver world-class cybersecurity on a proven XDR platform. It is initially available in the U.S. and Canada in conjunction with Lumifi Cyber, a premier provider of managed detection, located in Scottsdale, Arizona. Clients outside North America may be serviced by a different NetWitness certified partner.

To learn more about the new NetWitness MDR service, visit netwitness.com.

About NetWitness

NetWitness, an RSA® Group Business, provides comprehensive and highly scalable threat detection and response capabilities for organizations around the world. The NetWitness Platform delivers complete visibility combined with applied threat intelligence and user behavior analytics to detect, prioritize, investigate threats, and automate response. This empowers security analysts to be more efficient and stay ahead of business-impacting threats. For more information, visit netwitness.com.

About Lumifi

Lumifi is a managed detection and response (MDR) services provider of enterprise-grade security for companies of all sizes. They use NetWitness Platform XDR to deliver continuous end-to-end protection against ransomware and the latest security threats. Their state-of-the-art Security Operations Center is staffed by a team of US-based analysts, ex-military and former DoD security experts to continuously monitor and manage customer environments. For more information, visit lumificyber.com.

©2022 RSA Security LLC or its affiliates. All rights reserved. RSA and the RSA logo are trademarks of RSA Security LLC or its affiliates. For a list of RSA trademarks visit https://www.rsa.com/en-us/company/rsa-trademarks. Other trademarks are trademarks of their respective owners. RSA believes the information in this document is accurate. The information is subject to change without notice.

Cloud Attacks: Are You Still Safe?

Cloud Attacks: Are You Still Safe?

95% of respondents are using the cloud, according to the 2016 State of the Cloud Survey. The nature of cloud-based computing offers the prospect of severe cloud security breaches despite its fast expansion, which can significantly harm an enterprise. One of the top worries is data security.

How can IT administrators maintain flexibility, data access, and innovation while still protecting themselves (and their companies)?

Let's look at 7 recommendations to protect your company against cloud security concerns.

1. Educate your employees.

There is a simple reason for the security concerns in the majority of organizations: unaware staff. You may reduce risk and stop cloud security risks by educating your personnel on suitable protection techniques:

Include the entire organization. Employees are more inclined to own up to their responsibilities regarding security measures when they actively participate in safeguarding corporate assets. Engage the whole staff in security training and inform them of future best practices.

Make a plan. Establish a reaction plan in case staff members believe their privacy has been violated. To ensure that users are always ready, create a document that outlines the actions they should do in various circumstances.

Conduct ad hoc security testing. It's crucial to educate your staff, but only if they remember the knowledge.

2. Secure a data backup plan.

The risk of irreversible data loss is increasing as the cloud develops. A secure backup of such data should be prepared for anything.

For enhanced security, IT administrators should spread data and applications over several zones and follow industry best practices for disaster recovery, offsite storage, and regular data backup.

3. Encryption Is Critical

For protection, cloud encryption is essential. It enables the encryption of text and data before it is uploaded to a cloud storage system.

Find out from your provider how data is managed. You may encrypt at the network's edge to guarantee the security of your data before it leaves your company, guaranteeing the transit of data in the cloud is safeguarded. Keep the encryption and decryption keys after the data has been encrypted. If you have both of these, any demands for information will require the owner's involvement even if the data is kept by a third-party supplier. Avoid storing encryption keys in the program that houses your data. IT departments must maintain physical control over encryption.

4. Passwords Matter

Considering that passwords are used to encrypt and compressed data, selecting one carefully is crucial. 90% of passwords can be broken in a matter of seconds.

According to Duncan Stewart, director of technology for Deloitte Canada, "passwords having at least eight characters, one number, mixed-case letters, and non-alphanumeric symbols were originally regarded to be strong." However, with the development of advanced technology and software, these may be readily hacked.

Despite the propensity for password reuse caused by our limited capacity to recall complicated credentials, avoid taking that risk. Create unique, distinctive passwords to fend against hackers.

5. Test, Repeat, Test Again

Think like a criminal while putting safeguards in place to secure your cloud. Penetration testing, a process in IT security intended to find and fix vulnerabilities as well as reduce cloud security risks, is one of the best ways to do this.

Here are some things to remember:

Be careful to alert your cloud provider before starting a penetration test because it resembles an actual assault.

Make a list of the things you need to test, such as servers and apps, and assess your weaknesses.

Keep in mind that internal dangers are just as likely as external ones when you develop your cloud penetration testing strategy.

Cyber Corruption: LAPSUS$

What do Microsoft, Okta, T-Mobile, Nvidia, and LG all have in common? Well, for starters, they have all been extorted by one of the most prolific and unpredictable hacking groups of 2022.

The group coined, LAPSUS$, remarkably infiltrated and extorted a handful of the largest, pre-imminent tech giants in the world through a unique approach of SIM-swapping, social engineering, malware, and other means to enact their financially-driven motives, such as threatening the public release of proprietary data or simply dumping private data on their digital channels for all to see which certainly separates them from other “successful” hackers and groups of the last several years, not to mention they may all be between 16-21 yrs. old.

Let’s take a deep dive into the psyche of LAPSUS$ and what exactly makes them so dangerous, yet so bewildering.

Who Is Truly Behind LAPSUS$?

Uncovering the leader or “brains of an operation” can culminate in immense understanding and ultimately dismantling of a criminal organization, but unfortunately, this cohort seems to work in a decentralized manner, closer to chaos than order. Some of the infamies certainly arise from their childish antics, leading to assumptions of inexperience.

The list of high-profile attacks would be enough for most cyber criminals to “hang it up” and relinquish to the dark recesses of the internet to preserve earnings and evade detection, but LAPSUS$ touts these victories via a public “Telegram” channel as well as polling viewers on their next “hit”. The social community seems to be the bread and butter of this group, alluding even further into their adolescent composition.

The LAPSUS$ group hit headlines in December of 2021, with a barrage of attacks against South American companies, including Brazil’s Ministry of Health and other government agencies in the area, before expanding their scopes onto larger, multinational companies to truly catapult into the limelight. At this point, the group had the full attention of the cybersecurity community and didn’t intend to squander it.

Fame and fortune stood around the corner as the group shifted to the pillars of international tech giants as their next prey, hoping to utilize their immense influence and coverage to the group’s advantage.

As stated via their Telegram channel, LAPSUS$ negates any state or political motives for their extortion attacks, leading some to question the seemingly randomized actions of the group. Is there a collective goal beyond notoriety and wealth?

How Does LAPSUS$ Operate?

Microsoft released a ground-breaking report in March of 2022, outlining LAPSUS$’s operational inner workings with speculation on how they were able to extort the largest tech giants in the world. The report did not divulge the members of the group, but rather their model of pure destruction and social engineering methodologies used to extract data from even the most secure of systems.

While the group may be comprised of juvenile counterparts, Microsoft repeatedly spoke on the intricate, elaborate, and downright cunning methods used, similar to the most mature threat actors.

Let’s take a look at their strategies.

Telegram Channel

LAPSUS$ proved time and time again, that they are to be taken seriously regardless of the make-up of their group, forcing C-suite cybersecurity executives to take notice swiftly. Microsoft stated they tend to gain seemingly impossible access via “social engineering” involving the bribing of employees at targeted locations within customer support call centers and/or various help desks.

Microsoft wrote, “Microsoft found instances where the group successfully gained access to target organizations through recruited employees (or employees of their suppliers or business partners)”

LAPSUS$ recruits “insiders” via social media channels since the beginning of their attacks, using nicknames such as “Oklaqq” and “WhiteDoxbin” to name a couple. These recruitment posts offered upwards of $20k/week to informants employed within companies like AT&T, Verizon, and T-Mobile. Their message was simple, just get us in the door and we will do the rest.

SIM-Swapping Method

SIM swapping is most simply described as transferring one’s mobile phone number (the target) to another device owned by the hacker. This opens the doors for attackers to receive those unique one-time codes & passwords for easy access to protected systems, while potentially gaining the ability to reset passwords for total control.

“Their tactics include phone-based social engineering; SIM-swapping to facilitate account takeover; accessing personal email accounts of employees at target organizations; paying employees, suppliers, or business partners of target organizations for access to credentials and multifactor authentication (MFA) approval; and intruding in the ongoing crisis-communication calls of their targets,” Microsoft explained.

Unit 221B, an advanced cybersecurity consultancy from New York, shadows cybercriminals performing SIM-swapping as well as keeping tabs on members of LAPSUS$ before their group ever formed (and still does). The group’s techniques, while wildly effective, are not unique, as this form of SIM-swapping has been heavily focused on within major phone companies for many years. Allison Nixon, Chief Research Officer of Unit 221B, exclaimed, “LAPSUS$ may be the first to make it extremely obvious to the rest of the world that there are a lot of soft targets that are not telcos,” Nixon said. “The world is full of targets that are not used to being targeted this way.”

The group also employs a malicious malware program called, “RedLine Stealer” or simply “RedLine”, which can be found on hacker forums for purchase and is commonly used for theft of information and infection of entire systems. Logins, passcodes, autofill data, and even stored payment info can be uncovered and extracted to access a plethora of personal accounts such as:

Social Media
Email
Banking
Crypto wallets, and more

RedLine Stealer was once again put into action by LAPSUS$ against Electronic Arts (EA), threatening to reveal 780 GB of proprietary source code, unless a hefty payment was received. The hackers revealed they gained control of EA’s data via authentication cookies purchased from the dark web in a marketplace called, Genesis.

“The existence of this leak was initially disclosed on June 10, when the hackers posted a thread on an underground hacking forum claiming to have EA data, which they were willing to sell for $28 million. The hackers said they used the authentication cookies to mimic an already-logged-in EA employee’s account and access EA’s Slack channel and then trick an EA IT support staffer into granting them access to the company’s internal network,” wrote Catalin Cimpanu for The Record.

Social Engineering & Corporate Extortion

Social engineering attacks work by stealing credentials that allow for data theft and other debilitating means via psychological manipulation of individuals to release critical data to attackers. Microsoft stated LAPSUS$ received “intimate knowledge” of various companies through these tactics allowing them unbelievable front-door access to systems.

LAPSUS$ was known to frequently dial help desks, sometimes bribing or tricking employees into resetting critical account information, and then learning how they handled these security invasions by listening in on comm channels like Teams and Slack. The group used this “training session” to truly understand the methods and protocol these organizations went through to deter the very attack the group planned to carry out. This insider knowledge allowed them to circumnavigate all security points and remain hidden within the system while formulating further plots for extortion.

Microsoft released a statement, “The group used the previously gathered information (for example, profile pictures) and had a native-English-sounding caller speak with the help desk personnel to enhance their social engineering lure. Observed actions have included DEV-0537 answering common recovery prompts such as “first street you lived on” or “mother’s maiden name” to convince help desk personnel of authenticity.”

Initial access is granted through various methods, such as using RedLine, searching public code repositories, and even purchasing remote access credentials via the dark web. Of course, more straightforward approaches such as directly paying employees for access also proved worthwhile.

Multi-factor authentication seems like a safeguard with minuscule security lapse but LAPSUS$ manages to override these systems through session token replay and even repeatedly spamming account holders with MFA prompts after they successfully gained the password. The hacker group stated in their Telegram chatroom, that upon targeting users during the middle of the night with MFA prompts, their success rates were much higher, since people tend to simply select, “Accept” rather than be interrupted during their precious hours.

Data Harvesting and VPNs

Virtual private networks, also known as VPNs, are another key on the keychain of LAPSUS$, which utilized them in a way that prevented any “impossible travel alerts” from being triggered within the system. These alerts, connected to cloud monitoring services, detect any suspicious activity of all users and logins, making notes on any consecutive login attempts from let’s say Colorado and then another from New York, 5 minutes apart. Hence, the “impossible” nature since one person could not possibly access a system quickly from these locations. Bypassing this feature is a critical step to remain hidden long enough to exfiltrate target data.

Microsoft reported, “DEV-0537 has been observed leveraging access to cloud assets to create new virtual machines within the target’s cloud environment, which they use as actor-controlled infrastructure to perform further attacks across the target organization.”

Once inside, LAPSUS$ had the power to knock out the business from its cloud platform, giving it absolute control. Next, all inbound and outbound email was to be directed to its infrastructure where data would be harvested before the total deletion of systems. Finally, the group would either publicly unveil the stolen data or use their many extortion tactics to prevent data release.

All good things must come to an end…right?

Arrests

Bloomberg releases a breaking report stating the entire operation is being driven by a 16-year-old teenager from Oxfordshire, UK with seven arrests following on March 24th.

The 16 yr. old boy's father told the BBC: "I had never heard about any of this until recently. He's never talked about any hacking, but he is very good at computers and spends a lot of time on the computer. I always thought he was playing games."

All arrested were immediately released, pending a deeper investigation, with confirmation coming on April 2nd that two individuals were charged with connection to LAPSUS$ and the attacks of numerous tech giants.

Offenses included:

3x counts of unauthorized access w/ intent to impair the operation of or hinder access to a computer.
2x counts of fraud by false representation
1x count of causing a computer to perform a function to secure unauthorized access to a program

Both individuals are reportedly on bail with limited details available due to their status as minors.

As a cybercriminal group, letting your voice be heard can be an opportunity for increased notoriety, but also lead to increased investigation and scrutiny by law enforcement agencies around the world. The above arrests of a 16 & 17 yr. old came just days after the public unveiling of source code for mobile apps belonging to these companies on March 30th:

Facebook
DHL
Abbot
AB InBev, and others

LAPSUS$’s Payday

You might be wondering, with the insane prestige included on their “hit list”, how lined is the group’s wallet? Well, speculation has risen that LAPSUS$ has amassed upwards of $160 Million in revenue.

This finding is not concrete and has yet to be confirmed by members of LAPSUS$, but their public Telegram channel released details on their crypto wallet containing (3,790.62159317 bitcoin).

Where Are They Now?

LAPSUS$ announced via its Telegram channel, “We created a Element/Matrix chat in the case this Telegram is deleted!

We advise everyone to join it!”

This is the last known message of the group, leading to speculation of potential regrouping while finding new paths of attacks after cutting it close with law enforcement. All of these intrusions mentioned in the blog occurred during a 3-month span, so potentially the master plan was to strike hard, and strike fast while jumping out before everything came crashing down.

Let us know what you think, have we heard the last of LAPSUS$, or is this just the dawn of a new era of cybercrime?

Attack Timeline

Public WiFi: Top Dangers for Remote Work

Public Wifi & Working From Home

By 2025, upwards of 36 million Americans will have entirely remote or flexible occupations, an 87 percent post-pandemic rise, according to some analysts. One might infer that having the opportunity to work outside of the office has led many employees to select open areas like cafés, diners, railway stations, terminals, and other public locations to do their tasks, increasing the vulnerability of organizations and people to cyberattacks via the dangers of public wifi.

Cyber Attacks Are On the Rise

You may believe, "I always use public wifi, and I've never had an issue!" Yes, at least not that you are aware of. The worrying reality is that cyberattacks are increasing along with the number of remote workers, putting everyone who uses public wi-fi in danger. Cyberattacks were ranked as the fifth top risk for businesses in the public and private sectors in a Global Risk Report that was issued in 2020, and it is anticipated that they will soon move up the list. The FBI assessed the financial cost at more than $4.2 billion and recorded 791,790 complaints of suspected cyber crime in 2020, which is 300,000 higher than reported in 2019. The need to safeguard oneself against the dangers of public wifi has never been greater.

What Are the Top Dangers of Public Wi-Fi for Businesses?

Most individuals who use public wi-fi networks while working are blissfully oblivious to the danger they run of unintentionally disclosing sensitive, secret, or essential information, which might pose a serious threat in the hands of an experienced hacker. You have probably used the convenience of free public wifi. The top seven risks of using public wifi for business, nevertheless, should be taken into consideration because this is not without significant risk.

Malware, Viruses, and Worms

The forced installation of malware, commonly referred to as malicious software, on user devices is one of the main hazards you may encounter when using public wi-fi. All programming and applications developed to damage devices or intercept information fall under this general heading. Hackers can infect the public wifi network, which subsequently spreads to the connected devices. Malware may cause havoc and spy on the systems it infects and comes in a variety of ways. In contrast to worms, which may multiply independently and do much more damage, viruses are a sort of malware that propagates through a host file and are activated and duplicated by a person.

Unencrypted Connections

Hackers may track all file sharing and data transferred between the individual and the server on a public wi-fi network when there is no encryption in place. In an unprotected network, a well-positioned attacker may simply follow the network users who are logged into the router and introduce malicious JavaScript onto their equipment.

Network Snooping

Network spying, which occurs when a hacker employs malicious software on an open wi-fi network to remotely observe the behavior on a third party's laptop, is another popular attack technique. Hackers can use this method to monitor any information transmitted, including passwords, credit card numbers, and other sensitive information.

Log-in Credential Vulnerability

Weak and obvious passwords lead to log-in credential vulnerability. Ensure all of your passwords for websites, applications, and wifi networks are strong and distinctive to avoid this kind of security issue.

System Update Alerts

Hackers are continuously coming up with new techniques to take control of smartphones. False system update alerts with the ability to exfiltrate data are one cunning kind of information theft that targets Android devices.

Session Hijacking

Public wifi networks provide a platform for a practice known as session hijacking, which involves abusing a valid online surfing experience. This is another way that hackers may access a network user's device's data without authorization, making any data about your company incredibly exposed.

How Can Businesses Stay Safe on Public Networks?

You must create a solid cybersecurity plan for your web presence and apps to ensure the protection of corporate communications, sensitive data, and other assets.

Here are some strategies for protecting your company from the dangers of open WiFi:

To safeguard login credentials and add additional protection to the personal information of your users, switch your website over to HTTPS.
Install a virtual private network (VPN) to provide you with protection by establishing an encrypted tunnel for user activity with end-to-end encryption.
To prevent hackers from acquiring unnoticed peer-to-peer access, tell staff to disable Bluetooth and WiFi auto-connect.
Ensure that the firewall is always turned on for remote workers' devices.
Ensure that anti-malware and anti-sniffing software is installed on all business devices.
Encourage staff to utilize the mobile hotspot offered by their cell carrier rather than a public wi-fi network that isn't secured.
Run regular vulnerability checks to find locations where your internet infrastructure is vulnerable.
Demand that your users generate secure passwords using a combination of letters, numbers, and special characters.
Establish guidelines so that employees are aware of the risks associated with using public WiFi and how to safeguard themselves and corporate assets from criminal attackers.
To prevent hackers from acquiring unnoticed peer-to-peer access, tell staff to disable Bluetooth and WiFi auto-connect.

A Guide to Cybercrimes and How They are Disrupting Our Lives

What is Cybercrime?

Cybercrime is a term that refers to all criminal activity perpetrated using computers and the internet. It includes crimes like hacking, phishing, identity theft, and more.

The term cybercrime was first coined in the late 1980s by William Gibson in his novel “Neuromancer”. He used it to refer to crimes committed by people who used computers and networks for their activities.

In today’s world, cybercriminals are becoming more sophisticated than ever before, and they are becoming harder to catch. Cybercrimes are an ever-present threat to the public. They can be committed by anyone, anywhere, and at any time. To protect ourselves from cyberattacks, we need to have a good understanding of the different types of cybercrimes that exist and how to prevent them.

What are the Most Common Types of Cybercrime?

The most common types of cybercrimes are phishing, ransomware, and data breaches.

Phishing is a type of online fraud in which the perpetrator tries to steal personal information from unsuspecting users by masquerading as a trustworthy entity in an email or a text message.

Ransomware is malicious software that encrypts data on a computer and demands ransom payments in order to decrypt it.

A data breach is when confidential customer information such as passwords, financial information, or other sensitive documents are stolen by hackers.

Motives of Cybercrime

Some types of cybercrimes are conducted against particular devices or systems in order to injure or disable them, whereas the bulk of cybercrimes is performed in order to generate income for the offenders. Others use computers and networks to disseminate viruses, sensitive information, photos, or other types of data. Some cybercrimes carry out both of these actions; they target computers in order to contaminate them with a virus, which is subsequently transferred to more machines and, occasionally, whole networks.

Financial loss is one of cybercrime's main effects. Ransomware assaults, email and internet fraud, identity fraud, as well as efforts to acquire bank assets, credit cards, or other payment information, are just a few examples of the numerous profit-driven criminal activities that can be classified as cybercrime.

Private information about a person or company data may be targeted by cybercriminals for theft and sales.

Due to the pandemic's widespread remote work practices, it will be more crucial than ever to preserve backup data in 2022 as cybercrimes are predicted to increase in regularity.

Distinct Forms of Cybercrime

There are many distinct kinds of cybercrime, as was already explained. Although the means by which cybercriminals want to be compensated might vary, the majority of cybercrimes are committed with the purpose of earning benefits from the attackers. The following are some distinct forms of cybercrimes:

Cyberextortion: committing a crime that involves an assault or threat of an assault along with a monetary demand to put a halt to the attack. The use of ransomware is one type of cyberextortion. Here, the hacker accesses a company's networks and encrypts any potentially valuable papers and files, rendering the information unavailable until a ransom payment is made. Typically, this takes the form of a cryptocurrency like bitcoin.
Cryptojacking: an assault that uses programs to secretly mine bitcoin within users' browsers. A cryptojacking attack may involve installing bitcoin mining software on the victim's computer. However, many attacks employ Javascript to conduct in-browser mining while a user has a page or window open in their browser that is pointed at a malicious website. No malware has to be installed because the in-browser mining code is activated when the affected website loads.
Identity theft: a cyberattack that takes place when someone gains access to a computer to collect personal data from a user in order to steal their identity or get access to their valued accounts, including banking and credit cards, or both. On darknet marketplaces, cybercriminals purchase and sell identification information in exchange for financial accounts and other sorts of accounts, including webmail, streaming video and audio, online auctions, and others. Identity thieves also frequently target personal health information.
Credit card fraud: a cyberattack that takes place when hackers get into merchants' networks to obtain consumers' financial and/or credit card information. Darknet marketplaces allow for the wholesale purchase and sale of stolen payment cards, which hacking organizations may benefit from by selling to lesser cybercriminals who use the cards to commit individual account credit card fraud.
Cyberespionage: a cybercrime when a hacker infiltrates networks or systems to access private data kept by a state or other institution. Attacks may be sparked by ideology or monetary gain. Cyberespionage activities can involve any kind of cyberattack to collect, modify, or destroy data, as well as the use of internet devices, like video cameras or closed-circuit TV (CCTV) cameras, to eavesdrop on a targeted person or group, and surveil communications, including emails, text messages, and instant messages.
Software piracy: a cyberattack including the unauthorized duplication, dissemination, and use of software for either personal or commercial purposes. This kind of cybercrime is frequently accompanied by trademark violations, copyright infringements, and patent violations.
Exit scam: unsurprisingly, the exit scam, a traditional crime, has a digital iteration thanks to the dark web. In its current form, dark web admins steal from other criminals by diverting virtual cash from marketplaces escrow funds to their own accounts.

How Lumifi Can Help

A proactive approach is the best defense, and that's where Lumifi shines. Lumifi runs thousands of simulated attacks on your network and endpoint environment to identify actual security vulnerabilities before cybercriminals can compromise your system. Utilizing our next-gen MDR services, we always stay on top of your cybersecurity, so you can focus on what matters most.

Palo Alto Networks PAN-OS Vulnerability: What Users Need to Know

The flaw has been exploited in real-world attacks, but most Palo Alto customers will remain unaffected.

In the second week of August, Palo Alto Networks issued a security warning for a high-severity vulnerability in its PAN-OS operating system. Many of the company' networking hardware products use this operating system, but not all of them are susceptible.

(more…)

How to Set Up Robust Log Management in Linux with AuditD

Find out how to configure Linux to generate comprehensive log feeds for SIEM, UEBA, and SOAR technologies.

Linux is an attractive solution for enterprises in search of a flexible, powerful operating system. Many different operating systems use the Linux kernel, such as Ubuntu, Debian, and Red Hat Enterprise Linux (RHEL), which itself is an enterprise-ready extension of CentOS.

Open-source Linux distributions have a slightly different security profile than proprietary technologies like Windows. Some enterprise IT leaders choose Linux specifically for its security capabilities and low implementation costs. However, making the most of those security capabilities requires utilizing sophisticated information security technologies like SIEM, UEBA, and SOAR.

Most Linux distributions automatically collect log data on user, application, and kernel activities. Logins, file modifications, and account modifications are stored in a chronological timeline so that security analysts can review them and investigate suspicious activities when necessary.

Boost Security Performance by Configuring Log Data

SIEM, UEBA, and SOAR technologies rely on these logs to categorize and prioritize suspicious activities and automate some of the most time-consuming tasks security analysts must perform. The better and more comprehensive those logs are, the more accurate these technologies’ insights can be.

One of the best ways to access log data in Linux is through the Linux Audit System, better known through its command line name Auditd. It provides comprehensive visibility into system calls, file access, and pre-configured auditable events throughout the Linux environment.

Configuring Linux’s log collection policies will let you send better, more accurate data to your SIEM, UEBA, or SOAR platform. This significantly boosts the quality of its security performance output in turn.

How to Configure Log Management Policies in Linux with Auditd

The example we have written is for RHEL but works the same way in Ubuntu. Most Linux-based operating systems will provide for a similar process.

The goal of this configuration is to push comprehensive system logs onto the syslog directory and move them from there to a remote log management solution. This configuration does not remove any existing rules, so you can use it as a starting point for changing the default configuration. However, if you already have a robust, custom configuration, some of these rules may overwrite yours.

This is the directory you’ll be placing the configuration in...

Get our custom AuditD ruleset for your use!

Make Sure Your SIEM, UEBA, or SOAR Platform Can Parse These Logs

In our example, we’re using syslog to access the logs our policies generate. You may use syslogd or syslog-ng for the same purpose – our team would be happy to provide you with the appropriate configurations.

Instead of using a simple *.* in the master rsyslog.conf file, we prefer creating a custom file in /etc/rsyslog.d. Consider creating a file called auditd.conf and populating it like this:

if $programname contains 'audisp' then

@@SIEM_COLLECTION_IP:514 & stop

Notice that we’re using @@ to send data via TCP and specifying TCP 514 as the port. The default port for syslog is usually 601, but most systems still use UDP and TCP 514 for logs. Feel free to edit this code to fit the needs of your environment and restart rsyslog when you’re ready to effectuate the changes.

That’s it! Now, almost every SIEM, UEBA, and SOAR system on the market can natively parse the logs generated by your Linux distribution. You may now review and analyze accurate log data describing unwanted access, changes, and installations on your Linux systems.

Craft Custom Rules to Improve Exabeam Performance: Part 2

Enriched data enables analysts to conduct faster, more accurate investigations in Exabeam.

The first part of this series covered some of the ways analysts can use context to build custom rules in Exabeam. Teaching Exabeam to recognize network zones and asset groups enables security professionals to cluster similar behaviors together, making it easier to investigate suspicious activity.

(more…)

Manufacturing Case Study

Description of Pain or Challenge: Manufacturers often have a disproportionately large data environment in contrast to their in-house staff. Risks affecting supply chain and business operations pose a serious threat to manufacturers, as they can be exposed through any number of the IT systems critical to maintaining effective supply and distribution of materials. Implementing a solution that fills the time/resource gap of the security team and provides detection and response capabilities across critical assets is imperative to a successful MDR program.

Solution Overview: Competing with nearly 8 other MDR providers, Lumifi was able to offer the most comprehensive solution to address the requirements for this organization. Lumifi was able to couple their client-centric services with an ecosystem of industry leading technologies to address the primary needs of the customer.

Services Description:

24x7 Alert Monitoring and Threat Validation
Incident Remediation and Forensic Analysis
Tuning/Filtering of Alerts
Custom development of parsers, rules, alerts, API integrations, runbooks/playbooks, reports
Full management of supported technology
Automated Threat Response (SOARaaS) – complimentary to Sentinel SOAR functionality
Advisory/consulting support for detection and response strategy

Technology Description:

Microsoft Sentinel for log visibility into Microsoft services and critical applications/systems
ExtraHop for north/south visibility, lateral movement visibility, asset discovery and network connected devices, and network performance monitoring for Primary DC, remote DC’s, and AWS environment
Crowdstrike for Endpoint Detection and Response
Proofpoint for additional Email visibility and context

Legal Organization Case Study

Challenge:

The success of a legal practice requires a focus on reputation management and nurturing the relationships that exist between the firm and their clients. Compared to other industries, the legal sector has an elevated risk of cyber threats primarily due to the confidential data and sensitive client information available to an attacker. Cybersecurity is not often at the top of the priority list because offices are filled with lawyers, and not IT teams. Considering this, the challenge becomes protecting sensitive data with limited skills and resources.

Solution Overview:

For this organization with limited resources, partnering with a Managed Detection and Response (MDR) team became critical in protecting Corporate IP. The client in this study also wanted to consolidate technologies and re-platform in the cloud. Lumifi worked with the client on moving them from RSA SIEM to Palo Alto Cortex XDR with the Data Lake. Content from the de-commissioned system was ported to the new cloud-based environment. Lumifi continued working with the client as it’s MDR provider, successfully maintaining the firms security posture.

Services Description:

MDR Service for 24×7 Alert Monitoring and Threat Validation Incident Remediation and Forensic Analysis Migration of existing content package to Cortex platform Tuning/Filtering of Alerts Custom development of parsers, rules, alerts, API integrations, reports Full management of supported technology Automated Threat Response (SOARaaS) – complimentary to Palo Alto XSOAR functionality Advisory/consulting support for detection and response strategy

Technology: Palo Alto Cortex XDR with Data Lake

Financial Organization Case Study

Description of Pain or Challenge: The financial services industry is one of the more mature markets requiring cybersecurity. Smaller financial services firms typically have a limited team coupled with an advanced environment. In this case this customer was looking for an MDR provider that could be a true partner and function as an extension of their team. The Lumifi team took the time and effort to diligently evaluate and invest in the best security products for this organization. They needed an MDR provider to not only fill the time and resource gap of threat management, but also create an operationally effective security ecosystem.

Solution Overview: Lumifi was able to offer the most comprehensive solution to address this customer’s requirements through their expertise and client-centric delivery model. Delivering the MDR service through a transparent and shared environment allowed Lumifi to work with this customer’s security team to develop and execute a vision of an integrated security platform. This customer experienced a reduced time to detect, reduced time to respond, avoided false positives, and was able to save critical time and assets for their business endeavors.

Services Description: 24×7 Alert Monitoring and Threat Validation Incident Remediation and Forensic Analysis Tuning/Filtering of Alerts Custom development of parsers, rules, alerts, API integrations, runbooks/playbooks, reports Full management of supported technology Automated Threat Response (SOARaaS) – complimentary to Sentinel SOAR functionality Advisory/consulting support for detection and response strategy

Technology Description: Microsoft Sentinel for log visibility into Microsoft services and critical applications/systems Microsoft Defender for Endpoint

Security Posture Priorities

Solution Evaluation

An integral step in creating a resilient cybersecurity platform is to perform an audit of your organizations existing policies and procedures. Lumifi can help with this endeavor during our Asset Criticality Assessment, during client onboarding process, and periodically on a structured timeline.

Here are components we consider when looking at the entire security infrastructure:

Network Security
Malware Prevention
Monitoring
Incident Management
User Education
Configuration and Change Management User Access and Privileges

Tool Implementation

Once the proper solution or suite of solutions is determined, we help source, install, configure, tune and customize each solution to our customer’s needs. If a solution is already in place, we step in and begin management of the existing tool.

The following are just a few of the services we offer in this step of the process:

Cybersecurity Hardware / Software Deployments
Cybersecurity Tool Configuration, Tuning & Customization
SIEM Appliance Administration
Establishing Security Policies & Procedures
We offer managed and co-managed environments that allow our customers to maintain visibility 24/7/365 right alongside our team. Once we are up and running the with the properly deployed solutions constant monitoring through our world-class MDR service is the next step in the process.

Managed Detection & Response (MDR)

Lumifi is a leader in MDR services, recognized on Gartner’s Managed Detection and Response Market Guide and by third-party service provider lists. Often, the least considered factor in the security provider selection process in the human element. While technology is an important factor in first-class MDR, Lumifi’s biggest differentiator is its expertise. Lumifi provides the experience needed to stand out from the saturated MDR market with leadership and management having decades of experience, stretching back to before MDR was even a term.

Vulnerability Management (VM)

Discovering where you are most vulnerable is a security priority and likely already part of your overall program. The ability to continuously identify threats and monitor unexpected changes in your network before they turn into breaches is common practice.

Security programs often have the challenge of finding and retaining talent along with time restraints for proper cybersecurity processes. Lumifi can help fill those gaps. Our security staff will manage the process and help ensure your security program is successful while saving you time and money.

Email Security

Ransomware, impersonation, spear phishing; standard email-defense systems can’t protect against it all. Lumifi deploys leading email security tools to defend against routine spam and targeted threats.
Email security tools combine internally developed and third-party technologies with dozens of internal and external threat-intelligence sources. These tools simplify and automate the process of recovering email and other data within your email environment while ensuring that email systems remain 100% operational, and data is secured within. In addition to L1 and L2 support, Lumifi provides back-end integration into its MDR services to enhance visibility and reporting.

Endpoint Detection & Response (EDR)

EDR solutions take traditional antivirus tools to the next level by allowing security teams to continuously collect, track and store endpoint data. This level of detail provides analysts with the forensic granularity necessary for active threat hunting and proper incident response. Lumifi partners with leading EDR tools such as SentinelOne, Defender for Endpoint and CarbonBlack to provide comprehensive security solutions that secure customer endpoints end-to-end.

Incident Response & Threat Remediation

Cyber resilience includes recovering quickly from an attack. When Lumifi reports a verified incident, our ASOC provides recommended steps for remediation, including step-by-step instructions with procedures and escalation paths to remediate the incident.

Compliance & Reporting Support

Cybersecurity compliance is a key factor in many industries and producing the proper reports and logging protocols necessary can be cumbersome and time consuming for many organizations.
Lumifi helps companies in various industries cover compliance mandates such as HIPPA, HITECH, PCI DSS, Sarbanes-Oxley, EU GDPR, CCPA and more. Our Security Operations Center is certified SSAE 18 SOC 2 Type II and prepared to help clients of all industries meet their cybersecurity compliance requirements.

Breaking-Down Managed Detection and Response

Cybersecurity is a very important issue for any organization, and events can lead to a variety of negative outcomes; incidents often result in data theft, financial loss, and even damaged reputation. The cost of an attack is very high, which is why it's important to be prepared for the worst-case scenario. Managed Detection and Response is an outsourced array of services delivered by a Security Operations Center (SOC). These services include the detection of threats and a structured plan for mitigation and/or containment correlated over multiple cybersecurity products.

What Is Threat Hunting?

Threat hunting is the proactive approach cybersecurity organizations use to identify threats before they happen. The process includes proactively searching for adversarial activity within an organization’s computer network. A threat hunting and incident response team is responsible for finding and analyzing cybersecurity breaches and are also responsible for mitigating the risk of future breaches. Threat hunting teams work to identify potential threats before they become actual incidents which can be done through deep packet inspection, network forensics, and other techniques. They can find out what type of malware is being used or where a vulnerability exists on customers networks by proactively monitoring those networks with tools like PaloAlto Cortex, Carbon Black, Azure Sentinel to name just a few. As soon as they have identified an issue, they can take appropriate measures to resolve it before it becomes a full-fledged cybersecurity incident. Lumifi Cyber utilizes its home-grown automated threat hunting platform, ShieldVision which allows our SOC to be tool agnostic and provide proactive threat hunting to stay ahead of today cybersecurity threats.

What Is Incident Response?

Incident response (IR) is a process of responding to and containing an incident. It includes preparation, detection, containment, eradication, recovery and documentation of lessons learned. The purpose of incident response is to minimize the impact on the organization's business operations while reducing the risk of future incidents. Incident response teams should be prepared for all types of cyber threats which could include malware infections or ransomware attacks. These incidents disrupt systems and or steal sensitive data such as credit card numbers or personal information throughout the network. The goal of IR is to ensure that the data has not been compromised or exfiltrated and to mitigate the damage of future incidents.

Why Choose Lumifi?

Companies looking into MDR need to take a holistic view of their providers and their teams. Often, the least considered factor in the security provider selection process in the human element. While technology is an important factor in first-class MDR, Lumifi’s biggest differentiator is expertise. Lumifi provides the experience needed to stand out from the

saturated MDR market with leadership and management have decades of experience, stretching back to before MDR was even a term. Our approach to security is focused on a balance of custom solutions, client-centric partnerships, and proactive approaches. Lumifi has its own team of threat Content Developers, Web Developers, experienced Engineers, and seasoned Analysts to provide unparalleled proficiency. We not only utilize the industry’s leading threat intelligence platforms but also deliver personalized security recommendations through scheduled calls with a dedicated Engagement Manager. Lumifi leverages a proprietary platform called to provide leading AI Orchestration capabilities. This tool allows us to discover malicious activity within a client’s environment and then utilize that information to detect and respond across our client base who may be experiencing the same malicious activity. Our suite of services allows you peace of mind knowing your organization is being monitored around the clock by an industry-leading SOC which takes pride in its customer's security.

Simplifying SOAR

Security Orchestration, Automation and Response (SOAR) is an integrated, automated, and orchestrated set of services that provide a response to cyber incidents. It enables the rapid identification of cyber incidents and prevents them from escalating into major disasters.

SOAR was developed as a response to the need for automating incident responses and remediating security incidents. SOAR utilizes a framework that can be used by myriad organizations from small business owners to large enterprises. The process helps organizations automate security operations and enhance their security stance, integrating with tools such as SIEM, to provide a holistic view of the organization’s cybersecurity posture. It also provides a platform for Security Operations Centers (SOCs) to orchestrate the response to cyber-attacks in real time.

The Benefits of Implementing SOAR

Automating Repetitive Tasks

Human error in the workplace is the initial entry point for 95% of security incidents which inevitably leads to cloud environment compromises, according to Gartner. The high failure rate is due to repetitive manual tasks, which increase the likelihood of an oversight or mistake. Threat investigations and responses are performed faster and at scale across complex or expansive IT infrastructures with SOAR capabilities.

AI Enables New Security Initiatives to Protect Digital Infrastructure

The integration of machine learning in SOAR solutions enables the technology to dive deeperinto threats, analyze them, and gain contextual knowledge of their capabilities. The insight SOAR provides sets the foundation for fine-tuning incident response strategies to improve overall IT security.

Orchestrate Security Incidents Sent to The Expert

SOAR technology automates the orchestration process and routes security incidents to an analyst or expert with the best credentials to handle a particular incident. SOAR ensures teams get only the essential information needed to act, increasing the fidelity of threats and reducing the number of alerts.

SOAR in a Nutshell

In short, the best cybersecurity orchestration and automation solutions provide the following:

Automated security monitoring and analysis
Security orchestration
Automated response
Orchestration of third-party services
Continuous monitoring and reporting on security events.

At Lumifi, you can be certain that your organization is in capable and experienced hands, implementing the most modern SOAR techniques. Forward-moving and ever-evolving, we exist to help improve your security posture.

Contact Us Today to Learn More

Lumifi Cyber Acquires Datashield to Deliver Next-Generation Managed Detection and Response

Combines AI and Machine Learning-Based Software with MDR Services to Provide Fortune 500-Grade Security to Companies of All Sizes

Palm Desert, CA and Scottsdale, AZ — May 3, 2022 — Lumifi Cyber, Inc., a next-generation managed detection and response (MDR) cybersecurity software provider, today announced its acquisition of Datashield, Inc., an end-to-end cybersecurity resilience services provider, to deliver Fortune 500-grade security to companies of all sizes for an affordable monthly price.

Although terms of the deal were not disclosed, Lumifi’s joint offering will integrate their cutting- edge attack simulation, automated endpoint remediation and continuous threat monitoring software with Datashield’s industry-recognized MDR services, state-of-the-art security operations center and team of ex-military and former DoD cybersecurity professionals.

“Too many companies lack the security staff, tools and expertise to defend against the rise of ransomware attacks,” said Michael Malone, CEO of Lumifi. “Datashield is the perfect acquisition partner for us to deploy our recent growth capital to execute on our vision of combining always- on attack simulation with automated remediation to alleviate the cybersecurity skills gap.”

Together, Lumifi’s advanced MDR platform leverages AI, machine learning and automation to proactively identify security gaps before cybercriminals can exploit them, automatically remediate endpoint vulnerabilities to reduce the available attack surface and continuously monitor network and endpoint environments 24/7/365 to detect, contain and remediate threats.

“The threat landscape is constantly evolving, which requires continuous investments in people, process and technology to stay one step ahead of attackers,” said Jimmy Treuting, former President and General Manager of Datashield and incoming COO of Lumifi. “Our customers will only benefit from our new company’s shared culture of innovation, speed and agility.”

In order to provide peace of mind against the latest cyber threats, Lumifi will provide a turn-key cybersecurity monitoring and management solution for an affordable monthly price that delivers advanced levels of security to businesses of all sizes across regulated industries, such as energy, manufacturing, healthcare, finance and more.

About Lumifi

Lumifi is the only next-generation managed detection and response (MDR) services provider that provides Fortune 500-grade security for companies of all sizes at an affordable monthly price. Our cutting-edge platform combines attack simulation, automated remediation and continuous threat monitoring software with a proactive managed cybersecurity service that delivers continuous end-to-end protection for businesses nationwide against ransomware and the latest security threats. Our state-of-the-art Security Operations Center is staffed by our team of US-based analysts, ex-military and former DoD security experts with dozens of security certifications to continuously monitor and manage customer environments. For more information, please visit www.lumificyber.com.

About Datashield

Datashield provides end-to-end cyber security resilience solutions with a specialty in managed detection and response (MDR) services. Founded in 2009, Datashield is one of the few companies in our space that can provide true MDR to the mid-market and small-to-medium enterprises. We leverage our proprietary security automation, orchestration and response software, SHIELDVision, along with threat intelligence and core processes to generate actionable insight into advanced security threats for analysis and response. Known for our tool-agnostic, truly consultative approach, Datashield services clients across all industries, including healthcare, financial services, manufacturing, energy, government and more.

###

Everything You Need to Know About the Spring4shell Vulnerability

A newly discovered Spring vulnerability enables remote code execution on enterprise Java applications.

In late March, a developer publicly posted exploit code describing a zero-day vulnerability in the popular Spring Framework, a popular solution for building enterprise applications in Java. Spring is part of VMWare's suite of enterprise products, designed to let developers quickly and easily develop enterprise-level applications.

(more…)

Upgrade Your Audit Policies: What Should You Be Logging?

Your security response depends heavily on what data you log, and how you log it.

Your security information and event management (SIEM) solution uses logs to build an accurate picture of your organization's security profile.

(more…)

What Is Managed Detection and Response and Why Do You Need It?

The security of data and systems is one of the most important concerns in today' business world. If your data is at risk or compromised, it can cripple your operations along with the trust others have in your business.

(more…)

Is SOAR A Must For Your Tech Stack?

Security Orchestration, Automation, and Response (SOAR) tools enable analysts to establish efficient workflows for handling both common and highly sophisticated threats.

Even the best enterprise cybersecurity workflows suffer from scalability issues.

(more…)

The Necessity of Threat Hunting

Press play to get an inside look at how Lumifi works with Anomali ThreatStream. (more…)

How Fortune 200 Enterprises Select MDR Vendors

For large organizations, managed detection and response is just one of many cybersecurity solutions that must work together seamlessly.

Enterprise cybersecurity professionals have to choose their tech stack wisely.

(more…)

Tony Simone Named Exabeam's "Techical Person of the Year" for 2021

Castra Managed Services is excited to announce that its company co-founder, Tony Simone, has been named Exabeam' "Technical Person of the Year" for 2021.

Exabeam, the Gartner Magic Quadrant leader in security information event management (SIEM), held its annual Spotlight Partner Summit early last week, where various partners met to discuss industry trends and new developments in SIEM technology.

(more…)

How Data Lake and Cloud Archive Can Improve Your Security Posture

Is your business weighing out the pros and cons of data lake and cloud archive?

We can help with that.

What we need to establish first is how does your organization handle the compliance regarding your company' and customer' data? Where does that data reside? Is it secure, and if you needed to recall aging data from your system, could you do so with ease?

(more…)

The Difference Between Cybersecurity & Network Security

Today’s threat landscape is more diverse and expansive compared to any period since the beginning of the information age. Recent security trends such as the increase in malicious activities rising by 358% from July 2019 to July 2020 and 90% of healthcare organizations reporting security breaches to highlight the increased dangers enterprises face.

To effectively detect and mitigate threat factors to IT infrastructure, understanding the different features associated with delivering cybersecurity and network security is required…and yes there are differences between both. Here, the differences will be outlined including the diverse security tools that can be used to secure cyber infrastructure and enterprise networks.

What is Cybersecurity?

Cybersecurity is the processes you deploy to defend your organization’s IT architecture which includes the network, computers, and the data it produces from unauthorized access and attacks. Implementing cybersecurity measures involves the use of security tools to ensure the aforementioned assets are protected.

Enterprises that produce or store a large amount of data are more likely to experience cybersecurity incidents. Security operations centers designed to tackle cybersecurity incidents make use of tools that fall into the security orchestration, automation, and response tools and/or security information and event management solutions.

To effectively deal with cybersecurity threats, security tools are deployed to predict threat events, analyze them, and employ the right responses to mitigate threats. Enterprises with functioning IT architecture are expected to invest in cybersecurity solutions to deal with related security incidents.

What is Network Security?

Network security is a subset of cybersecurity because it focuses on protecting the data that is sent and received through your IT architecture or networks. Implementing network security to respond to incidents involves the use of both hardware and software security solutions to secure devices with access to your networks.

The security tools used to deliver network security includes anti-viruses, firewalls, intrusion detection and prevention solutions, and virtual private networks. These tools work together to limit unauthorized access to your enterprise networks and when successful breaches occur, they work to get the attacker out of your networks as quickly as possible.

Cybersecurity vs. Network Security

The definition of both security processes highlights the most important distinction between cybersecurity and network security. Using the above definition, network security is a subset of cybersecurity that focuses on securing computer networks, the data sent through them, and the devices that have access to these data.

Other important distinguishing factors that help when struggling with differentiating between cybersecurity vs. network security include:

Types of Security Threats – Networks are susceptible to attacks such as spyware and adware, denial of service attacks, viruses and worms, and zero-day attacks. Cybersecurity deals with attacks propagated through phishing, pretexting, and baiting. The personal approach cybersecurity incidents take is one reason why human error is the leading cause for successful cyber-attacks.
Security Tools Used – The security tools used to deliver network security include firewalls, intrusion and prevention solutions, network security monitoring tools, and virtual private networks. The security tools applied to handle cybersecurity threats include SOAR and SIEM tools.
Security Deployment Procedure - In many cases, network security solutions are integrated into hardware and software infrastructure by default and require regular updates while effort must be put into selecting, purchasing, and deploying the correct cybersecurity tools. It’s not all bad news though because cybersecurity services can be outsourced to providers that help with deploying cybersecurity tools.

Conclusion

Cybersecurity vs. network security is hardly a battle outside the need to understand the differentiating factors because enterprises are expected to deploy cybersecurity and network security tools to protect IT infrastructure. The solutions used to secure both cyber and network assets must be integrated into SOCs if you intend to be prepared to handle the different risks attackers throw your way.

For more information about the differences between network and cybersecurity contact us to reach one of our team members.

Strong Showing For Lumifi Partners In 2021 Gartner Magic Quadrant

With a clear separation in the market among the considered vendors, the newest Gartner Magic Quadrant for EPP, showcases 4 Lumifi partners who are leading in this space.

Recently, Gartner released their Magic Quadrant for EPP and we saw a clear separation in the market among the considered vendors. As an industry we have witnessed a rapid evolution in this space as the requirement for visibility into the endpoint has quickly expanded with the constant threat of ransomware and malware threatening to cripple organizations. Most recently, we have seen a literal arms race with a spur of recent technology acquisitions most notably by Crowdstrike (Preempt Security and Humio) and SentinelOne (Scalyr) as this space spins into the XDR realm.

At Lumifi, our primary goals are to provide quality and expert level service to our customers. As such we have been very strategic in the selection of EPP partners. We understand that not all products are created equal, and we needed partners that was forward thinking and innovative, has a customer first approach, and wanted to partner with us to provide better overall protection.

Who are Lumifi's top partners from the Gartner Magic Quadrant (GMQ)?

We are pleased to see that each of our chosen partners in the EPP space made a strong showing in this most recent iteration of the Gartner Magic Quadrant.

Microsoft (Leader)
- Partnering with Microsoft was a logical choice for our team at Lumifi. We love the interoperability of the toolsets that we use everyday namely Microsoft Defender for Endpoint and Azure Sentinel. Cloud based is key and being able to leverage the Azure data lake has obvious upside.
Crowdstrike (Leader)
- Crowdstrike continues to make a huge splash in the marketplace and we have strategically positioned ourselves to support our customers through their growth. Interesting to note is the recent announcement by Crowdstrike and another Lumifi partner Google Chronicle, to integrate the Falcon endpoint protection platform into Google Cloud’s Chronicle security analytics platform, VirusTotal Enterprise crowdsourced malware collection platform and Security Command Center (SCC) risk management platform. Read more here.
SentinelOne (Leader)
- We knew we made a good choice in partnering with SentinelOne and that was only confirmed when they absolutely crushed the most recent MITRE ATT&CK Evaluation. Read more here. A few key takeaways:
  - SentinelOne is the only vendor to deliver 100% visibility with zero missed detections across all tested operating systems.
  - SentinelOne delivered the most high-quality analytic detections to provide automated and instant context.
- VMware Carbon Black (Visionary)
  - A long time Lumifi partner, VMware Carbon Black has continued to by a mainstay in this space will continue to be so as they evolve post VMware acquisition in 2019. We see a streamlined licensing model and the integration into the VMware ecosystem and data lake a key component of success moving forward.

Conclusion

With so much movement in the first half of 2021 in the EPP space, it will be fascinating to watch the rest of the year unfold. Lumifi is well positioned for our customers with these strategic partnerships as outlined above.

What is Cyber Insurance?

Statistics show that the fallout from successful cybersecurity incidents has both financial and business-related consequences. A data breach costs the average enterprises approximately $60,000, and in extreme situations, small and medium-sized businesses may go out of business within 6 months from the date the incident occurred. Thus, to determine whether the financial cost of successful hacking attempts, businesses have turned to insurance to deal with extensive losses.

Today, cyber insurance or cyber-liability insurance is popular among enterprises with online operations. Cyber insurance is defined as insurance policies a business takes to protect itself from the fallout of a successful hacking or cybersecurity incident. The policy is a contract between the enterprise and an insurer providing financial security against cyber-related incidents. The insurance policy ensures a business receives the financial support it requires to successfully apply mitigation techniques to deal with network and IT infrastructure security incidents.

"Organizations should also consider having a third-party Security Operations Center (SOC) like Lumifi Cyber, as it often qualifies them for a discount on their policy," said Director of Product Management Mike Heller. "Many insurance companies will consider the use of a qualified outsourced SOC as means to transfer risk and provide a discount for those services."

What Does Cyber Insurance Cover?

Insurance coverage and what it covers are determined by the contract signed between the insurer and the business owner. The average cyber insurance policy is designed to provide cover for cybersecurity failures. Cybersecurity failures in this context would refer to data recovery initiatives, IT forensics, and the cost of the legal fallout from security incidents regardless of an in-house error that led to a successful system breach.

The mitigation process needed to deal with breaches differs according to the severity of the incident. In many cases, where Ransomware or business email compromise hacking techniques are used, a team of external experts may be required to handle the mitigation task to regain stolen data. In terms of BEC, security agencies may be involved with tracking the hackers behind a successful incident. The mitigation process for the above examples is expensive. Thus, insurers generally provide added paperwork for more complicated security breaches.

Cyber insurance policies sometimes cover the amount lost from a BEC hacking attempt depending on the amount lost. Coverage for BEC fraud is generally provided as a specific policy outside the standard cybersecurity insurance coverage framework. The need for exclusivity where BEC fraud is involved is once again due to the large sums, which can run onto six figures, associated with BEC scams.

Insurance companies also take diverse approaches to deal with successful Ransomware attacks. After evaluating the effect of the Ransomware attack, the insurer may determine that paying the requested ransom fee may be a more effective method of getting back sensitive data. Insurers may also choose to involve law enforcement, which comes at a cost, or bring in experts they have worked with in previous cases to deal with the situation.

What Isn’t Covered by Cybersecurity Insurance?

Cybersecurity incidents can be broad and far-reaching as they can affect both online and offline business operations. Thus, in some cases, cybersecurity insurances provide limited coverage compared to the amount of risk an enterprise’s IT infrastructure and business has been exposed to. For example, a successful Ransomware attack that becomes public can affect the finances, reputation, and intellectual property of an enterprise. Standard cybersecurity insurance policies may cover the financial cost of dealing with the attack but not the reputational damage or intellectual property is stolen or distributed on the dark web.

The limited nature of cybersecurity insurance means an enterprise that never recovers its goodwill may still go out of business despite deploying mitigation techniques to limit the damage. Losing customers is a fallout no insurance can cover as customers feel safer taking their business elsewhere.

Another grey area to be considered is cybersecurity incidents that are perpetrated by hacking farms backed by other nations. For example, the NotPetya malware attack, linked to the Russian military and similar attempts from North Korea, can be classified as acts of war by insurers. This grey area must be analyzed, and a coverage decision was taken before any insurance policy is signed. Using the NotPetya incident as an example, some insurers paid damages to mitigate risks while others stuck to the ‘act of war’ narrative, leaving the payment decision to the courts.

The grey areas within cybersecurity insurance are reasons why enterprises must thoroughly evaluate cyber insurance policies before choosing to go with an insurer.

What Does Cybersecurity Insurance Cost?

Statistics put the average cost of cybersecurity insurance in the US at approximately $1,485 per annum. This average cost does not apply to every enterprise because more comprehensive cybersecurity insurance which focuses on peculiar security incidents costs more. Insurance enterprises also evaluate the cybersecurity threat levels of a business to determine the cost of purchasing an insurance plan. Thus, enterprises susceptible to cybersecurity incidents due to the nature of the business they run are subject to more expensive insurance coverage.

The choice of purchasing insurance policies against successful Ransomware attacks or BEC fraud also comes at a cost. The value of data a company stores within its IT systems plays an essential role in deciding how much an insurer will be willing to charge for providing a policy plan against such security incidents.

Conclusion

Although cybersecurity insurance provides some help against hacking attempts, it is not a substitute for maintaining a functional security operation center and implementing compliance policies. As stated earlier, insurance may cover financial losses, but an insurance plan cannot repair hits to an enterprise’s reputation.

Top 5 Most Popular Cybersecurity Certifications

The cybersecurity analyst has become the third most valuable job description in the technology industry. The increasing security incidents to IT infrastructure, the demand for accountability from end-users, and the financial cost of successful breaches are significant reasons enterprises and startups are taking cybersecurity seriously. Ambitious professionals who choose a career in IT security are reaping the benefits of securing operating systems and deployed IT infrastructure.

Cybersecurity experts are handsomely rewarded for their efforts and are in high demand. But in an industry where standardization of skills is often proven, job candidates often must have specific certifications to obtain high-value jobs. Today, cybersecurity certifications play essential roles in highlighting a professional’s critical competencies alongside provable work experiences.

The top five popular certifications include CISSP, CISM, CRISC, AWS Certified Security, and CompTIA Security+ according to the 2020 IT Skills and Salary Report.

The Importance of Certifications in Cybersecurity

A few decades ago, anyone with a bit of understanding of computers and IT systems could label themselves as cybersecurity experts to gain access to jobs. The lack of regulation and little or no means to determine an expert’s core competencies except through informal referrals led to chaos within the industry. The rapid introduction of new threat actors and hacking tools exposed most ‘cybersecurity experts’ as under-qualified individuals with limited hands-on knowledge in dealing with threats.

To eliminate the chaos caused by inadequate validation processes, diverse organizations developed testing criteria to determine an individual’s ability to deal with all kinds of cybersecurity incidents. The testing procedure, which also awarded certifications, has become the top validation tools for enterprises hiring cybersecurity experts or firms.

Today, a cybersecurity certification is essential for different aspects of a professional’s career growth; at the entry-level where individuals with non-existent work experience intend to join the workforce, certifications highlight that the certified individual has the technical knowledge to handle cybersecurity issues. Attaining certifications gives entry-level professionals a foot into the door of a very competitive industry.

Experts who have spent years perfecting the art of identifying and mitigating cyber risks also have a lot to gain with a certification attached to their names. First, a certified expert takes professional development activities seriously. With the validation cybersecurity certifications provide, statistics show that professionals with multiple certifications earn approximately $10,000 more than those with fewer certifications.

The Top 5 Most Popular Cybersecurity Certifications

The International Information System Security Certification Consortium (ISC)²: CISSP Information Systems Security Management Professional – The CISSP is a certification provided by ISC², and it accesses an individual’s ability to design, implement, and manage best-in-class cybersecurity operations for an enterprise. The certification examination process also expects you to have completed some prerequisite courses before taking the exam.

CISSP was developed to validate the skill sets of high-level cybersecurity experts such as Chief information officers and Chief Technical Officers tasked with running the operations of a security center. Certified professionals are expected to recertify in a couple of years, and the certification provides access to leading journals, resources, and tools about cybersecurity.

ISACA Certified Information Security Manager (CISM) – ISACA is another international non-profit organization that provides certification training and examinations for the IT community. The CISM is a management-focused certification that evaluates a candidate’s understanding of both the technical and business aspects of managing a security operations center or system.

Earning a CISM validates your skill sets in setting up an operations center and managing it, thus supporting your application for management roles within the IT industry. CISM-certified professionals are granted access to cutting-edge security materials and are expected to recertify after a couple of years.

ISACA Certified in Risk and Information Systems Control (CRISC) –Properly managing a company’s exposure to risks from cybersecurity incidents ensures the affected company retains its brand reputation despite security threats. The CRISC certification validates a professional’s ability to manage IT enterprise risks and design risk-based information systems controls.

The CRISC certification is designed for risk and security managers, information control managers, and CIOs interested in validating their risk management abilities. The certification comes with an expiry date, and certified professionals are expected to renew their certifications periodically.

AWS Certified Security – Specialty: The leading provider of cloud-based services offers security certifications targeted at professionals building a career in managing AWS-built infrastructure. The AWS Certified Security certification is designed to evaluate and validate your ability to secure AWS cloud from cyber threat actors. The certification is targeted at risk and security managers, security analysts, and CIOs who intend to secure cloud infrastructure.

The certification program requires a prerequisite qualification, and certified professionals are expected to recertify in a few years. AWS-certified security professionals are in high demand due to Amazon’s dominance of the cloud infrastructure industry.

CompTIA Security+ – The CompTIA examination body is respected globally for designing programs to test the efficiency levels of IT professionals. Its Security+ certification program is designed for entry-level individuals looking to validate their understanding of IT security terminologies, tools, and operations. Thus, a CompTIA Security+ certificate should be viewed as the starting point for anyone interested in a career in IT security.

Prospective candidates do not require any prerequisite certifications to participate in the Security+ certification exam. It is also important to note that this certification fulfills the prerequisite conditions for more advanced certifications.

Conclusion

A cybersecurity certification is an excellent validation tool that confirms your technical and applicable knowledge of cybersecurity tools—getting certified increases your chances of building a career as a cybersecurity professional across every industry where IT infrastructure is deployed.

What is Ransomware?

Ransomware is a form of malware cybercriminals use to encrypt data stored in computers or online servers. Cybercriminals demand payment to release the encryption key blocking the user from accessing the encrypted data. Payment is typically made through diverse mediums, including digital currency like Bitcoin. Once payment has been made, the victim is generally provided with instructions on decrypting their data.

The Evolution of Ransomware

Ransomware has been a threat to businesses since the 1980s and has gained increasing popularity.

A significant historical event of its use was the infiltration of participants' computer systems at the 1989 World Health Organization (WHO) Conference. A Harvard-trained doctor distributed a malware tagged the AIDs Trojan, which infiltrated computers and encrypted the data of participants at the WHO event.

Statistics show a 585% increase in the use of ransomware between 2008 and 2009. The dramatic increase can be traced to hackers discovering new ways to cover the financial trail and proceeds from every successful incident. Between 2000 and 2015, transactions moved from making payments through online drugstores and shady websites to cryptocurrency.

The success of blockchain and Bitcoin led to the increase in ransomware as a primary hacking tool. By 2015 there were approximately four million samples of ransomware floating around the dark web. As ransomware usage grew, the term Ransomware as a Service (RaaS) was coined. RaaS meant that anyone with criminal intent could purchase a different strain of ransomware for about $40. The ease of accessing and using ransomware led to a 172% increase in its use as a hacking tool by 2016.

How Does Ransomware Work?

Ransomware is delivered through either an online medium of communication, hard drive, or malicious websites. Online mediums of communication refer to e-mails, instant messaging applications, or video chat rooms. Cybercriminals deceive victims by introducing ransomware in communications that appear authentic with links that install the executable files that encrypt its host system.

Unlike brute force hacking attempts where specific systems or IT infrastructures are targeted, ransomware attacks are rarely targeted at specific systems. Cybercriminals apply a generic mailing approach by blasting out Ransomware-integrated information with the hope that something sticks. Thus, employee negligence plays a vital role in successful ransomware attacks.

A successful attack doesn't always have to lead to a ransom payment; hackers view undetected access through ransomware as successful due to the ability to continuously capture important personal or enterprise-related data from the host.

The most important thing to know is that an encrypted host must be decrypted using a mathematical key native to the ransomware used. Other strains of ransomware such as leakware or doxware exist. In scenarios where both strains are used, the hacker includes threats to publish encrypted data on the dark web or social media platforms to pressure the victim to pay the specified ransom.

Effects of Successful Attacks on Organizations

The effects of successful cyber-attacks including ransomware on business enterprises have been documented and the statistics are worrying. Successful breaches to small and medium-sized business lead to an average pay-out of approximately $83,000. Although law enforcement advice against making payments, approximately 40% of business owners take the payment step with the hope of limiting the damage to their brand and finances before the breach becomes public knowledge.

Ransomware encryptions also mean enforced downtime as businesses no longer have access to business operations. According to statistics, small to medium businesses lose approximately $8,500 per hour to the unplanned downtime caused by successful ransomware attacks. Downtime may also be the least of an SMBs worry, as approximately 60% of enterprises go out of business months after successful breaches to their IT infrastructure. The fear of losing entire business units is another reason why executives are willing to pay $20,000 to $50,000 to receive a decryption key after an attack.

How to Combat Ransomware

Successfully combating ransomware requires two major approaches; an enterprise-wide approach and an individual approach. The enterprise-wide approach involves developing a security strategy that ensures every software application and operating system used for business purposes stays updated. The application of security tools such as security information and event management (SIEM) or SOAR alongside internet security software ensures system health can always be tracked in real-time.

Enterprises can also limit access to suspicious websites from computer assets. This ensures that employees do not stray or mistakenly click links that redirect to compromised platforms. Creating a dedicated backup system ensures that in the event of a successful breach, a business does not have to function at the mercy of a cyber-criminal.

The individual approach to combating ransomware starts with educating employees about the dangers associated with ransomware. Cybersecurity training introduces employees to the risks of going through informal channels when using a company's IT resources. Extensive cybersecurity training prepares everyone within an enterprise to follow company-wide policies when utilizing IT resources.

Additional solutions include email protection that can help filter out spam and phishing email as well as encrypt communications.

Beyond a managed SIEM solution, endpoint detection and response is a frontline defense for organizations. Companies like SentinelOne provide an endpoint solution that focuses on ransomware and offers a ransomware warranty.

Conclusion

Preventing Ransomware attacks is the preferable option for dealing with a successful data breach because wrong decisions can be made in the heat of the moment. Taking advantage of cybersecurity solutions such as integrating a SIEM tool with an existing security operations center ensures an enterprise keeps track of its infrastructure in real-time. In the event a successful ransomware attack occurs, the last rule is never to pay the specified ransom but to contact your security service providers and the required authorities to deal with the incident.

Microsoft Exchange Vulnerability

As you may know, a zero-day vulnerability in Microsoft Exchange Server was published last week that is garnering a lot of attention.

Microsoft has attributed this to a known threat actor that has now compromised thousands or even tens of thousands of systems with these attacks, though it's important to understand that other attackers are now leveraging these vulnerabilities for their own campaigns.

Most critically: It is possible for an attacker, once authenticated to the Exchange server, to gain access to the Active Directory environment and download the Active Directory Database.

This cannot be emphasized enough - compromise of an Exchange server could lead to a much wider compromise that will require extensive efforts to contain and remediate.

Lumifi is seeing active exploitation of this vulnerability already.

If you have Microsoft Exchange in your environment, please patch immediately and scan all Exchange servers with the latest IOCs.

We have included additional IOCs below that may not be included in your current scanning tools. Please let us know if you do have Exchange so that we can work with you for a deeper review.

(more…)

5 Do's and Don'ts to Qualify Your Next MDR

(Updated April 2022)

The success of your managed detection and response deployment hinges on asking the right questions.

Managed detection and response is a valuable element of your enterprise' security posture. With the right technologies in the hands of competent, highly trained analysts, you can significantly reduce security risks while paying a fraction of what an in-house team would cost.

(more…)

What is Penetration Testing?

A penetration test or pen test is a simulated cyber-attack against computer systems, application systems, and IT infrastructure to discover loopholes. These simulated cyber-attacks come in diverse forms with the intent of breaching a system through its servers, web or mobile applications, and other endpoints. The purpose of pen testing is to discover exploitable vulnerabilities in a controlled setting before cybercriminals take advantage of them.

Penetration testing is an IT security niche with diverse testing methods and requires a skilled tester to execute. Why attempt to penetrate your cyber systems, you may ask? The short answer is that the insight it provides can be used to patch detected loopholes, while the longer answer is what this article covers.

How Does Penetration Testing Work?

Penetration testing is a process that follows a defined pathway to gain insight into vulnerabilities. The process consists of five stages: planning, scanning, gaining access, maintaining access, and result analysis. The first four stages simulate the actions of a cybercriminal's attempt to gain a foothold within computer systems, while the last stage focuses on how IT security teams can prevent and respond to similar security incidents. The importance of these five stages includes:

Planning – The planning stage is where goals and strategies are set. Here, the system to be tested is pinpointed, and the penetration testing method or methods to be used are outlined.
Scanning – This stage involves exploring how the target application or system responds to diverse intrusion attempts. The scanning phase involves the use of scanning tools such as vulnerability scanners or network sniffers to collect datasets that provide essential information about the target.
Gaining Access – Knowledge from the scanning phase is then used to gain access to the target. Here, tools and techniques simulating attacks are used. These tools could be cross-site scripting, SQL injection, or backdoor breaching attempts to gain access into applications, servers, and systems.
Maintaining Access – Successful cyber-attacks are generally detected months after access has been gained. The slow discovery process is due to the efforts made to maintain access to a target. Thus, this phase focuses on analyzing if discovered vulnerabilities can be exploited for extended durations to gain prolonged access.
Analysis – A formal report outlining detected vulnerabilities, the vulnerabilities that were exploited to gain access successfully, and how long access was maintained is provided. The insight from the pen test report is used by security teams to patch vulnerabilities and to take a preventive approach to tackle future attacks.

Penetration Testing Methods

Five methods can be applied to test for system and firewall vulnerabilities within an IT infrastructure. These methods can be applied as singular processes or meshed together depending on the planning stage's stated goals. The five methods include:

External Testing – External testing methods target the most visible online assets of an enterprise. This includes web applications, emails, and other online platforms. The testing process involves using phishing attacks to glean data from these visible assets.
Internal Testing – The internal test method is conducted behind an application's firewall which means the attacker has either gained access to an employee's credentials or made some lucky guesses. The internal test simulates scenarios where an employee has been compromised or gone rogue. Approximately 90% of successful data breaches are due to human error, highlighting the importance of the internal testing method.
Blind Testing – The blind test method involves using brute force to gain access into an enterprise network without any inside information or employee credentials. The blind test provides security teams with insight into how cybercriminals work and how an application or system assault occurs.
Double-Blind Testing – The double-blind test simulates real-world scenarios where the cybercriminal has no inside knowledge, and security teams have no prior knowledge of when the attack will come and what type of attack will be used. Thus, security teams respond in real-time as the attacker adapts to changing security situations.
Targeted Testing – Targeted testing is the opposite of the double-blind test method and in this case, both the attacker and the security personnel are in sync as the test occurs. Targeted test is more or less a training process to get security teams up to speed with new attack methodologies and understand the behavioral patterns of hackers.

Who Does Pen Testing?

An authorized penetration tester handles penetration testing, and pen testers are also broadly classified as information security analysts. The penetration tester actively searches for the vulnerabilities and flaws in exiting cyber systems using the methods outlined above. The tester uses existing hacking tools to simulate actual attacks, thus assisting security teams with patching flaws and developing high-performing incidence response strategies.

Professional penetration testers are expected to be skilled security analysts with excellent knowledge of scripting and coding. The tester is expected to have gained knowledge of the particular operating system to be tested and understand the tools hackers use to target that system. Finally, knowledge of network protocols like DNS is required to understand how cybercriminals target vulnerabilities and breach systems.

Why Does Penetration Testing Matter?

The evolving security threats IT infrastructure face and the regular additions of new applications mean constant vigilance is needed to forestall breaches. Penetration testing provides a means to continuously test your enterprise's security posture to detect vulnerabilities and craft remediation strategies to eliminate vulnerabilities. It also serves as a training and validation tool for cybersecurity teams tasked with developing mitigation strategies to respond to cybersecurity incidents.

Penetration testing is also done to ensure cyber systems stay updated to regulatory compliance standards such as the European Union Cybersecurity Act. An annual penetration test keeps your business on the right side of the law while protecting your data from cybercriminals.

Conclusion

The fallout from successful cyber-attacks is why comprehensive penetration tests must be done if optimal security is the goal. Statistics show that approximately 60% of SMBs go out of business within 6 months of a data breach. Penetration testing provides a means to secure your business applications and reputation from criminal intent.

What is the MITRE ATT&CK Framework?

Learn about the MITRE ATT&CK® Framework and how cybersecurity teams leverage its matrix of tactics and techniques to assess risk and vulnerabilities within an organization.

Definition

The MITRE ATT&CK Framework is a knowledge base of tactics and techniques that can be used as a foundation for classifying adversary behaviors and assessing an organization’s vulnerabilities.

Created in 2013 by the MITRE Corporation, a non-profit supporting U.S. government agencies, it is one of the most comprehensive sources for classifying threats and developing models.

The ATT&CK portion of the name stands for Adversarial Tactics, Techniques, and Common Knowledge.

Simply put, you can imagine the MITRE ATT&CK knowledge base a “Wikipedia” of cyber threats and tactics.

Who is MITRE?

MITRE is a government-funded research organization. The company was born out of MIT in 1958. MITRE started ATT&CK in 2013 to document common tactics, techniques, and procedures (TTPs) that advanced persistent threats use against Windows enterprise networks. It was created out of a need to document adversary behaviors for use within a MITRE research project.

MITRE ATT&CK Matrices

The MITRE ATT&CK Matrices are tactics and techniques laid out in a “periodic table” of tactics and techniques used by threat hunters, defenders, and other cybersecurity professionals to classify attacks and assess an organization’s risk.

The most popular framework used is the MITRE ATT&CK® Matrix for Enterprise.

The matrix contains information for the following platforms: Windows, macOS, Linux, PRE, AWS, GCP, Azure, Azure AD, Office 365, SaaS, Network.

Tactics

The MITRE ATT&CK Tactics represent the “why” of a technique. What is the adversary’s objective when performing an action? Tactics give important context to the offensive action.

Techniques

Techniques are the “how” component of the action, how an adversary achieves the tactic. They may also represent the “what” an adversary gains by performing an action.

Use Cases

There are a number of ways an organization can utilize the MITRE ATT&CK framework, here are just a few:

Adversary Emulation: Organizations can use the framework to emulate scenarios and verify their defenses
Red Teaming: Plan and organize red team operations to avoid certain defensive measures within a network
Behavioral Analytics Development: Construct and test behavioral analytics to detect adversarial behavior within an environment
Defensive Gap Assessment: Assess tools, monitoring, and mitigations of existing defenses to find gaps

SOC Maturity Assessment: The matrix can be used as one measure of a SOC’s effectiveness and can signal its maturity in detecting and responding to intrusions
Cyber Threat Intelligence: Use the MITRE ATT&CK framework to better understand adversary group profiles and popular threat actors

How Lumifi Utilizes the MITRE ATT&CK Framework

When choosing a Managed Security Service Provider (MSSP) for outsourced threat detection and response services, the MITRE ATT&CK Framework proves its value in a Security Operations Center (SOC).

Lumifi uses the MITRE ATT&CK framework in several ways.

First, our content team maps each of our alerts to a technique, which allows us to see where our detections are heaviest and where we need to expand our ruleset.

When our analysts are threat hunting, they use MITRE techniques as guides for Tools, Techniques, and Procedures (TTPs) that they should be on the lookout for. Doing so allows us to find gaps in customer visibility.

One use case is if a customer gets all their alerts in the Reconnaissance phase, but not much else, we can assume they are not receiving all relevant data. This would start a process where we take another look at their environment and see if their critical logging source has changed their logging format.

Another added benefit is trend data. Lumifi receives alerts across our clients’ environments collectively, where they can be categorized using the MITRE framework. For example, if there is a spike in Initial Access through phishing, like the initial onset of COVID-19, or an influx in Supply Chain attacks in the SolarWinds fiasco.

Our customers receive more information so they can become more granular with their defense strategies and focus on weak areas. For example, if we see a customer with a large amount of phishing emails, they may need to step up their email filtering. Or if we see an increase in privilege escalation, defense evasion, or credential access, we should figure out the origin of these attacks and ensure the customer has a solid Endpoint Detection and Response platform.

MITRE allows Lumifi to identify gaps in security and give a broad picture of where our SOC should focus and how to better assist our clients.

Every level of our security operations team uses the MITRE ATT&CK framework, from reporting to tasking the threat content team to see if customers need specialized assistance or guidance.

SHIELDVision

Lumifi's proprietary orchestration tool, SHIELDVision, utilizes the MITRE ATT&CK framework in order to provide concise identification and feedback.

We utilize the framework in our automated scans, hunting scans, and investigations. Analysts make sure to list the Access and Technique according to the framework.

Customers can rest easier knowing we are mapping their networks to the MITRE framework and receive additional insight in their quarterly calls with our engagement team.

Conclusion

The MITRE ATT&CK Framework is an important tool for red and blue teams alike. Whether it’s emulating an attack or using the framework to inform security decisions, the MITRE ATT&CK framework is a useful piece of the cybersecurity landscape.

Leading MSSPs utilize the framework in order to provide in-depth investigations, threat hunt, and create clear communication with their customers.

To learn more about how Lumifi uses the MITRE ATT&CK Framework and how we can protect your network, contact us today.

SolarWinds vs. Splunk: Comparing Two Leading SIEM Solutions

SolarWinds Log Event Manager and Splunk Enterprise Security are two of the top security information and event management tools. Both SIEM solutions differ but offer high-performing features that simplify threat detection and response within expansive networks.

Here, we look at key differentiators between both options. To effectively compare both options, the following criteria were chosen for their importance to the threat detection and response process, will apply:

Threat Intelligence – Discovering threats through telemetry analysis improves overall security and reduces the number of false alarms. This criterion focuses on the capabilities of the threat intelligence framework of both SIEM solutions.
Behavioral Profiling and Analysis – Data tells important stories concerning the state of an IT infrastructure’s security, but contextual analysis is needed to gain insight into what captured data, events, and logs say. This criterion focuses on the behavioral profiling capabilities of both options.
Application Monitoring – Your entire IT environment is run by applications that must be monitored and managed to get optimized performances that keep your business running. Thus, the ability to monitor app security and performance is a key function of SIEM solutions.
Ease of Deployment, Available Support, and Ease of Use – Everyone requires extensive support from time to time when dealing with IT security. This includes experienced security teams and non-technical staff manning visualization screens. Although the level of technical support the former and the latter requires may differ, the simplicity of using a SIEM tool is an important deciding factor for most organizations.

Threat Intelligence

SolarWinds is more than a SIEM tool as it offers other services across the database management, network performance monitoring space, among other services, but our focus is on its SIEM capabilities.

SolarWinds relies on data centralization to collect logs and data lists and to monitor threats with results displayed using an interactive dashboard. It is important to note that SolarWinds is only available as a virtual appliance, which means it is pre-configured to a large extent and can efficiently run through an IT infrastructure.

SolarWinds takes a proactive approach to threat intelligence through intelligence feeds that are updated continuously to showcase real-time incidents, thus simplifying response. According to its website, it leverages 700 built-in correlation rules and hundreds of admin responses to automate threat detection and response. SolarWinds is a reliable option for small to medium-sized businesses.

Splunk bills itself as a security operations suite that business organizations can apply to optimize cybersecurity defenses through accurate data analysis. This means, like SolarWinds, it offers more comprehensive security services include SIEM. Splunk SEIM threat intelligent features deliver end-to-end visibility into expansive IT networks through a visualization dashboard, simplifying the detection and response process.

Splunk applies machine learning and predictive analysis to deliver a proactive threat intelligence solution that ensures security incidents are accurately detected in real-time. According to Splunk, its advanced use of predictive analytics alongside automated playbooks can discover threats 30 minutes in advance, thus ensuring that end-users can react quickly. Splunk isn’t a virtual appliance, and it provides its services to both SMBs and larger organizations.

Both Splunk and SolarWinds are recognized for their ability to provide high-performing threat intelligence solutions. According to Gartner Peer Reviews, Splunk gets a rating of 4.4 with more reviews, while SolarWinds is rated 3.8 for by much fewer users.

Behavioral Analysis

SolarWinds rely on behavioral analysis when sifting through large data sets to discover patterns and gain insight into specific threat profiles and bad agents. Its application of behavioral analysis is backed by its cyber threat intelligence product and machine learning.

The extensive behavioral analytics capabilities Splunk provides ensures end-users can prepare to quickly identify hacking attempts through well-known actors such as DDoS or phishing attacks, as well as more complex hacking technologies.

Splunk once again relies on machine learning to detect anomalous behavioral patterns and analyze the intent behind them. The application of machine learning ensures Splunk can trace anomalous behavior from diverse endpoints to discover any common determine factor behind specific security incidents. The insight this provides ensures threats are dealt with from the root source with high accuracy.

Splunk also offers a dedicated product, the Splunk User Behavior Analytics, to complement its SIEM tool’s behavioral analytical capabilities.

Reviewers on Gartner Peer Review show an average rating of 4.7 for Splunk’s behavioral profiling and analytics solution, while SolarWinds gets a rating of 3.5 with fewer reviewers.

Application Monitoring

SolarWinds offer robust application monitoring and management tools that ensure security teams and non-technical individuals can troubleshoot both complex and simplistic issues through its information dashboard. SolarWinds offers “Pingdom and Web Performance Monitor,” two features for analyzing both on-premise and cloud-based applications for web applications monitoring and management.

Other solutions SolarWinds offer include “AppOptics and Loggly” for monitoring SaaS-based applications, cloud applications, and hybrid applications running through multiple environments.

Splunk takes app monitoring to the next level through its suite of products aptly named Splunk Application Performance Monitoring (APM). Splunk APM is explicitly built for cloud-based applications and applies an open standard approach to collecting data from libraries and diverse app platforms to ensure every application within an enterprise network can be monitored.

Splunk leverage AI to simplify errant troubleshooting applications to find root causes and continuously monitor app performances. Gartner Peer Review on both solutions application monitoring and management capabilities show a rating of 4.8 for Splunk and 3.3 for SolarWinds.

Ease of Use and Support

As a virtual appliance, SolarWinds is easily deployed and used within expansive IT infrastructure, unlike Splunk, which requires some manual configuration activities. Both solution providers also provide extensive after-sales support to ensure customers get started with using the SIEM tools they offer quickly.

SMBs who make use of SolarWinds appreciate its ease of use features, and this can be seen from its rating of 4.6 compared to Splunk’s 4.2 ratings on Gartner Peer Review. SolarWinds also scores a high rating of 4.7 for its support, while Splunk is rated at 4.6.

Conclusion

Choosing the right SIEM for your organization can be challenging. Depending on your specific organization’s needs, existing architecture, and preferred software and vendors, there is a lot to consider. Lumifi provides essential consultation and engineering when implementing a SIEM solution within a client environment. Contact us today to take your security to the next level.

What is SOAR?

SOAR is an acronym thrown around a lot within the cybersecurity industry, but what does it really mean? SOAR stands for Security Orchestration, Automation and Response.

SOAR tools are the technologies used to orchestrate responses to security incidents and assign responsibilities between various tools and individuals within a security team or enterprise.

The working principles of a best-in-class SOAR technology include:

A combination of security orchestration and automation solutions that automates incident response and threat investigation processes
Provision of an interactive centralized dashboard to simplify the security management process for security teams and non-technical staff
Simplifying case management and efficient response to security incidents with a priority ticketing system

The Benefits of Implementing SOAR

The upsides of utilizing SOAR capabilities are:

Automating Repetitive Tasks

Human error in the workplace is responsible for 95% of security incidents in cloud environments, according to Gartner. The high failure rate is due to repetitive manual tasks, which increase the likelihood of an oversight or mistake. Threat investigations and responses are performed faster and at scale across complex or expansive IT infrastructures with SOAR capabilities.

AI Enables New Security Initiatives to Protect Digital Infrastructure

The integration of machine learning in SOAR solutions enables the technology to dive deep into threats, analyze them, and gain contextual knowledge of their capabilities. The insight SOAR provides the foundation for fine-tuning incident response strategies to improve overall IT security.

Orchestrate Security Incidents to Capable Hands

SOAR technology automates the orchestration process and routes security incidents to the analyst or expert within a team with the best credentials to handle a particular incident. SOAR ensures teams get only the essential information needed to take action.

SOAR Use Cases

Managing Security Operations

As a security operations manager, SOAR technologies handle multiple tasks such as vulnerability management, security certificate management, endpoint diagnostics, and reporting activities. The broad range of management services SOAR offers means enterprises with varying security capacities can deploy SOAR for security management operations.

For example, an enterprise with a dedicated, experienced security team can rely on SOAR to send timely reminders on expiring security certificates so the appropriate individual can handle that task. In other enterprises with limited security operations, SOAR can serve as an additional tool for managing vulnerabilities and dealing with security incidents through automation.

Threat Hunting and Incident Response

The process of threat hunting is more than simply discovering threats, it involves gaining insight into threat complexities using machine learning and other pattern recognition solutions. SOAR provides the tools for automating the threat hunting, analysis, and response processes for enterprises regardless of their security team’s experience levels.

Use cases for experienced security teams revolve around gaining contextual insight into indicators of compromise captured across diverse threat hunting technologies. Security teams also rely on SOAR technology to analyze big data sets from expansive enterprise infrastructures as they can extract and analyze data from both cloud-based and on-premise IT assets.

Use cases for enterprises with limited security capacity to take advantage of the orchestration and automation capabilities of a SOAR technology or solution. Under this category, enterprises rely on automation to discover threats and determine the response required to mitigate discovered threats. These enterprises also rely heavily on comprehensive dashboards and playbooks to understand the nature of threats, their targets, and the severity of a security incident.

Automating Security

Automation and the option to rely on superior analytical powers SOAR provides are a major reason why enterprises choose to use a SOAR solution. Due to the always-changing nature of IT security and the threats cybercriminals deploy, relying on the automated support SOAR provides to discover new threats are the reasons why security teams deploy SOAR technology.

Conclusion

SOAR tools continue to be adopted by enterprises looking to increase efficiency and provide greater threat hunting capabilities. Gartner mentions SOAR capabilities as a top feature for Managed Security Service Providers. If your organization is looking to implement SOAR capabilities or needs an outsourced provider with these competencies, reach out for a no-cost consultation with a Lumifi professional today.

5 Questions to Ask an MSSP

An organization’s choice to seek a managed security services provider (MSSP) to guard over its IT infrastructure is usually based on three major reasons.

According to Gartner’s 2020 Market Guide for Managed Detection and Response Services, they are:

A lack of technical knowledge needed to build and manage a security operations center
The need to support available security infrastructure with managed solutions
The need to secure the services of security experts and solutions at affordable rates

To simplify the decision-making process while ensuring the final choice leads to a long-lasting business relationship, here are questions you should ask potential MSSPs:

How do you adapt your service to your clients’ needs?

“Business context” is talked about a lot by providers, but not all can provide a truly tailored experience.

Ask potential MSSPs how they have adapted their services and approach to a client’s unique business environment and operations. A qualified MSSP will work with you to understand your security infrastructure, day-to-day operations, and future goals.

Lumifi's foundations are built upon our consultative approach. We have clients ranging from small to mid-market organizations to large multi-national operations across all industries. We understand the intricacies of compliance reporting and regulations across industries.

Can you use our current security stack, or will we need to implement new technology?

Depending on the service provider, MSSPs can work with existing infrastructure or require their clients to adopt their “package” of security tools.

Depending on your current security stack, keeping your current system may be more complex and expensive than transitioning or migrating to a different platform.

Lumifi provides the best of both worlds. We partner with the best in class security tools and integrate with most of them with our security orchestration tool. Depending on your current security stack, you may not have to add or deploy new tools. Additionally, Lumifi may be able to help you cut cost with exclusive partnership licensing fees.

Can you configure and customize my logs?

Your organization generates millions of data points for every event that passes through its IT infrastructure every day, recorded in logs. Marketing efforts, sales, client services, and financial transactions passing through a network generate a ton of events and alerts.

Auditing and analyzing logs is a key component for protecting an IT infrastructure from security incidents, meeting government regulations, and responding to threats.

Security information and event management (SIEM) tools audit and analyze logs. Most MSSPs rely on SIEMs to handle the task of managing the logs of a customer.

A well-configured, customized, and installed SIEM can make a world of difference for your IT team.

Any MSSP worth their salt will work with your organization to implement and tune your log ingestion and SIEM tool to deliver rich contextual alerts.

Lumifi works with the industry’s top SIEM solutions, including on-premise, hybrid, and cloud architectures. Our engineers and threat content team provide a premier SIEM installation and tuning experience.

Do the logs and alerts have the right type of data and level of detail to support threat hunting activities and compliance reporting?

SIEM tools allow for full packet capture, which provides necessary event data to actively threat hunt and generate detailed reports.

MSSPs can implement a SIEM tool on your network while tuning alerts to reduce the volume and increase efficiency.

Make sure your MSSP goes beyond the out-of-the-box rules and alerts, customizing them to your specific needs.

Lumifi provides a consultative approach to logs and alerts. We work with best-in-breed SIEMs, and our security engineers can help you architect and deploy your ideal security stack. Additionally, our Managed Detection and Response service comes with active threat hunting and a dedicated account manager who facilitates progress and status calls.

Will your MSSP support our organization’s incident response activities?

Detecting threats and capturing security incidents is the first part of the process of mitigating threats to your organization’s IT infrastructure.

Your organization should ask potential MSSPs how they currently handle incident response and how they work in co-managed or fully outsourced environments. Understanding the ownership for threat response will determine your budget and resource spend.

Lumifi offers a spectrum of incident response services and tools that interface with the MITRE ATT&CK framework; contact us today to see how we can best collaborate.

Other Considerations

Most MDR providers lack the vetting and decades of competition that MSSPs have faced. Due diligence must be paid before signing a contract. Make sure to:

Use a Proof of Concept (PoC)
Ask for sample deliverables and use cases
Interview multiple providers and request demos and quotes from each
Don’t just look at the specs; make sure to consider the customer support and experience

Add Lumifi to your shortlist

Lumifi has been providing Managed Detection and Response services for over a decade. We use our proprietary software SHIELDVision and core processes to focus on generating valuable and actionable insight into advanced security threats for analysis and response, allowing us to beat the competition. Additionally, we have the experience and resources to set up, configure and manage virtually any SIEM appliance, email security tool, or endpoint software.

Top 5 Takeaways for NIST 800-53 Rev 5

Recapping a highlight from Cybersecurity Awareness Month, the National Institute of Standards and Technology (NIST) has released an update to its master IT security guidance document, Special Publication 800-53. This update, "Rev 5," is the first major change to SP 800-53 in seven years, and a lot has changed in cybersecurity since 2013. The new guidelines will eventually form the foundation for the compliance programs – and requirements– in nearly every major US corporation with a security, privacy, and risk management focus.

Over the past few weeks, we've had the opportunity to fully review this 483-page document and its supplemental materials. NIST has referenced nearly 200 applicable laws, policies, directives, regulations, standards, and guidelines to bring together over 1,100 discrete controls. Read on to find out our top five observations on Rev 5, including a striking shift in its guidance on privacy.

1. Supply chain risks have finally been recognized

Supply Chain Risk Management is one of the two new control families included in this latest revision – a long overdue development. Nearly all organizations require external partners and components to carry out critical functions and are themselves part of the supply chains of other organizations. Having controls that recognize this coordinated and collaborative reality, and the inherent risks that come with this, is a major improvement from prior publications.

Previously, NIST did not provide sufficient guidance on how to control and verify these external dependencies. There are now comprehensive controls that can be more readily applied to external system services. These cover cloud-delivered services, 3rd party software developers, and anything that might be outsourced. Twelve new second-level controls (all with a short "SR-" prefix) address areas such as creating a risk management plan, the process around critical supply chains, and matters like performing regular assessments and reviews of suppliers. Factors like provenance, detecting tampering, component authenticity, and inspections are entirely new concepts within the SP800-53 framework.

2. A focus on results

Prior versions of SP 800-53 focused on assigning responsibility for each control. Organizations implementing these controls in a strict fashion would be obligated to place the full burden of addressing a given control on a narrowly defined implementer (a person or team). In reality, good controls require broad cooperation and collaboration to achieve. Rev 5 shifts the focus of controls to desired outcomes – part of a broader recognition that SP 800-53 is used by non-government organizations that may not have the strict delineation of roles that government entities often do. The emphasis on achieved results aligns with a broad shift occurring across the landscape of IT. Governments and businesses alike have increased their demands on IT systems to deliver demonstrable outcomes.

3. Compliance assessment tools will show new gaps

Every new revision of SP 800-53 results in new machine-readable files following the Open Security Control Assessment Language (OSCAL)framework. These XML, JSON, or YAML files will be incorporated into various third-party tools, often translated into another open standard like SCAP or OVAL, to automate security and governance testing within organizations. These tools are crucial for demonstrating to stakeholders that best practices controls are in place or the implementation of controls is trending in a good direction. All organizations should consider revisiting their assessment tools in the near future and ensure that the new framework files are incorporated.

4. Privacy objectives have been integrated into all control sections

In Rev 4, privacy controls appeared to be "bolted on" via a separate control section devoted to the topic. In Rev 5, privacy controls are fully incorporated into the overall control guidance, with personal privacy controls taking on greater prominence. Personally Identifiable Information Processing and Transparency is one of two new Control Families. This likely represents the influence of both GDPR and CCPA, both of which increased legal protections and regulations for individual privacy.

More broadly, the relationship between security and privacy is very strong, and our frameworks need to recognize this. Eight new second-level controls (all with a short "PT-" prefix) address matters such as determining authorization to process or store personal information, obtaining consent, giving sufficient privacy notice, and defining a purpose within the organization for handling this information.

5. More controls

Organizations face an ever-growing list of threats and attack vectors. The number of defined concepts/objectives that require controls grows along with these threats. When Rev 1 of SP 800-53 was released in 2005, it had close to 300 controls. Less than 10 years later, when Rev 4 was released, the number of controls had tripled to 965. Rev 5 appears to have more than 1,100 controls. Each control represents a business impact to identify, consider, implement, and iterate on.

Overall, we are left with a positive impression of the changes made in SP 800-53 rev 5. Beyond the significant content changes, the document is easier for security professionals to use. Controls now link to each other, and the document has become more compact and well-organized.

We understand the challenge organizations would have in attempting to respond to these changes without leveraging the expertise of 3rd parties who specialize in compliance, regulation, and governance frameworks. Most organizations will have no choice but to continue to rely on (or increase their reliance on) a blend of tools and professional service consultations to effectively adjust their security posture. This increased dependence on 3rd party tools and talent is not NIST' fault. The complexity of Rev 5, and similar guidance from other authorities, is a reflection of the increased complexity of the cybersecurity challenges all organizations face today.

John Snyder vCEO - Lumifi

Detecting Zerologon - more than event 5829

Zerologon basics

(more…)

Phishing on the Rise During the Pandemic – Here' How to Fight It

Cybersecurity threats based on major disasters or world events are nothing new. During the coronavirus pandemic, one threat in particular has increased much more quickly than others: phishing for sensitive information in disguised emails. During March 2020 alone, phishing attacks were up 667 percent! Protecting your system from the malicious intrusion of phishing emails is critical, and Lumifi

wants to help. Read on to learn about how COVID-19 is changing the face of cybersecurity and how you can protect your business.

(more…)

Leveraging the Power of Exabeam

Organizations of all sizes are dealing with more data than ever before, and as Lumifi learns about increasingly complex attack vectors, it is worth noting that traditional SIEM may no longer fit the purpose of the modern security program.

Traditional SIEMs are based on correlation rules, with no machine learning and no behavioral monitoring. Security teams, and especially SOC Analysts, are under enormous pressure to protect an organization.

While Lumifi does have a reputation within the industry for generating meaningful value using traditional SIEMs, we invite you to see what we can do with even better tools!

Our Take

If you speak with the likes of Gartner, they will tell you that logging, UEBA, and SOAR are now the three key components of a modern-day SIEM.

Lumifi believes that logging is a commodity and that the value of SIEM is in automation and analytics. As such, Exabeam was the first Gartner MQ SIEM leader to disrupt the pricing model of this market.

They did this by launching their SIEM/UEBA/SOAR with a user-based pricing model, as opposed to the volume-based pricing models imposed by the large majority of the industry.

Since Exabeam introduced this model, some traditional SIEM vendors have been forced to respond by introducing their own user-pricing model.

Today, data lakes are popping up everywhere, and organizations need a SIEM that can pull data from many locations – SIEM differentiation will no longer be in the collection and storing of logs, but in the application layer.

In parallel, IoT and OT devices are raising the level of importance of Information Security. As well as monitoring users, laptops, and servers, security teams need to monitor everything IoT that accesses company data or can access company systems, including customers, partners, or vendors (supply chain).

What makes up a "modern SIEM"?

Lumifi’s unique approach as a transparent, integrated, and affordable service provider will ensure all organizations (no matter their size or industry) have a robust and flexible approach to their Security Program.

The Exabeam Security Management Platform is a modern SIEM that helps security teams work smarter. Organizations can take advantage of the big data architecture, advanced analytics, and automation capabilities. Exabeam delivery consists of three simple constructs: objects, insights, and actions.

Objects – such as a user, account, or device – are containers for sharing information. There can be any number of objects, including employees, consumers, computers or IoT devices, and vendors.
Insights – information gleaned through analytics about the status, behavior, and relationships of an object.
Actions – invoke a change in policy or other activity related to an object. Each of these will be significantly enhanced by the use of machine learning and the addition of context from third-party sources.

And critically, not only will objects, insights, and actions be available within Exabeam’s platform, but they can also be shared with other applications in orchestrated responses.

The platform will include tools to allow Lumifi engineers to create custom content: parsers to ingest data, IR integrations, and even machine learning (ML) models to improve detection, and playbooks with near-limitless outputs.

Lumifi will have the ability to add additional applications to the Exabeam platform – playbooks executing on-demand vulnerability scanning or managing cloud security configurations, just to name two.

Exabeam and Lumifi can create custom application actions relevant to any organization’s security program needs.

Each application on the platform can share objects, insights, and actions with Exabeam, and with each other.

Of course, analysts will be able to source data from any repository, be it on-premises or in the cloud. And it is built with the needs of an organization’s future in mind: multi-region cloud, scale, automation, reporting, RBAC, HA/DR, archiving, and more.

Read Our Exabeam Data Sheet

View Now

Better Outcomes

This new platform will allow hybrid security operations teams to help reduce risk, time, and exposure:

With data lakes commoditizing, this open platform can potentially reduce costs.
Lumifi analysts’ vision is enhanced. Shared object data and insights will lead to improved visibility into the overall risk of users and accounts, devices, and other transitory objects in environments.
Collaboration will improve through shared intelligence between applications, security teams, and regions, and will eliminate siloed insights.
The ability to create custom content and applications will allow the Lumifi team to improve security by tackling a broader range of use cases.
Additional automation will remove a lot of mundane tasks.

AI & Machine Learning

Exabeam is a leader and visionary in the use of AI and machine learning in its platform, which enables Lumifi to better detect and respond to all cyber incidents.

Since its inception, Exabeam applied AI and ML to create various techniques to identify adversaries in the customers’ environment, looking at behavior amongst peer groups and organizational commonalities.

With AI and ML in Exabeam’s Advanced Analytics, the other Exabeam tools, Case Management and Incident Response yields, alert mitigation for analysts that would make their work more efficient by leveraging learned data models and new detection technique attacks spanning multiple MITRE TTPs.

Lastly, Exabeam’s strategy is to continue to invest in and foster innovations that would be incorporated into the platform to simplify workflows and provide excellent and automated visibility into customers’ technology environments. Below are some specific capabilities in Exabeam to consider:

UEBA: It stands for user and entity behavior analysis. The entire process begins with accounts in Active Directory. User and entity behavior analytics is a new category of security solutions that use innovative analytics technology, including machine learning and deep learning, to discover abnormal and risky behavior by users, machines, and other entities on the corporate network.UEBA can detect security incidents that traditional tools do not see, because they do not conform to predefined correlation rules or attack patterns or because they span multiple organizational systems and data sources.
MITRE ATT&CK enhancement: Exabeam currently supports use cases and rules that map to the MITRE ATT&CK framework. Lumifi and Exabeam plan to expand coverage for other MITRE ATT&CK techniques as well. Additionally, Lumifi and Exabeam plan to use the MITRE ATT&CK framework as a scorecard to assess the defensive posture and to allow teams to understand where critical gaps exist in their security coverage. Where there are gaps, organizations can be specific on how security investments can help close those gaps (e.g., explaining how adding EDR, CASB, IAM, or other technology would improve security coverage).

Detection use cases: adding new detection use cases for “beyond the SOC” items like enhanced monitoring with SWIFT information, OT/IoT (connected grid monitoring, logistics), and fraud use cases (transaction, data handling, elevated access).
Alert prioritization: Akin to what you are using today but bringing in further automation and efficiency around alert triage beyond our existing human alert triage and workflows.
Seamless investigation workflow: We want to enable SOC/IR teams to perform investigations, collect evidence, and attach artifacts more effectively and quickly. Analysts will be able to add elements to an investigation such as files, logs, endpoint forensics, and binary analysis to an incident from anywhere on the Exabeam UI, using Case Management.
Integrations & playbooks: Exabeam has 70-plus integrations today, including SIEM, EDR, FW, IPS, TI, ITSM, and more. Lumifi will support far more integrations (along with new actions) based on ABN direction. Lumifi will also provide additional SOAR checklists and playbooks. Further, as Lumifi has shown, we are well-qualified to write these directly, ensuring reduced time to production for nearly any automation.

Why Exabeam?

Cyberattacks continue to infiltrate companies at an alarming rate. In just one recent example, we saw Cognizant, a supplier hit by MAZE.

Cybercriminals steal valid credentials to impersonate legitimate users, span IT environments, and conduct malicious activities along the way. Exabeam and Lumifi can detect the subtle anomalies and correlate them across the complete attack chain, leveraging the existing log repositories to search and scan when detecting malicious behaviors.

Exabeam adds security intelligence to existing log management or data repositories to understand a complete picture of the user’s session, allowing the technology to detect and assemble the full attack chain.

The Exabeam User Behavior Intelligence solution uses a powerful combination of session assembly and Stateful User Tracking™, behavior analysis, and risk-scoring to automatically determine the likelihood of an attack and prioritize responses. Its revolutionary technology focuses on user behavior and minimizes the mundane steps in detecting cyberattacks.

Key Proposed Platform Components

Advanced Analytics

Exabeam Advanced Analytics (or UEBA) is the behavior analysis component of the offering in which Exabeam detects anomalies. Exabeam continuously maintains a baseline of normal behaviors for each user, entity, and each group (e.g., department) within the environment. New activities are then compared to the baseline and reported as anomalies if they are deemed inconsistent.

Exabeam analyzes discrete events to build user sessions from the time a user logs in until the user logs out or the session ends. Exabeam then compares the behavior of each new user session to all previous sessions.

Comparing an entire session’s behavior, as opposed to a single event, drastically reduces false positives and dramatically improves the accuracy of threat detection.

As hosts change IP addresses or users switch credentials, Exabeam is able to intelligently track these changes and attribute these activities to the correct user session.

Incident Responder and Case Management

The Exabeam Security Intelligence platform includes Exabeam Incident Responder (EIR), an incident response automation product. EIR includes a fully customizable incident response management system that can be used to track the status of incidents, gather artifacts and entities, assign ownership of the incident to analysts, and perform investigations.

All fields within this system are fully customizable, allowing security teams to create a response management system that matches their desired workflows and processes. EIR’s incident management system is context-aware, and the UI automatically displays different information to users based on the specific type of incident being viewed. For example, phishing incidents will show information about senders, recipients, and subject lines, whereas malware incidents would show fields related to hosts, malware names, attacker URLs, and so forth.

Ready to see how Exabeam can benefit your security program? The experts at Lumifi are here to answer your questions. Contact us!

Leveraging the Power of Exabeam

Organizations of all sizes are dealing with more data than ever before, and as Castra learns about increasingly complex attack vectors, it is worth noting that traditional SIEM may no longer fit the purpose of the modern security program.

(more…)

Ensuring the Cybersecurity of a Remote Workforce

As the COVID-19 pandemic continues to grip the globe, many companies are finding it necessary to transition from on-site to remote work – and experts warn this could be the new normal for the foreseeable future. Is your company ready to make the switch securely? Lumifi has some tips on making the transition with cybersecurity in mind.

(more…)

FBI Warns ICS Cybersecurity Under Attack by Kwampirs

The ICS sector is under attack.

According to the Federal Bureau of Investigation (FBI), a new security threat is on the horizon for those in the Industrial Control System (ICS) sector. While the Kwampirs remote access Trojan (or RAT) is not new, it is now targeting ICS companies and especially the energy sector. The FBI alert urges companies to take action against this dangerous malware, and Lumifi is here to help.

(more…)

5 Ways to Protect Your Business' Data During Tax Season

If you're an accountant or tax professional, you know that tax season is also scam season and that you're a prime target.

Cybercriminals are using new, sophisticated scams that can compromise your website or infiltrate your systems with remote desktop software. These join the more traditional email-based attacks that trick you into installing malware that steals your credentials or takes charge of your systems. There are, however, precautionary measures you can take to protect your business and clients during this important time.

(more…)

The Four Pillars of Network Security

Every organization works hard to attain a healthy security posture.

But what does that mean? It involves a properly resourced team of information security experts working to leverage the latest information security tools. The job of the security team is to prevent attacks before they happen, protect the organization in the case of an attack, detect attacks that would otherwise go unnoticed, and respond accordingly.

(more…)

Beginners Guide to IDS, IPS & UTM

There is often a lingering and general confusion over the acronyms IDS and IPS, and how they are like or unlike UTM software modules. Everyone likes primers and simple descriptive definitions; so let's take a look at IDS, IPS, and UTM through that lens.

IDS
An Intrusion Detection Sensor (IDS) is a tool that most obviously detects things, but what things? Ultimately it could be anything, but thankfully most vendors include a large array of 'signatures' and or methods for detecting stuff. What do I want to detect? For each network, this answer will vary, though generally, it is looking for unusual traffic. What's unusual? In the simplest terms, it's traffic you don't want on your network, whether that is policy/misuse (IM, games, etc.) or the latest malware.

Just as they say in real estate: its location, location, location. Not the location in the rack, but the segment of your network the IDS will monitor. Monitoring traffic at the ingress/egress point will show you what comes and goes (after the firewall policy approves of course), but may not allow you to see remote offices connecting to core components.

One thing you don't want to do is inspect traffic on the public side of the firewall. Monitoring all of the traffic on an internal switch, like your LAN or a DMZ, will allow the IDS to monitor user activity or key servers, but it won't see things happening on other parts of the network. Unless you have unlimited resources, you may not be able to monitor everything on the network, so a key decision will be which traffic matters the most and which segment provides the best vantage point.

IDS can passively monitor more than one segment and can monitor traffic that an IPS or UTM would never see, such as the traffic staying entirely within a LAN or DMZ. An IDS, therefore, could alert on a desktop machine attacking other desktop machines on the LAN, something the IPS or UTM would miss due to being inline.

IPS
An IPS (Intrusion Prevention Sensor) is an IDS in most regards, save for the fact it can take action inline on current traffic. This sounds amazing right?...well almost. IPS and UTM, by their nature, must be inline and therefore can only see traffic entering and leaving an area. A huge concern is that an IPS can prevent business legitimate or revenue-generating traffic from occurring (an IPS, remember, can alter traffic flow). IPS actions include drop, reset, shun, or custom-scripted actions and all of this occurs immediately upon signature match. This potentially negative action makes the person responsible for security now responsible for loss in revenue should the IPS drop legitimate traffic. In my experience, IPS devices make great tools as long as you also leverage the key components that differentiate the IPS.

Make sure your IPS devices are capable of "failing open"; this means if any part of the application fails or even the chassis fails (power loss anyone?) the unit continues to pass traffic. No one wants a brick impeding the flow of data.

Also realize that only a small portion of the signatures that fire should actually be allowed to take action on traffic. To help reduce false positive rates, one should have very well defined home net or protected ranges allowing direction oriented signatures to be more effective. You will also need to spend quite a bit of time reviewing alarm and event output to ensure the signatures allowed to take action are working as intended. You can expect to spend more time upfront and more time at each signature update looking at which signatures the vendor has chosen to take action and considering how that can impact your traffic. This often works best in settings where firewalls are not very favorably looked upon between "open" network segments.

Software Based Modules in UTM Devices
This brings us to software-based modules in Unified Threat Management (UTM) devices. Key items to point out about these devices happen to be drawbacks, though this does not reduce their efficacy. Obviously, they can only be located where the UTM itself is located. Typically this is a junction point like your Internet gateway or an access control point between your LAN and DMZ. In this case, a UTM would not be able to see all of the system-to-system traffic on the DMZ or LAN, rather only traffic coming and going from that segment.

In addition, UTMs are not purpose-built platforms, thus tending to have higher false-positive rates (though this is getting better). In the case of high CPU or memory utilization, they will turn off software modules to preserve the primary function of the device, as a firewall. This is an important point related to not being a purpose-built platform and helps justify requests for dedicated devices. If all you have is a device like this, we say go for it! It is much better to have visibility in traffic coming and going from your network than to not have any IDS at all. Ask your vendor to validate that they logically inspect traffic after the firewall policy and make sure to notify yourself immediately should your device move in to conserve mode or consistently seeing high resource utilization.

So, in Summary, Comparing IDS, IPS, and UTM
None of the three are "set it and forget it" devices. New malware and vectors for exploit and detection emerge daily. Regardless of your choice, you will have often recurring maintenance in signature event/alarm output and a need to update and manage your policies, especially in the case of IPS. Updates can be automatically applied in any of the devices discussed, but that does not absolve the need for human review. Set aside some time daily to check in on your device and consider turning off groups of signatures that have no role in your environment (think "policy-based") and tuning out other noise granularly.

Hopefully, all the cautionary statements penned here don't scare you off. Getting traffic inspection in your environment is a great way to get visibility into traffic on your network.

(more…)

Why Set-and-Forget SIEM Deployments Often Fail

(Updated April 2022)

There are many ways to optimize and automate your SIEM workflow, but you can't replace the human element.

(more…)

Network segmentation

Network segmentation is the practice of dividing a formerly 'flat' network [where every device can contact every other device] into a series of segments that have restricted communication between them.

What's this mean in real terms, though? And why would you want it - and is it useful outside of making PCI compliance easier?

In real terms, this means that you will end up working with your network hardware to create a set of 'zones' or enclaves, populated with a given group of assets. Then, you'll put some kind of barrier between each of these zones - either by assigning each of them to a VLAN and restricting routes between VLANs, or setting up a firewall to partition off various subnets and restrict communications - or a combination of the two.

As an example, consider a small sandwich shop that accepts credit cards. It has some POS terminals at the registers, a back office for management, and offers wifi for the customers.

In this case, you would want a segment for guest wifi - a separate VLAN that only routes out to the internet - to keep guest devices outside of the card processing environment. Similarly, you would want a segment for the POS terminals that can route to the network gateway - for credit card authorization - and for traffic from the registers to the management network - so that management can keep track of inventory sold.

By restricting the kinds of communication that are possible to the kinds that are specifically allowed, you've made your network more secure - the disallowed kinds of communication are either not possible, or require changing the setup in a way that would be very obvious to the SIEM.

Likewise, if you restrict the kind of traffic that can transit between zones to the minimum necessary traffic, any attempts by an attacker who has managed to infiltrate one segment to attack other resources will be restricted, or possibly prevented - and activities taken by the attacker to discern the kinds of assets on the network will be much more obvious.

A side effect of segmentation is that in some instances network performance may be improved. Several different protocols - like NetBIOS - generate broadcast traffic; if this traffic is forbidden from crossing segment boundaries into areas where it is not needed, then the overall amount of traffic on the network can be reduced. With modern networks this is usually not a significant concern, but it can be mildly beneficial in some instances.

Network segmentation also has benefits for compliance - in many cases, if the kinds of traffic that need compliance certification are isolated on a specific segment, that restricts the scope of the audits required to maintain certification to that specific segment. Smaller scopes are easier to audit, and it is easier to prove compliant configurations - you won't need to account for every single asset.

Segmentation is a very worthwhile means of adding to the security posture of your network. Talk to us here at Lumifi about whether your organization would benefit from this kind of defense in depth, and how it can be integrated into your existing security posture; we'd be happy to help.

Threat actor operations are converging along similar themes

Mobile devices with both personal and corporate data are valuable targets

The cybersecurity skills shortage gives cybercriminals the upper hand

Top 5 most common types of malware in 2024

1.) Ransomware

What you can do:

2.) Spyware

What you can do:

3.) Remote Access Trojans (RATs)

What you can do:

4.) Cryptojacking miners

What you can do:

5.) Multi-use malware

What you can do:

Stay ahead of the latest threats with Lumifi

Your organization needs dedicated space and infrastructure for conducting security operations.

Introduction to Security Operations Centers (SOCs)

Components of a SOC

Component 1: People

Component 2: Process

Component 3: Technology

Factors that influence the cost of building a SOC

Cost breakdown: Personnel and equipment

Considerations for budgeting and planning

Outsourcing vs. in-house SOC — pros and cons

Outsourced SOC

In-house SOC

Cost-effective solutions for building and maintaining your SOC

What is the SANS Incident Response Framework?

SANS Incident Response Framework vs. NIST Cybersecurity Framework

Who should Implement the SANS Incident Response Framework?

Adopt the right incident response framework for your organization

Learn how to establish robust, standardized security controls for handling any kind of incident.

Take these steps to improve your incident response plan

1. Define and categorize different security incidents

2. Make sure everyone has a well-identified role

3. Don’t forget about external stakeholders

4. Test your incident response playbooks frequently

5. Gather data and conduct after-action reports

What is the NIST Cybersecurity Framework?

1. Identify

2. Protect

3. Detect

4. Respond

5. Recover

What does NIST compliance achieve?

What about NIST SP 800-53?

Key differences between the NIST Cybersecurity Framework and NIST SP 800-53

Why comply with the NIST Cybersecurity Framework?

Find out how AI is likely to impact the cybersecurity industry in the next decade.

What exactly do LLMs do? Cybersecurity use cases explained

How new AI technologies will enhance cybersecurity workflows

Threat actors will leverage AI to break down operational barriers

Adjusting to a security landscape dominated by AI means understanding its limitations

Where will AI take the cybersecurity industry?

Cybercriminals are now leveraging attack vectors previously only available to well-funded nation-state actors.

As ransomware groups enhance their capabilities with generative AI and sophisticated automation, security leaders need to extend their detection and response capabilities more than ever.

Most security technologies are ineffective against unauthorized users with stolen credentials.

User Entity and Behavioral Analytics (UEBA) Technology is Key

Preassembled User Activity Timelines Optimize Event Response

Combine UEBA SIEM Technology with On-Demand Expertise

With UEBA-powered platforms like Exabeam, you can catch threat actors who already work within your network.

You can make UEBA technology work right out of the box – but custom configuration is needed to unlock its real value.

How Default UEBA Configurations Work

Custom Configurations Enhance UEBA Performance from Day One

How Lumifi Uses Custom Rules to Improve Risk Management

Government agencies are quietly suffering a significant uptick in security incidents and data breaches – but the cybersecurity industry doesn't seem to have noticed yet.

Cybercriminals are adopting new, more sophisticated tactics. Security leaders can't depend on purely technical solutions that ignore the human element.

Automation isn't always a replacement for human expertise. The two must work together to generate lasting security value.

Cyberattacks against banks and financial institutions continue to rise as cybercriminals develop new tactics.

OpenSSL originally warned this patch would fix a critical vulnerability impacting all OpenSSL 3.0 installations.

The open-source cryptographic library is an industry-standard found in an enormous range of applications.

More on how you can help: Click HERE

The flaw has been exploited in real-world attacks, but most Palo Alto customers will remain unaffected.

Find out how to configure Linux to generate comprehensive log feeds for SIEM, UEBA, and SOAR technologies.

Boost Security Performance by Configuring Log Data

How to Configure Log Management Policies in Linux with Auditd

Get our custom AuditD ruleset for your use!

Make Sure Your SIEM, UEBA, or SOAR Platform Can Parse These Logs

Enriched data enables analysts to conduct faster, more accurate investigations in Exabeam.