Blog

Challenge

All IT security audits in the Bank were handled in a big famous corporate GRC system. But every time a new cybersecurity standard was published, retuning of the process was frequently connected with issues on the GRC side.

Lack of convenient user tools for managing of different standards requirements and especially of the similar ones, made the team to lose a lot of time for the double work when users had to conduct a new audit campaign with a particular standard.

Defensys technologies

The initial process of dealing with a huge number of requirements was held via electronic tables with all related to such an approach cons. One of the main requirements from the customer’s side was to have the most of the standards, they should be compliant with, available and structured out-of-the-box. After a series of meetings and the PoC project, the Defensys SGRC was chosen as a core solution for the cyber security requirements management system of the Bank.

Implementation

As the first step, the Defensys SGRC had to be integrated with the Bank’s GRC solution. As a result, the whole structure of assets incl.

More

Cybersecurity news

• Aruba Networks published a security advisory to inform customers about six critical-severity vulnerabilities impacting multiple versions of ArubaOS, its proprietary network operating system. The flaws impact Aruba Mobility Conductor, Aruba Mobility Controllers, and Aruba-managed WLAN Gateways and SD-WAN Gateways.
• Cybersecurity researchers Bitdefender have released a new decryptor for the MortalKombat ransomware which can help save precious files, free of charge.
• A stealthy Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus has become the first publicly known malware capable of bypassing Secure Boot defenses, making it a potent threat in the cyber landscape.
• The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has added CVE-2022-36537 to its “Known Exploited Vulnerabilities Catalog” after threat actors began actively exploiting the remote code execution flaw in attacks.
• Hackers are actively exploiting two critical-severity vulnerabilities in the Houzez theme and plugin for WordPress, two premium add-ons used primarily in real estate websites. Houzez is a high-quality WordPress theme that is available for purchase on ThemeForest, a popular marketplace for digital products.
• In-the-wild exploitation of a Fortinet FortiNAC vulnerability tracked as CVE-2022-39952 was seen just days after a patch was announced, and on the same day a proof-of-concept (PoC) exploit was made public.

More

For the purposes of building the effective Cyber Intelligence process relevance and completeness of the received data plays the crucial role. In most of the cases the work with the Threat Intelligence (TI) data starts with the adding of open source feeds. Regarding the 2021 SANS Cyber Threat Intelligence (CTI) Survey 66.3 % of the companies use open sources for the collecting of indicators of compromise (IoC) data and they strive to work with multiple sources in parallel.

On one hand using several sources seems the most simple and obvious way to start collecting data quickly but on the flipside there is a big issue in numerous detections when you upload these indicators to the security tools. And it makes the process of the data processing by the analyst almost impossible. We’d like to note also that if you want to create block lists for security tools from IoCs or a collection for search queries on the side of EDR solutions there will be a limitation by the number of entities. This means that anyway there has to be the manual work to prepare such collection of IoCs. Besides you have to keep in mind that only indicators itselves are useless.

More

Cybersecurity news

• Security researchers have discovered a new backdoor called WhiskerSpy used in a campaign from a relatively new advanced threat actor tracked as Earth Kitsune, known for targeting individuals showing an interest in North Korea.
• A new Mirai botnet variant tracked as ‘V3G4’ targets 13 vulnerabilities in Linux-based servers and IoT devices to use in DDoS (distributed denial of service) attacks. The malware spreads by brute-forcing weak or default telnet/SSH credentials and exploiting hardcoded flaws to perform remote code execution on the target devices. Once a device is breached, the malware infects the device and recruits it into its botnet swarm.
• A new stealthy malware named ‘Beep’ was discovered, featuring many features to evade analysis and detection by security software. Although Beep is still in development and missing several key features, it currently allows threat actors to download and execute further payloads on compromised devices remotely.
• A recently identified financially motivated threat actor is targeting companies in the United States and Germany with custom malware, including a screenlogger it uses for reconnaissance.
• New ESXiArgs ransomware attacks are now encrypting more extensive amounts of data, making it much harder, if not impossible, to recover encrypted VMware ESXi virtual machines.

More

Challenge

It was very difficult to locate a host when something wrong occurred within the network.

Typically, cybersecurity specialists would call a large number of colleagues from different regions before collecting all the necessary data.

In addition, different systems installed within the infrastructure provided different equipment statistics.

Results

Following the PoC process, there was a comprehensive implementation of the Defensys ACP solution that helped.

• Consolidate all inventory information into one location: equipment technical properties, locations, time zones, equipment personnel.
• Consolidate vulnerability data across infrastructure through automatic prioritization which has contributed to a much more efficient vulnerability management process.
• Aggregate data from more than 1,000 distributed antivirus solution management servers.

Defensys ACP does a healthcheck of the AV system giving the up-to-date reports weekly.

As a result, the Defensys ACP has become a source of reference for assets, not only for cybersecurity personnel, but also for other departments.

Some IT systems use the ACP’s API to enrich the required data with asset information.

The system’s metrics are distributed on the Cyber Security Office video wall where the Operations Center is located.

More