Challenge & Implementation

The Financial Institution had an implemented vulnerabilities management process based on Company’s scanners, that transferred vulnerabilities to the Defensys SOAR. When the Institution decided to change existing scanners, the running process was stopped. Moreover, the process was inconvenient for users and there was a huge demand for innovations. The Defensys’s engineers together with the Institution’s representatives have formulated the main goals for the process modernization:

1. Нosts have to be grouped in one incident

Previously 1 vulnerability was connected to only 1 host, that consequently led to creation of 1 incident in the SOAR and 1 remediation request in the Company’s ITSM system. So the process was related to the most critical vulnerabilities only. Because if the SOAR received more than three hundred thousand vulnerabilities, the IT department would have the same number of requests. As human resources are limited all the vulnerabilities could not be remediated on time in such a case.

Defensys, the developer of cybersecurity solutions, continues to keep Defensys SIEM development at a high pace and is ready to announce the release of the new version 1.6. The version includes improvements of correlation rules handling, as well as enhanced scalability, additional control, and user management.

A new module of distributed correlator available while setting up a collector has been added to the Defensys SIEM 1.6. Now resources of several nodes in a cluster can be used for synchronized events handling. Thanks to this correlation resources can be horizontally scaled with available physical machines for numerous events handling saving the cost of large configurations.

The Defensys team has paid particular attention to companies with huge infrastructures for whom a flexible role model is extremely important. Therefore, the developers have implemented the multitenancy in the new version, thanks to which it’s possible to centrally manage one solution to protect several organization’s branches or different organizations within one interface.

Challenge

The Bank effectively uses the Defensys SOAR and SGRC in their routine. Nevertheless, the implemented scanner of the Bank from another vendor reported about numerous vulnerabilities daily. Thus the necessity appeared to develop and set up new processes of vulnerabilities management.

Implementation

New policies and processes had to be restructured considering the specifics of the Bank’s infrastructure: all company’s assets are united into informational systems. Individual departments of the Bank and even teams are responsible for different cyber security functions.

Using integration with the Bank’s task-manager, the Defensys’s engineers updated response processes. A playbook, that creates a ticket for responsible employees in a task-manager and adds a report in Excel-form, starts after a new portion of vulnerabilities has automatically come from the scanner. The report contains necessary information regarding vulnerabilities only for a certain team, responsible for separate business processes.

Defensys has announced a new release of the Defensys TIP version 3.24. New functions of the Defensys TIP are aimed at automation of indicators of compromise (IoCs) handling and increase of threat analysis effectiveness.

One of the key changes is the expansion of IoCs export capabilities to security tools. The developer has added the option to create IoCs export rules of IP-address type in OpenIOC format for further transfer to target systems. These improvements expand IoCs export capabilities and make information security processes more effective.

The updated Defensys TIP 3.24 has a modified IoCs search within data flow coming from SIEM systems:

• Information regarding IoCs detection events in CEF format can now be sent back to SIEM systems;

• The filter for events from Apache Kafka has been added. The feature enables events search within the flow in accordance with the defined fields.

Cybersecurity News

• Unauthenticated Stored XSS Vulnerability in LiteSpeed Cache Plugin Affecting 6+ Million Sites.

• WordPress LiteSpeed Cache Plugin Security Flaw Exposes Sites to XSS Attacks. The flaw, tracked as CVE-2024-47374 (CVSS score: 7.2).

• DrayTek has released patches for several models of its routers, addressing 14 vulnerabilities. One of them is rated as critical (10.0 on the CVSS scale) and allows remote execution of arbitrary code.

• CUPS vulnerabilities could put Linux systems at risk. The vulnerability can lead to the interception of a computer over a network or the Internet during a print job.

Defensys has introduced the new version of the Defensys SOAR. The team of experts has improved the user interface so that SOC analysts can solve their daily tasks more productively. To promote communication among CS specialists, the 5.3 version has a modernized email handling. Moreover, the function for calculating the incidents’ impact on business processes has been added to the Defensys SOAR. It increases transparency of SOC work to assess cyber security state in organizations. New function will accelerate the decision-making process on response prioritization, as well as managerial decisions on building the information protection system.

The key update in the user’s interface is the improved editing mode in incident cards. Now depending on the task SOC analysts can choose either point field editing to make quick corrections or edit mode if multiple changes are required.

Additionally, the version has multiple interface changes that make it more intuitive and the displayed information more readable:

• The “Incidents” section has been redesigned and an action panel has been added;

• The display of incident severity level has been redesigned;

• A setting that allows users to switch to a compact view while working with incident list has been added;

Cybersecurity News

• Hardbit ransomware version 4.0 supports new obfuscation technique.
• Hackers are attacking Windows users with Internet Explorer zero-Day vulnerability.
• Apple warns iPhone users in 98 countries of more spyware attacks.
• Critical Exim bug bypasses security filters on 1.5 million mail servers.
• Latest CapraRAT Android spyware campaign targets gamers and TikTokers.
• Dark Gate malware campaign uses Samba file shares.
• GitLab critical bug lets attackers run pipelines as other users.
• A user has

In order to improve the process of working with incoming cybersecurity events Defensys has expanded functionalities of the Defensys SIEM. The release 1.3 has a range of updates: the developer has increased the number of functions for events collection and handling, implemented new tools for content processing and search, added a report builder and new integrations to external systems. These changes will lead to better security of IT infrastructure and improve efficiency of CS specialists.

Defensys continues developing technologies for data protection and prevention of cyberattacks. New features are included in the event processing pipeline by Defensys’ specialists, updates allow SOC’s analysts to manage data processing collection in the system’s interface. Thus, the Defensys team has added new elements to the already available input and output points, buses and event normalizer, among them are an aggregator, a router and a filter. This allows users to customize event handling at its fullest, that is especially important for a large infrastructure of sources and systems.

Cybersecurity News

• Researchers have spotted exploitation attempts for the critical vulnerability impacting all D-Link DIR-859 WiFi routers.
• Brain Cipher has released decryption keys for free, allowing victims to recover their encrypted data.
• Apple’s CocoaPods platform bugs expose millions of Apps to code injection.
• Ticketmaster has started to notify customers who were impacted by a recent data breach.
• Researchers discovered a new Android malware, “Snowblind”, running active campaigns since early 2024.
• OpenSSH addressed a critical vulnerability, tracked as CVE-2024-6387, that can lead to unauthenticated remote code execution.
• Cisco has patched a

Cybersecurity news

• Google has released an emergency security update for the desktop version of the Chrome web browser, addressing the eighth zero-day vulnerability exploited in attacks this year. The high-severity flaw is tracked as CVE-2022-4135 and is a heap buffer overflow in GPU, discovered by Clement Lecigne of Google’s Threat Analysis Group on November 22, 2022.
• Over 1,600 publicly available Docker Hub images hide malicious behavior, including cryptocurrency miners, embedded secrets that can be used as backdoors, DNS hijackers, and website redirectors. Docker Hub is a cloud-based container library allowing people to freely search and download Docker images or upload their creations to the public library or personal repositories.
• Windows gamers and power users are being targeted by fake MSI Afterburner download portals to infect users with cryptocurrency miners and the RedLine information-stealing malware.