Risk management is an equally important component of SGRC. Willingness to implement it in itself indicates a certain level of maturity in an organization. If audits answer the question “what is happening to CS now?”, risk management helps answer the question “What will happen to the organization’s CS in the future?” and also try to change that future.

Risk management is a proactive response to potential problems in the cyber security system. Of course, this process can be translated by regulators through regulatory documents requirements but it can be very difficult to approach. The reason for this is the following two factors, which are not described in detail in almost any risk assessment regulation:

– Risk assessment methodology.

– Threats catalogs.

1. Risk assessment methodology

The term “risk assessment methodology” in this article refers to a list of risk parameters and how they are calculated.

There are three key points in the creation and description of assessment methodology, without which the process is not possible:

– What is considered to be the risk level – a key parameter, on the basis of which risks will be prioritized?

– On the basis of what parameters is the risk level calculated?

– On what principle are risk parameters calculated?

Cybersecurity news

• Google has confirmed that a zero-day security vulnerability in Chrome web browser is being actively exploited and has issued an emergency security update in response. CVE-2023-3079 is a type confusion vulnerability in the V8 JavaScript engine.
• GitHub has added support for the Swift programming language to the platform’s security features. A GitHub user can warn project owners about vulnerabilities in the dependencies of their Swift project.
• CISA, FBI and NSA have released another Joint Security Guide, which is the result of a collaborative effort to provide an overview of legitimate uses of remote access software, as well as common exploitations and associated tactics, techniques, and procedures.
• A new anti-cybercrime campaign, Operation CMDStealer, has been revealed, aimed at gaining access to online business accounts of users in Mexico, Peru and Portugal.

The Defensys company issued a new release of the Platform for incident response automation and SOC high efficiency Defensys SOAR v. 5.2. The new version provides users with an email communication tool and enhanced response playbooks capabilities.

One of the key Platform features is the built-in functionality of e-mail correspondence, which is implemented as a separate tab in the incident card. All messages are displayed in the familiar user form as in popular messengers. Herewith, an incident mail thread can be created either manually or automatically using response playbooks. For instance, you could set up an automatic start message requesting additional information immediately when an incident occurs. This increases the ease of communication during the incident handling process and saves time spent switching between the system interface and e-mail.

In the updated version, the Defensys company has improved response playbooks by setting up automatic handling of connector execution errors. Thereby, the Defensys SOAR users get better control over the playbook execution process. If a network failure occurs or an external system is temporarily unavailable, connectors will restart automatically without any human intervention.

Challenge

The customer had a need to take in order internal IT & cyber security processes. So a large research across the market was made.

After the careful search Defensys ACP was preferred.

The customer has a huge infrastructure with a large number of servers, active network equipment and of course workstations.

During the project implementation several customer’s departments were involved. At the beginning, the work was established with IT department, further the cyber security department joined with their own requirements.

The main objective just from the beginning of the project was to make a single repository of assets and to put them in order there. Defensys ACP was tuned to receive data from different network segments. By working together with two Cyber security and IT departments, a lot of different types of systems were successfully integrated with the ACP system but of course there were some specific requirements during this process. For example the customer’s network has different segments that are not interconnected on a physical level. That’s why some part of data was uploaded to the system with the files integration capabilities, from custom databases and via specified questionnaires that were sent using built-in task manager of the ACP.

Cybersecurity news

• The Python Package Index (PyPI) has announced that it will require every account that manages a project on the platform to have two-factor authentication (2FA) turned on by the end of the year.
• A new ‘File Archivers in the Browser’ phishing kit abuses ZIP domains by displaying fake WinRAR or Windows File Explorer windows in the browser to convince users to launch malicious files.
• A team of researchers at Georgia Tech, the University of Michigan, and Ruhr University Bochum have developed a novel attack called “Hot Pixels,” which can retrieve pixels from the content displayed in the target’s browser and infer the navigation history.
• The QBot malware operation has started to abuse a DLL hijacking flaw in the Windows 10 WordPad program to infect computers, using the legitimate program to evade detection by security software.

We recently told you about the analytical tools implemented in Defensys SENSE.

Some of them are programmatic experts – algorhytms that use statistical analysis and machine learning methods to detect anomalies and threats in users and endpoints behaviors.

Today we’re going to continue the overview of Defensys SENSE capabilities and will take a look at behavioral models that are the basis of programmatic experts. In this article we’ll tell you in details about the processes of additional learning and relearning of behavioral models and how they can help to get rid of false positives and false negatives increasing the effectiveness of working with the detected anomalies.

Behavioral models and its learning

Behavioral models work is established on the processes of the knowledge extraction and updating related to the observation entities. This data is being processed from the event logs and this process is built on the complex mathematical models and calculations.

This helps to build observation entity profile and to detect the deviation in its behavior.

Picture 1– The process of the system’s initial learning

Cybersecurity news

• A new APT hacking group dubbed Lancefly uses a custom ‘Merdoor’ backdoor malware to target government, aviation, and telecommunication organizations in South and Southeast Asia. Lancefly has been deploying the stealthy Merdoor backdoor in highly targeted attacks since 2018 to establish persistence, execute commands, and perform keylogging on corporate networks.
• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of a critical remote code execution (RCE) flaw in the Ruckus Wireless Admin panel actively exploited by a recently discovered DDoS botnet.
• Microsoft’s May 2023 Patch Tuesday, and security updates fix three zero-day vulnerabilities and a total of 38 flaws.

Challenge

The Oil company has a colossal infrastructure and its SOC contains 3 response lines. Undoubtedly, a new system should have been customized and adapted to all internal processes. After the PoC project, for incident orchestration the Company has chosen the Defensys SOAR.

Implementation

The Company already had a plenty of installed systems, such as SIEM, CMDB and others. Of course, the SOAR had to be integrated with all of them. Therefore, Defensys successfully set up several connectors for incidents receipt and their enrichment. Much information is taken into SOAR from antivirus and AD.

Cybersecurity news

• Apache Superset is vulnerable to authentication bypass and remote code execution at default configurations, allowing attackers to potentially access and modify data, harvest credentials, and execute commands.
• VMware has released security updates to address zero-day vulnerabilities that could be chained to gain code execution systems running unpatched versions of the company’s Workstation and Fusion software hypervisors.
• A new reflective Denial-of-Service amplification vulnerability in the Service Location Protocol allows threat actors to launch massive denial-of-service attacks with 2,200X amplification.
• A new side-channel hacking technique has been discovered affecting multiple generations of Intel processors.

Compliance as a right

It was discussed above how automating the typical stages of audits simultaneously results from and at the same time, helps to increase the maturity of the process as a whole. Having implemented the appropriate solution, some organizations may think that is the end of the matter – all that is left to do is keep the process running. Tasks are automated, monitoring is underway, and data is organized.

In fact, this is just the beginning. Organizations are moving to the next level of cyber security maturity when they stop doing audits “because the authority forces them to do this” and realize that this tool can be used to proactively respond to problems.

Internal audits can be organized in many different ways but quite often they begin with the fact that, as cyber security employees gain the experience they start to form their own, in-house, standards. As they learn the various regulatory requirements, they feel the need to formulate a metric for themselves that reflects the level of asset compliance without reference to specific external documents.

This is how internal standards and compliance assessment methodologies are born.