Tim Watson

What I learned today. Nice - I wasn't aware of the InstallProduct method from PowerShell to fetch a remotely hosted MSI file and subsequently install it. Invoke-WebRequest is one of the more popular methods, at least in our incident response cases. As always, there is more! Matthew Green wrote about PowerShell Download Cradles a few years back, with a ton of information from a detection engineering standpoint 🫶 [1] Elastic does not let us down, either. The rule here would detect the PowerShell code from the image below. [2] And here is the link to the full article from Recorded Future, where I took the screenshot from [3] [1] https://lnkd.in/eey77Yyh [2] https://lnkd.in/eCp8P4DP [3] https://lnkd.in/eUc39xt8

342

12 Comments

Let's talk about Non-Certification Assessments in CMMC. 🥇 Possibly the top question I get lately with clients is whether your C3PAO who's performing your L2 Cert Assessment can also do a 'Readiness Assessment' with you As always - IT DEPENDS! (yayy - our favorite) ❓But Matt - why the quotes on 'Readiness Assessment'? Because that's the whole point. One company's 'Readiness Assessment' doesn't necessarily mean the same thing as another's It's a non-official term. And depending on what they're doing in that assessment, that will dictate if they can still perform your L2 Cert Assessment 📄 So, what IS allowed? Well on page 12 of the CyberAB's Code of Professional Conduct, the term "Non-Certification Assessments" is defined: "A non-certification assessment is the conduct by a C3PAO of a full or partial cybersecurity assessment of an OSA that does not result in the issuance or denial of a formal certification." 😎 Okay, so there is a thing that the CyberAB allows C3PAOs to do outside of a formal cert assessment, but wouldn't that impede their independence? Lucky for us, the CoPC defines the exact scenario that needs to happen so that there is no conflict of interest!   Basically, to be regarded as a true mock assessment that does not create a conflict of interest the C3PAO must: A) Follow official assessment processes outlined in 32 CFR Part 170 B) C3PAO shall not provide recommendations, advice, or consulting C) OSA shall receive an official document with the results So it really comes down to - if they're doing A, B, and C of the above, there is no conflict of interest and you CAN use that C3PAO to still do the official Level 2 Certification 💡So, if a C3PAO proposes doing a gap, mock, or readiness assessment AND your Level 2 Certification - just make sure you understand what they are and aren't doing in that assessment before engaging

69

18 Comments

Proud to share the latest Dragos Knowledge Pack (KP) update, which my team significantly contributed to, focusing on enhancing the detection of ransomware threats targeting Industrial Control Systems (ICS). This update strengthens the Dragos Platform by incorporating new analytics and characterizations specifically designed to identify the evolving tactics ransomware groups use within operational technology (OT) environments. By improving visibility into these malicious activities, we're helping defenders bolster their defenses and better protect critical infrastructure from disruptive ransomware attacks. Check out the blog post for a deeper dive into how these new detections work and why they are crucial for robust ICS cybersecurity. https://lnkd.in/gdFfnUD9

62

4 Comments

Are #cybersecurity incidents growing more costly? Cyentia Institute's recent Information Risk Insights Study points to a 15-fold increase in the cost of #incidents and #databreaches over the last 15 years. The chart on the left shows the distribution of known/reported financial losses from incidents across the time period of study. The typical (median) incident costs about $600K, while more extreme (95th percentile) losses swell to $32M. Note that the chart uses a log scale, so the tail of large losses is a lot longer than it appears. The chart on the right trends the escalating costs of cyber events over time. Median losses from a security incident have absolutely exploded over the last 15 years, rising 15-fold from $190K to almost $3 million! The cost of extreme events has also risen substantially (~5x). So, yeah—cyber events are definitely growing more costly. That said, this picture looks a lot different among different types and sizes of organizations. How are cyber losses trending for orgs like yours? Download the full IRIS 2025 to find out! Link in the comments.

102

15 Comments

‼️MSPs, you might want to start getting your house in order! 👀 👨🏼‍⚖️📃The new Cyber Cyber Security and Resilience Bill is proposing to bring MSPs into scope, meaning you’re going to need to align with the NIS regulations, which in turn means aligning with standards and frameworks such as NCSC CAF and ISO27001 with the ICO as regulator. 🔐 👨🏼‍💻Having audited and assessed numerous MSPs over the years for standards like CE+ and IASME CA, they are often lacking with their own controls, even when they are implementing them for their customers… 🌐If you’re going to look at ISO27001, it’s not a quick or cheap undertaking (assuming you do it properly), so I’d recommend starting to look at your controls now, if you haven’t already. #cyber #resilience #cybersecurity #msp #mssp #compliance #nis #regulations Damien Sansom Gareth Guest David Lenagh

35

4 Comments

Vulnerability Assessments CIP-010-r3 Requires paper or active vulnerability assessment 95% doing paper assessments because of fragility of control system networks Introducing a network based Digital Twin as a way to do vulnerability scanning Including an AI reasoning agent as an adversary simulation Purely offline. -Brian Proctor Frenos Brian Proctor EnergySec

55

"We need to impose cost on adversaries and build evidence based resilience" - NCSC CTO Ollie Whitehouse at #BSidesCheltenham this morning. Disrupting attack chains by simulating adversarial behaviours and hardening Windows and Linux functions so that they cannot be exploited by adversaries can be a way to achieve this.

62

3 Comments

Stop operating your SOC like a traditional IT Helpdesk. This is a dangerous and mostly overlooked issue. IT helpdesks reserve significant importance in any business. However, SOC’s operating as one, undermines the complexity of the work SOCs undertake. Issues I have encountered: → Responding to events that have already happened. → L1/L2 triage response is slow and siloed. → Treating potential incidents as a ticket resolution task. This is where the principles of the Modern SOC would provide a resolution. Analysts become cross-trained, and empowered. (Not distracted by Netflix on a 12-hour shift) I’d suggest: → Prioritising a shift to Proactive Threat Detection. → Cross-training analysts across all roles, to be well-equipped to respond to incidents. → Periodic audit of ticket responses to support SOPs and acknowledged behaviours. Is your SOC struggling to become more proactive?

141

28 Comments

Had a good chat with my mate Andy Swift about the problem with app demo scoping calls. Don't get me wrong, demos are GREAT for learning how to use the app (100% required for a pentest). However they only show the surface, and 95% of the pentest deals with the stuff under the water. Scoping an app for a pentest is an impossible task, I think anyone who has been involved in scoping + testing realizes that at some point. The more information a customer can provide about the deeper stuff, the more accurate a scope will get. The issue is how difficult some of that info is to get. Web Server / Database? Simple. 3rd Party APIs? Bit harder, but still enumerable. Number of GET/POST/PUT etc. requests? Tricky, but estimable. Number of parameters on those requests? Good luck. It's easier to scope a pentest after a pentest has completed. If you're a customer getting a pentest (any pentest, not just appsec), ask the tester at the end for their honest opinion about whether they think more days were needed. Use that information to get a better test next time.

100

6 Comments

After Joe Hudson highlighted how valuable a comprehensive Q&A resource for common questions we get asked would be, I created exactly that! Introducing our "20 Questions: Client Queries Answered" guide, addressing the penetration testing questions clients actually ask us: - Should you notify your MSSP when we're testing? - What criteria determines test duration and pricing? - Can testing cause system downtime? - How do we handle sensitive data discovered during testing? - What's the difference between cloud pentesting vs. auditing? Plus 15 more critical questions answered with practical insights based on countless engagements. Whether you're evaluating security partners or maximizing your current testing program, this resource cuts through the jargon to deliver actionable guidance. If you're interested in chatting through an engagement or want to discuss anything in this guide: DM me or email [email protected] 📊🔒 #pentesting #cybersecurity #infosec #tcmsecurity #securitytesting

51

12 Comments

The March 2025 release of the Information Security Manual (ISM) introduces 24 new control items, removes one, and changes 87. It brings the total number of control items to 1003. Of the changes, 43 are very minor, mainly removing the space between "cyber" and "security" to use the dictionary's "cybersecurity". The other changes are also fairly minor, such as: • "Web applications" and "applications" changed to "software" • The addition of a "staging" environment in the software development process • "HIPS" now extended to "HIPS or EDR". The new ISM starts with ten new control items related to the expectations of "board of directors or executive committee". Other new control items include: • Change management is back, in the form of a change management plan (but no formally defined processes and procedures, yet) • Inclusion of exceptions for "authorised medical devices" in SECRET and above environments • DNS encryption to be used where supported. As always, I recommend reading the ASD's own eight-page changes document at the link below. I have not posted the link to my OneDrive repository of useful ISM-related tools for a while. They are available here: https://lnkd.in/giWjwZfV. Comments and feedback welcome. #ASD #ACSC #ISM #cybersecurity #IRAP #infosec

93

6 Comments

Day 4 of SQLite Forensic Myth Busting Myth 4: ID's are not reused I wrote about this topic earlier this year. If the table primary key is NOT set to auto increment, id values can be reused because there is no mechanism to track the LARGEST id used. Example: I receive a chat, and it gets assigned id 10 as the HIGHEST existing id is 9. I delete that chat. I receive another chat, it gets assigned id 10 because id 9 is still the HIGHEST existing id. For primary keys that are set to auto increment, the sqlite_sequence table keeps track of the LARGEST id ever used in a table. Always check the sqlite_sequence table and if your table of interest does not have an entry then the id's can be reused. Fun Fact: Once your id reaches 9,223,372,036,854,775,807, the id's will start to be reused regardless of whether it is set to auto increment. Anyone know why? #sqliteforensics #digitalforensics #mobileforensics

19

3 Comments