Ben Lane

What I learned today. Nice - I wasn't aware of the InstallProduct method from PowerShell to fetch a remotely hosted MSI file and subsequently install it. Invoke-WebRequest is one of the more popular methods, at least in our incident response cases. As always, there is more! Matthew Green wrote about PowerShell Download Cradles a few years back, with a ton of information from a detection engineering standpoint 🫶 [1] Elastic does not let us down, either. The rule here would detect the PowerShell code from the image below. [2] And here is the link to the full article from Recorded Future, where I took the screenshot from [3] [1] https://lnkd.in/eey77Yyh [2] https://lnkd.in/eCp8P4DP [3] https://lnkd.in/eUc39xt8

342

12 Comments

Proud to share the latest Dragos Knowledge Pack (KP) update, which my team significantly contributed to, focusing on enhancing the detection of ransomware threats targeting Industrial Control Systems (ICS). This update strengthens the Dragos Platform by incorporating new analytics and characterizations specifically designed to identify the evolving tactics ransomware groups use within operational technology (OT) environments. By improving visibility into these malicious activities, we're helping defenders bolster their defenses and better protect critical infrastructure from disruptive ransomware attacks. Check out the blog post for a deeper dive into how these new detections work and why they are crucial for robust ICS cybersecurity. https://lnkd.in/gdFfnUD9

62

4 Comments

Let's talk about Non-Certification Assessments in CMMC. 🥇 Possibly the top question I get lately with clients is whether your C3PAO who's performing your L2 Cert Assessment can also do a 'Readiness Assessment' with you As always - IT DEPENDS! (yayy - our favorite) ❓But Matt - why the quotes on 'Readiness Assessment'? Because that's the whole point. One company's 'Readiness Assessment' doesn't necessarily mean the same thing as another's It's a non-official term. And depending on what they're doing in that assessment, that will dictate if they can still perform your L2 Cert Assessment 📄 So, what IS allowed? Well on page 12 of the CyberAB's Code of Professional Conduct, the term "Non-Certification Assessments" is defined: "A non-certification assessment is the conduct by a C3PAO of a full or partial cybersecurity assessment of an OSA that does not result in the issuance or denial of a formal certification." 😎 Okay, so there is a thing that the CyberAB allows C3PAOs to do outside of a formal cert assessment, but wouldn't that impede their independence? Lucky for us, the CoPC defines the exact scenario that needs to happen so that there is no conflict of interest!   Basically, to be regarded as a true mock assessment that does not create a conflict of interest the C3PAO must: A) Follow official assessment processes outlined in 32 CFR Part 170 B) C3PAO shall not provide recommendations, advice, or consulting C) OSA shall receive an official document with the results So it really comes down to - if they're doing A, B, and C of the above, there is no conflict of interest and you CAN use that C3PAO to still do the official Level 2 Certification 💡So, if a C3PAO proposes doing a gap, mock, or readiness assessment AND your Level 2 Certification - just make sure you understand what they are and aren't doing in that assessment before engaging

69

18 Comments

Welcome to Third Party Report Management: powered by the Compliance Theatre™️ TPRM is just compliance with extra steps removed. We kept the paperwork but dropped that pesky 'actually checking things' part. What it actually is: ❌ SOC 2 exists (Not Qualified for the semi-finals) ❌ ISO 27001 exists (What? "A Statement of Acceptability?") ❌ Questionnaire answered (They said yes to everything) ❌ Pentest passed (Nessus scan on the internal wiki) ❌ Trust Center exists (must be trusted) ❌ Incident response tested (they have a security email) ❌ Vendor assessed as critical (they're the only ones who replied back) Sample vendor security assessment: - Send 400-question clunky portal link - Receive 400 "Yes" answers - Ask for compliance certificates - "Can we use Okta?" - Do you think security is good? - Accept all risks because "business critical" - Risk score: Inherent is low, residual is kinda lower - Repeat annually regardless of changes Meanwhile, your vendors are: - Deploying to prod 100 times a day - Changing infrastructure hourly - Rotating entire environments weekly - Accessing your data continuously - But hey, I got their SOC2 Bridge Letter! Your "continuous monitoring" is: - Checking if certs expired - Validating security logos still exist - Making sure questionnaire is less than 1 year old - Ensuring screenshots are still in GDrive - Monitoring their Trust Center uptime What it could be (just some examples): ✅ Understanding vendor infrastructure -> Walk us through how configuration changes propagate from development to production, including approval gates and validation steps ✅ Analysing actual security controls -> How you validate security control effectiveness beyond simple existence checks ✅ Assessing real threat exposure -> Demonstrate how you identify and track shadow IT/unauthorized service usage in your environment ✅ Evaluating incident response capabilities -> Explain your automated response to a compromised production credential scenario ✅ Reviewing data flows -> Demonstrate how you identify and control sensitive data movement between environments ✅ Testing security assumptions -> Walk us through how you verify segmentation controls are working as intended ...But this takes too much time. There's no way I can do all of this for all of my vendors!!! Who said you should do it for all your vendors? You can't pinpoint your _really_ critical vendors? Maybe focus on them first, industrialise your approach for performing deep-dives. You can then tier your assessments in a way that makes more sense than SIG Core vs. SIG Lite. Some welcomed disruption is coming soon and building the foundation for scaling assessments that actually provide value to both parties. Watch this space! A funny note: TPRM is checking compliance worst than compliance themselves in order to stay compliant with their own compliance requirements... lol #GRCEngineering

121

49 Comments

Had a good chat with my mate Andy Swift about the problem with app demo scoping calls. Don't get me wrong, demos are GREAT for learning how to use the app (100% required for a pentest). However they only show the surface, and 95% of the pentest deals with the stuff under the water. Scoping an app for a pentest is an impossible task, I think anyone who has been involved in scoping + testing realizes that at some point. The more information a customer can provide about the deeper stuff, the more accurate a scope will get. The issue is how difficult some of that info is to get. Web Server / Database? Simple. 3rd Party APIs? Bit harder, but still enumerable. Number of GET/POST/PUT etc. requests? Tricky, but estimable. Number of parameters on those requests? Good luck. It's easier to scope a pentest after a pentest has completed. If you're a customer getting a pentest (any pentest, not just appsec), ask the tester at the end for their honest opinion about whether they think more days were needed. Use that information to get a better test next time.

100

6 Comments

‼️MSPs, you might want to start getting your house in order! 👀 👨🏼‍⚖️📃The new Cyber Cyber Security and Resilience Bill is proposing to bring MSPs into scope, meaning you’re going to need to align with the NIS regulations, which in turn means aligning with standards and frameworks such as NCSC CAF and ISO27001 with the ICO as regulator. 🔐 👨🏼‍💻Having audited and assessed numerous MSPs over the years for standards like CE+ and IASME CA, they are often lacking with their own controls, even when they are implementing them for their customers… 🌐If you’re going to look at ISO27001, it’s not a quick or cheap undertaking (assuming you do it properly), so I’d recommend starting to look at your controls now, if you haven’t already. #cyber #resilience #cybersecurity #msp #mssp #compliance #nis #regulations Damien Sansom Gareth Guest David Lenagh

35

4 Comments

After Joe Hudson highlighted how valuable a comprehensive Q&A resource for common questions we get asked would be, I created exactly that! Introducing our "20 Questions: Client Queries Answered" guide, addressing the penetration testing questions clients actually ask us: - Should you notify your MSSP when we're testing? - What criteria determines test duration and pricing? - Can testing cause system downtime? - How do we handle sensitive data discovered during testing? - What's the difference between cloud pentesting vs. auditing? Plus 15 more critical questions answered with practical insights based on countless engagements. Whether you're evaluating security partners or maximizing your current testing program, this resource cuts through the jargon to deliver actionable guidance. If you're interested in chatting through an engagement or want to discuss anything in this guide: DM me or email [email protected] 📊🔒 #pentesting #cybersecurity #infosec #tcmsecurity #securitytesting

51

12 Comments

Very exciting stuff, Realize Security is officially a CREST approved provider for #Pentest! This is something we've been working on for some time now and it's fantastic to see it having come to fruition. This allows us to provide CREST accredited assurance as part of our direct services and services provided through partner organisations as part of our 'force multipliers' program. We now provide #CREST accredited penetration testing services across our regular #app, #API, #infrastructure and #cloud security services. We also cover more specialist services such as #phishing, attack surface management and code review. Come check us out at our website (coming to you fresh from a shiny new CI/Cd pipeline) and get in touch as the world rolls back into the pentest season of 2025. https://lnkd.in/eYwzpMbe

55

8 Comments

Vulnerability Management is Evolving. Are You Ready? The next version of the Vulnerability Management Maturity Model (VMMM) is coming this September — and it’s not just a facelift. We’ve rebuilt it from the ground up to match the speed and complexity of modern risk. Here’s what’s new: Threats move faster — your response must too Hybrid environments demand dynamic prioritization You’re expected to prove impact, not just patch counts This updated model is: -CTEM-aligned -Lifecycle-driven (PIACT) -Built for strategic decision-makers -Practical, not theoretical If you’ve used the original SANS VMMM — or struggled to define what good actually looks like in VM — this is your next step forward. Launching September Previews and behind-the-scenes insights dropping soon #VMMM #VulnerabilityManagement #CTEM #SecurityMaturity #CyberLeadership #StrategicVM #SANS #InfoSec #CyberSecurity

103

13 Comments

"We need to impose cost on adversaries and build evidence based resilience" - NCSC CTO Ollie Whitehouse at #BSidesCheltenham this morning. Disrupting attack chains by simulating adversarial behaviours and hardening Windows and Linux functions so that they cannot be exploited by adversaries can be a way to achieve this.

62

3 Comments

Stop operating your SOC like a traditional IT Helpdesk. This is a dangerous and mostly overlooked issue. IT helpdesks reserve significant importance in any business. However, SOC’s operating as one, undermines the complexity of the work SOCs undertake. Issues I have encountered: → Responding to events that have already happened. → L1/L2 triage response is slow and siloed. → Treating potential incidents as a ticket resolution task. This is where the principles of the Modern SOC would provide a resolution. Analysts become cross-trained, and empowered. (Not distracted by Netflix on a 12-hour shift) I’d suggest: → Prioritising a shift to Proactive Threat Detection. → Cross-training analysts across all roles, to be well-equipped to respond to incidents. → Periodic audit of ticket responses to support SOPs and acknowledged behaviours. Is your SOC struggling to become more proactive?

141

28 Comments

If you are going to send a phishing email pretending to be from DVLA, then it is probably not a good idea to send it to the ex-DVLA Chair, include spelling and grammar mistakes, an ancient GSI email suffix and a .net email addy that has nothing whatsoever to do with DVLA! #justsaying

103

4 Comments

MDR sharpens visibility. Because resilient businesses need a clearer lens. In today’s cyber landscape, what you don’t see often matters more than what you do. Modern security teams face an overload of alerts. MDR steps in to give clarity where it matters most: - Filters noise so only real threats demand attention - Adds context to alerts for faster understanding - Guides action with expert-driven recommendations - Accelerates decisions when time is critical - Strengthens resilience by spotting what tools alone may miss MDR makes your defenses sharper, faster and more reliable. Graftronics is a Sophos MDR partner, transforming IT teams across organizations in multiple industries. Reach out to us for assessing MDR for your setup. - Vimesh Avlani Managed Detection & Response | Cyber Resilience | Trusted by Mid-Market CXOs

20

4 Comments

One of the most common missed opportunities I've been seeing in IAM cv's recently... It's important to share what you DO e.g. 'I implement CyberArk', or 'I sell our CIAM product'... Buuuuut something I've been seeing a lot less recently is people sharing what they've DONE. Outcomes, achievements etc. ---> What did you DO - e.g. 'I implemented strongDM' - ok, how many times, what projects, how long were they, what types of clients, what challenges did you overcome etc. 'I sold our PAM product' - ok, to who, where, what was your target, achievements etc etc. ---> Where did you sit in your team - e.g. you're THE person, one of a few, were you the first hire, are you the go to for X thing? ---> What actually was your role - e.g. did YOU really create X outcome entirely yourself? where did you come in? did you own a certain part? etc ---> Choose words wisely - e.g. 'I'm an IGA expert' - does the word 'expert' truly reflect your expertise & can you back that up in conversation? Did you lead something? Did you actually create what you say you did? ---> Think about keyword vomit - Does the person reading know what your expertise is? - I often see job titles & and bunch of key words. Are they all relevant? Do they give the right/wrong impression about your skillet? ---> IMPACT & VALUE - so so important to share where you can. E.g. improved something by X percentage, delivered X time period ahead of schedule. Took on a complex project alone? Think about outcomes... Happy IAM-ing 🆔✌🏻 #careers #iam #identitysecurity #identityandaccessmanagement

56

2 Comments

The UK National Cyber Security Centre (NCSC) has released new PQC guidance. Jason Soroko and I take exception to the dates it gives and explain why in the Root Causes Podcast. Audio: https://lnkd.in/guqbbmuq Video: https://lnkd.in/gVm9iDGB

26

The UK Government has released guidance for a voluntary Software Security Code of Practice, with plans for offering a certification based on compliance. There are four themes: Secure design and development, Build environment security, Secure deployment and maintenance, and Communication with customers. The guidance consists of fourteen principles which are reasonable for vendors of all shapes and sizes to satisfy (at least to some degree). I typically dislike these generic guidance documents stating things like "Distribute software securely to customers," but not everyone is fortunate enough to have a team of internal security professionals. If it's any signal for software supply chain security, to see even the most fundamental guidance include software composition analysis and maintenance of third-party components is a huge win!

24