War Games Aren’t Just for Warriors Anymore

/in /by

Starting weeks into the Russian invasion of Ukraine, the North Atlantic Treaty Organization’s (NATO) Cooperative Cyber Defense Center of Excellence is hosting the event in neighboring Tallinn, Estonia. These virtual exercises come at a time when Russia again demonstrates its preference to wage a hybrid cyber and kinetic war.

This era of hybrid warfare means that it is not only military and government organizations that need to prepare for cyberattacks from nation-states like Russia and China or state-sponsored actors and sophisticated cybercrime gangs. In this hybrid era, there is no distinction between combatants and non-combatants. Civilian targets across all industries are in the cross-hairs, and we have yet to develop the equivalent of the Geneva Convention that established international legal standards for humanitarian treatment in war.

Leading up to the invasion, Russia allegedly launched cyberattacks against 70-plus government websites, services, and banking. Throughout the campaign, they’ve gone after utilities and telecommunications infrastructure. Additionally, it appears the UK and its international allies are investigating a report from the UK National Cyber Security Centre (NCSC) alleging that Chinese actors had targeted more than 600 Ukrainian targets, including the defense ministry.

Before the invasion, it was no secret that criminal cyber gangs operated within friendly borders, such as Russia, from which they launched repeated campaigns against western government and civilian targets in the United States, Canada, the United Kingdom, Ireland, and Australia. These gangs operate with impunity or from districts that lack the enforcement wherewithal to prosecute criminals. It’s generally accepted that as long as these gangs don’t attack domestic targets, then the “the enemy of my enemy” ethos applies. But when Russia elected to invade Ukraine, it’s likely that Russian officials called in the favor and recruited domestic criminals to operate as state-sponsored actors in coordinated attacks against strategic assets in Ukraine.

Oftentimes, state-sponsored actors are civilian affiliations, like the Conti ransomware gang, sharing resources and even funding while directed by government institutions. In other words, civilians participate in aggression alongside their military comrades. This blurring of the line between combatants and civilians is not the only erosion of its kind in the war against Ukraine. As Russian forces attack civilian targets such as schools and hospitals and fight to capture non-military targets and territory, it’s a reminder that we now live in a world with little distinction between legitimate war targets (military) and protected participants (civilian).

Perhaps not since World War II that Europe has witnessed this level of aggression against civilians and the destruction of cities and civil infrastructure. This is not the only relevant comparison. It was the end of World War II that ushered in the cold war, in which NATO and Soviet powers maintained an adversarial posture while avoiding all-out military aggression. The cold-war tensions between the superpowers of the East and West were balanced on the cantilever of nuclear devastation and ran its course in a gray world of espionage, theft, and sabotage.

Espionage is no longer spy-vs-spy crossing the Berlin Wall in a digital world. It’s full-out cyber espionage, digital theft, financial fraud, and extortion. Until the invasion of Ukraine, I called it the “gray cyberwar,” keeping the global temperament just below the boiling point. It seems Russia’s determination to push the west to the brink means it’s no longer a cold war. And it no longer discriminates between military participants and defenseless civilians. As a result, businesses with no government or military affiliations are an open target for unleashed cybercriminals. Industries of all kinds often feel the aftershocks of the tectonic geopolitical events such as tensions in the Middle East, trade wars with China, and now the Russian war on Ukraine. And it reiterates what I’ve been saying for years.

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Energy (DOE) published a joint Cybersecurity Advisory warning against attacks on US and international targets. CISA also regularly publishes alerts about Russian state-sponsored actors, such as Conti, operating against western targets.

Well before the Ukraine war, cybercriminal gangs operated like Fortune 500 companies, relying on an ecosystem of criminal expertise to minimize operational costs and maximize returns from their activities to generate record profits. These groups go after healthcare providers, manufacturers, law firms, accounting services, etc. They use well-established tactics, techniques, and procedures (TTP) to infiltrate and exploit these targets.

Ransomware-as-a-service mirrors similar SaaS services but offers small criminal groups the opportunity to leave or revenue share sophisticated malware sets and experts. These cartels often operate under a common brand name (Conti, Ryuk, DarkSide, etc.) and offer services to assist victims in paying ransoms or other extortion fees.

The Truth About Cybersecurity:

As I wrote in my book, No Safe Harbor: The Inside Truth About Cybercrime, there is no longer collateral damage. There is only damage, and it’s inflicted on businesses like your own. As an IT security practitioner and business leader, you must defend. And one of the first steps is to identify the risks that face your operations and plan a response that can mitigate or minimize the impact on your business.

Take a page from NATO and run a cyber wargame. Perhaps not to test your skills in attacking targets, but to predict attacks and test your security defenses and your ability to make the critical decisions that make the difference between a close-call event and a massive, public disruption. Running cross-company table-top exercises that simulate cyberattacks is one of the best ways to test your metal when making difficult choices during a cyberattack, like a ransomware offensive that shuts down your operations.

As I am fond of saying, cybersecurity is not an IT problem to solve; it’s a business risk to manage. Many of the decisions made have nothing to do with IT or technical decisions, leading to the second-order effect that has a business consequence. For example, a reasonable decision to suspend compromised credentials or internet-facing services can lead to public disruptions eliciting media attention. A technical decision leads to crisis communications and awkward interviews on the evening news.

Far too many companies paid ransoms as their go-to response. Now insurers are pushing back with increasing premiums, tighter security requirements as part of the policy, and a growing trend to refuse claims when those policy requirements are not mine. I am not referring to complex requirements. Unmandated multi-factor authentication, missing security awareness training records, or the lack of security management using a SIEM lead to denied claims, canceled coverage, or refused renewals.

What’s more, paying ransoms can put corporate officers on the wrong side of several federal laws. The US Treasury issued advisories warning against payment to individuals, groups (ransomware gangs), affiliations, institutions, or nations on the Office of Foreign Assets Control (OFAC) sanctions lists. The issue is more complicated, but it reminded me of the quip I used to apply with the C-suite that ROI now stands for Risk of Incarceration. Yes, I’m joking—sort of.

The laundry list of business decisions that confront leaders as they face shutdowns, mounting operational costs, and lost revenue, goes well beyond the simple examples I’ve provided.

How to Run Incident Response Simulations:

When it comes to running table-top exercises or incident response (IR) simulations, here are some suggestions:

The war on Ukraine is a humanitarian disaster and serves as a warning for what our hybrid cyber-kinetic world looks like when aggression boils over. Remember, no matter the size or nature of your business, and you are a target for cybercriminals. They are smart; they will gain access if they want into your organization. The best thing you can do is hope for the best and prepare for the worst. As Winston Churchill famously said, “Never let a good crisis go to waste.” The war on Ukraine is a crisis. Don’t waste this opportunity to prepare your organization for a cyberattack.

Remote Work and The Human Error: 3 Major Challenges

/in /by

As the world begins to return to our new sense of normalcy, most people opt for remote work instead of going back into the office. According to CNBC, “new research from CareerBuilder found that jobs allowing employees to work from home full- or part-time saw seven times more applications than in-person roles last month.” With such significant change comes growing pains, and as the lines between home and work become blurred, security risks soar. Corporate jobs are evolving, which means organizations and IT professionals need to make changes to keep up. Let’s look at three of the biggest rising challenges with remote work.

Challenge 1: The Human Error

According to Forbes, in the past 12 months, one in four employees (26%) have lost their jobs due to a mistake that compromised their company’s security. Cybercriminals are happily targeting remote workers who lack IT support. Most companies are falling behind in providing the same support to employees remotely as they would in the office, and cybercriminals have taken note. To make matters worse, many are not adequately trained on cybersecurity awareness, causing errors to slip through the cracks of their fragile IT landscape. Forbes also reports:

“Two-fifths (40%) of employees sent an email to the wrong person, with almost one-third (29%) saying their business lost a client or customer because of this error.

Over one-third (36%) of employees have made a mistake at work that compromised security, and fewer report their mistakes to IT.

On average, a U.S. employee sends four emails to the wrong person every month—and organizations are taking tougher action in response to these mistakes that compromise data.”

Employees are not entirely to blame when there is no robust cybersecurity awareness training or credible command center for security operations to shift the burden onto. Human error is often inevitable. However, the more you know, the more you can avoid making careless mistakes that might cost your organization more than an apology can pay for.

Challenge 2: Skill Gaps are Growing

As discussed in a previous blog post, the cybersecurity industry is experiencing an extreme talent shortage across the country. Some of the many reasons this gap exists include lack of diversity, trouble attracting candidates into the field, and a continuous change in skillset demands. Closing the skills gap must be a combined effort by companies and professionals. To help close this gap, companies should consider doing the following:

  • Upskilling: Consider closing the skills gap by upskilling and reskilling current employees. By giving internal candidates the appropriate training, they may be able to fill open roles in addition to mentoring and training new hires.
  • Diversity: According to a McKinsey report, companies in the top quartile for gender or racial and ethnic diversity are more likely to have financial returns above their national industry medians. Adopting more inclusive hiring practices will only benefit organizations in the long run.

IT professionals have become the backbone of many businesses. They lead the pack in managing a healthy and robust IT environment, including consistently updating and patching holes and conducting cybersecurity awareness training.

Challenge 3: Disaster Recovery and Digital Transformation

The past two years have brought holes in companies’ IT landscapes to light. Many companies were not fully prepared to have employees and operations moved to fully remote environments, which has propelled the need for digital transformation. It has also called for organizations to prioritize disaster recovery and prepare for the future.

Now that we have moved past survival mode and remote work is the new normal, we can embrace this era of digitalization. Turning this challenge into an opportunity can open many doors to companies’ security. If your company begins looking into options for securing employees and building their cyber awareness knowledge, you can create better moral and data protection for your organization.

Mitigating the Remote Risk: Secure Staff Wherever They Are

Working from home is a significant game-changer for corporations and will not disappear anytime soon. Any company looking to attract talent and provide location flexibility must become diligent when managing the risks of remote work.

Prevention is key. Humans have proven time again that they can be the weakest link to an organization’s security, so it is essential to address that reality. Too many corporations look at defending against cyber risk as an expense or afterthought when it needs to be a priority. Cybercrime is continuously evolving; cyber awareness training and investing in a security and compliance automation platform will help mitigate the risks that come with it.

The Rise of Municipal Cyberattacks: Becoming Proactive

/in /by

Municipalities are expected to respond to the demanding needs of maintaining and sustaining vital sectors within our communities, so cities carry a heavy burden of responsibility; now more than ever, they must take cyber threats into account. It is no secret that the municipality industry operates under strict budgets that limit their resources, making them vulnerable and prime targets to cybercriminals. In 2020, 44% of global ransomware attacks targeted municipalities, according to InfoSecurity. This blog will explore four prevention methods your organization can implement to avoid cyberattacks and reduce costs.

Reducing Cost: How to Prevent Cyberattacks on Municipalities

The best way for municipalities to protect themselves from attacks is to prevent them from happening in the first place. Sounds simple, right? It can be. There are solutions to deal with malware infections, but most require more technical skills than the average computer user, so prevention is critical. Let’s start with the easy wins for prevention.

  1. Implement Robust Cybersecurity Training: One of the most significant risks for breaches can be the government’s employees. We are only as strong as our weakest link, and cybercriminals know this. A great way to start building awareness is to create a best practices guide and require consistent cyber awareness training for your employees.
  2. Know the Warning Signs: The first step to combatting malware is recognizing that your computer may have been affected, and it can only be removed if it is appropriately identified. Below are 10 warning signs to look out for:
  • Your computer is freezing or crashing.
  • Your computer runs slow and takes longer to start up/shut down.
  • Ads start popping up.
  • Emails you did not write are being sent on your behalf.
  • New icons are appearing on your desktop or toolbar.
  • Software is difficult to remove or will not allow removal.
  • The battery won’t last.
  • Computer locks and ransom is demanded.
  • Your browser is getting redirected.
  • Everything is normal – this is the most dismaying non-warning sign of them all.
  1. Create Secure Backups: Backups make for an easier recovery after being attacked by malware. There have been ransomware attacks in the past where confidential files could never be recovered—remember when the City of Atlanta’s data was held for ransom in 2018? As a result, years’ worth of confidential police dashcam footage was never recovered. Malware attacks are inevitable, so preparation is vital.
  2. Patch Management: Developers are consistently working on discovering vulnerabilities in their software. Once they are found, patches or updates to fix those vulnerabilities are released. It is crucial not to procrastinate on software updates. When a security network is outdated, cybercriminals see these flaws and attack within those holes. The more out-of-date security is, the more risk you put on sensitive data and information. Investing in Continuous Vulnerability Management (CVM) will not only help with finding vulnerabilities but fix them by discovering and assessing them in real-time. Here is a breakdown of CMV:
  • CMV Lifecycle
    • Asset Management allows known and unknown assets to be automatically discovered, categorized, identified, and managed.
    • Vulnerability Management includes real-time vulnerability and misconfiguration detection within each industry’s most comprehensive range of devices, operating systems, and applications.
    • Threat Detection & Prioritization automatically prioritize the vulnerabilities posing the most significant threats to an organization.
    • Patch Deployment deploys patches across any size environment, keeping systems up-to-date reducing the vulnerabilities operating teams must chase down.

Focusing on the Bigger Picture

Anti-virus programs are not enough to protect municipalities or businesses when constant monitoring is necessary. Regardless of size or location, municipalities’ cybersecurity is a critical issue. Focus on the basics first, teaching password and email security, best practices within any organization, and implementing a cybersecurity platform that includes managed services. Mitigating the level of destruction from malware attacks will reduce costs in the long run.

Malware Madness: Combatting the Chaos

/in /by

It’s that time of year again when millions of people dedicate valuable time, effort, and money crafting the perfect bracket for March Madness. Even with slim chances of winning, followers still spend hours researching teams and submitting their brackets online. However, many do not know that they are perfect targets for cybercriminals.

There are increases in phishing emails, sites, and messages during March Madness, all designed to fool people into submitting teams last minute, leaving them with busted brackets or empty bank accounts. These emails and messages are vehicles used for malware. While there may not be a high chance of winning with a perfect bracket, there is a high probability of being attacked by some type of malware.

According to Comparitech, 74% of organizations experienced a malware attack last year, and it may be the biggest threat to you and your organization because it exploits weaknesses within your IT landscape. Let’s talk about what malware is, the common types, and how to combat it.

What is Malware?

Malware, or “malicious software,” is a worldwide issue that is continuously evolving. It is also an umbrella term describing viruses, ransomware, worms, and any other type of software, file, or code made to destroy. Cybercriminals use malware to intentionally wreak-havoc to harm a computer, network, or server. In 2020, over 268,000 “never-before-seen” variants were detected, adding to the existing amount.

Common Types of Malware:

  • Virus
    • A computer virus is a “malicious code that replicates by copying itself to another program, computer boot sector, or document and changes how a computer works,” TechTarget Network It can spread innocently when an employee opens an infected email attachment file or visits a malicious website.
  • Worm
    • Worm malware is a program spread through software vulnerabilities that copies itself from computer to computer. Much like viruses, worms can infect your computer from spam emails or messages. Most firewalls or default security settings can block worms.
  • Trojans
    • Trojan malware is mainly used as a vehicle for hackers to let other malware into a network. They are much different from other types of malware because they are hidden and disguise themselves as legitimate programs to download. They survive by going unnoticed while slowly collecting private or sensitive information over time. It is essential to ensure that what you are downloading is legitimate—always double-check.
  • Spyware
    • Spyware is exactly how it sounds. It is malware that infects your computer and silently collects data from you, including what you download, usernames and passwords, credit/debit card information, etc. There are countless ways spyware can infect your security system, making it difficult to eliminate. The main issue is that this malware tends to go undetected, leaving you vulnerable.
  • Ransomware
    • As we have explored previously, ransomware takes the cake as one of the fastest-growing types of malware. The Cybersecurity and Infrastructure Security Agency (CISA) describes ransomware as “a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption.” If a ransom is not paid, cybercriminals threaten to expose sensitive information or sell data.

Combatting the Madness of Malware

With the percentage of malware attacks being so high, it is imperative to arm your network with the right security solution. Malware can only be removed if it can be appropriately identified. The reassuring truth is that there are preventative tools and services that secure your IT landscape and cyber awareness best practices to implement within your business. Antivirus programs are not enough to protect your business when consistent monitoring is essential. Consequently, it is crucial to educate your organization on security services platforms that only take 90 minutes to deploy and can help you protect against the madness.

Social Media and Cybersecurity: What’s the Relationship Status?

/in /by

It’s clear. Social media and cybersecurity have quite a relationship. We often expose essential parts of our lives on the web, down to the tiniest details. As a result, we should know how social media and cybersecurity mingle. Previously, we’ve discussed the impact social media has had on cybersecurity and the power of misinformation. But now that some time has passed, you may be wondering: what’s the update? What does the relationship look like now? Well, hold on to your seats. After massive shifts like data privacy updates and other emerging trends- this will be a whirlwind.

According to Statusbrew, “over the past 12 months, the number of active social media users increased by more than 400 million, an addition of 9.9% for the total number to reach 4.55 billion.” Shocking? Not exactly, but a great reminder that social media is one of the most popular forms of communication around the world today. Although most social media platforms have security settings, cybercriminals find ways to access sensitive information. This sensitive information can include your passwords, bank account details, email addresses, or anything that they can use to steal your identity. For that very reason, social media and cybersecurity need each other now, more than ever. Let’s explore:

Significant Changes Call for Cybersecurity

Social media platforms are constantly changing their policies and algorithms, and with new updates come new security risks. Social media platforms must rely on cybersecurity protocols and best practices to mitigate risk. Let’s look at Facebook’s plans to transform into Meta as a popular example:

In 2021, Facebook announced that it would change its name and rebrand itself to — Meta. Meta will be based around Virtual Reality (VR) and augmented reality. Although the social media platform’s structure will stay the same, the new rebrand raises possible concerns about privacy and security. This presents the possibility of data such as usernames, email addresses, and other sensitive information being mishandled or breached by bad actors attempting to break into this new space. Subsequently, the power of cybersecurity comes into play at this moment.

Significant changes in cyberspace are bound to call for shifting priorities and ensuring that user safety and security come first. Social media platforms must roll out privacy and security settings that outline how user data will be utilized and protected. Meta’s new privacy policy can be found here.

What Role Do You Play?

Like all relationships, social media and cybersecurity face challenges. However, throughout it all, they rely on one another to keep individuals safe. As the popularity of social networking sites among businesses worldwide increases, cybercrime will take a bigger bite out of companies unprepared for battle. Whether you are an organization using social media to help generate brand awareness or an individual using social media to keep up with friends, you must be aware of your responsibilities concerning security. A few of those responsibilities include:

  • Use two-step authentication to enter and protect all accounts.
  • Keep your passwords updated regularly; refrain from repeating the same password across multiple accounts.
  • Manage your privacy settings.
  • Use precaution on all platforms; if something looks suspicious, report it.

Keeping the relationship between social media and cybersecurity healthy is not an easy job that can be done quickly. It will require help from us all by using these social platforms directly as they are intended.

Two Peas, One Pod

As long as the Internet of Things is around, bad actors will continue to pose a massive threat to businesses and personal lives. Social media’s intent is to provide access to one another by sharing our personal information and experiences, making it the primary target for hackers.

To sum up the ongoing status of this relationship, social networking sites will always need cybersecurity to protect shared experiences and information. Cybersecurity will always need social media as a channel to communicate the importance of navigating the cyberworld safely.

If you’re interested in learning more about this evolving relationship, check out a recent blog post: Cybersecurity’s Latest Battle: The Rise of Misinformation on Social Media.

2022 Need to Know: The Importance of Data Privacy

/in /by

As humans, we constantly battle the balancing act of our online life with offline life. Unfortunately for us, those lines can be easily blurred; from oversharing to data breaches, there is much opportunity for disaster. This is precisely where the power of data privacy comes into play.

Data privacy often referred to as information privacy, is the proper handling of sensitive data, including personal and other confidential data. This type of data can include financial, intellectual property, and more. Data privacy is all about limiting who has access to this information and how they can use it. Now, do you see its importance? If not, keep reading; there’s a lot more to uncover here.

Data Privacy and Your Safety

Whether or not you are an avid internet user, the probability that your personal information is available online is more significant than you think. From Google to personal social media accounts, it’s beyond your control once your personal information reaches the internet. Data privacy is important because it has regulations to protect your information. The concept is centered around the way data should be collected, stored, managed, and shared with third parties.

Securing your customer’s sensitive data should be your main priority. Cybercriminals are attracted to cracks in an organization’s or platform’s security infrastructure. Ensuring that all data privacy rules and regulations are followed by your organization, employees, and customers is vital to safeguarding information.

3 Elements of Data Privacy

The CIA Triad is a benchmark model created to govern and evaluate how organizations store, transmit, and process data. According to CISecuirty, below are the top three elements of data privacy:

  1. Confidentiality – Data shouldn’t be accessed without proper authorization. This ensures that authorized parties are the only people that have access to the information.
  2. Integrity – Data shouldn’t be altered or compromised. This element assumes that data remains in the intended state and should only be edited by authorized parties.
  3. Availability – Data should be accessible upon legitimate requests only. This ensures that all authorized parties have access to the data when required.

The main goal is to give individuals control over their data while it is in the hands of a third party. Companies need to understand how to respect personal data while also processing it. Trust is a significant piece of a successful business, and people need to feel like their information is in safe hands.

So Why is Data Privacy Important?

There must be a reason why this topic has its own day every year, right? The answer is yes. Data privacy is important because it holds organizations and individuals accountable when dealing with confidential information. Regulatory compliance is an essential piece to this puzzle because it requires businesses to meet legal responsibilities for collecting, storing, and processing the personal data of their partners, customers, and employees. Any form of non-compliance or misuse of information could lead to a significant fine or lawsuit.

Long story short, it is vital to ensure all your bases are covered when it comes to data privacy to prevent any unwanted activity or breaches. As 2022 begins, it is 100% better to be proactive with your data instead of reactive. It’ll save you money, time, and your brand reputation in the long run.

Cybersecurity Matters: Why Cyber Awareness Training Should be a Priority

/in /by

With cyber threats like data breaches and ransomware attacks becoming more common, to new regulations surrounding the cyber world, cybersecurity has become somewhat of a necessity. Every industry needs it whether they know it or not. As we enter October, which is also National Cybersecurity Awareness Month (NCSAM), Adlumin is back with some great insights. We believe that spreading awareness is key to stopping cybercriminals in their tracks, and here’s why.

Every aspect of our society relies on technology, which can be our greatest power, and our greatest downfall. As the world of cybersecurity continues to navigate through various trials and tribulations, awareness through education is the only way to remain resilient.

But, enough about its power. Let’s get into why spreading awareness is necessary and what you can do to contribute to a healthy cybersecurity ecosystem for your organization and worldwide.

Cybersecurity Awareness Training for Employees

Cybersecurity is essential because it is the shield that protects data and sensitive information from falling into the wrong hands. As a company, it is your responsibility to set your employees up for success. That should include providing employees with knowledge, tools, and training to ensure they fully understand and adhere to their information security responsibilities. Below are a few truths that will explain why cybersecurity awareness training should be an integral part of your company’s culture:

Truth 1: Cybercrime isn’t going away.

Cyber-attacks are happening daily. Tech Jury reports that every 39 seconds, there is a new attack somewhere on the web. Hackers thrive off vulnerability, which is the current state of many companies globally. Suppose your employees are not fully exposed to the reality of how data breaches, ransomware, or other threats can affect your organization’s success. The possibility of a hacker taking advantage of these individuals dramatically increases. After all, it only takes a small misstep to bring down an entire ecosystem.

Truth 2: Education is vital.

You know the old saying, “if you knew better, you’d do better?” Well, it can apply to cybersecurity. There is so much to learn about the industry, from the various types of cybercrime to prevention—it becomes information overload. However, as an organization looking to stay out of harm’s way when it comes to cybercriminals, it is best to educate your employees on the following:

This list only includes a few examples; the scope of cybersecurity awareness is far-reaching. The key is to prioritize the training topics and tools based on your organization’s needs.

Truth 3: Insider Threats are real.

External threats are scary, but there is nothing more frightening than knowing the real danger is inside your organization. According to The Department of Homeland Security, “insider threats, to include sabotage, theft, espionage, fraud, and competitive advantage are often carried out through abusing access rights, theft of materials, and mishandling physical devices.” However, not all insider threats are intentional, and some are negligent. Employees can avoid simple mistakes if they know what an insider threat is, and how a simple error or accident can become a major cybersecurity concern for the organization or individual.

Work Smarter, Not Harder

Your employees have access to sensitive data that is essential to the overall well-being of your company. Therefore, your employees need to be aware of the responsibilities and accountabilities when using their company laptops, mobile devices, and other technologies. Training courses should be a yearly requirement, and cybersecurity policies should be updated quarterly, keeping in mind that new threats and tips are created daily.

Human error is a significant threat to your organization. However, unaware, and untrained employees are one of the most significant threats of them all. Make this October’s NCSAM count – it’s a decision you can’t afford to ignore.

Visit Adlumin’s National Cybersecurity Awareness Month resource page for additional resources.

Explore More

Log Parsing for Network Security Threat Detection

/in /by

Firewall, VPN, and network security device logs can provide insight into a wide variety of malicious activities, including remote code executions, port scanning, denial of service attacks, and network intrusions. However, analyzing these logs presents several challenges.

These data streams are high velocity; even small and medium networks can produce thousands of logs per second with significant fluctuations throughout the day. A network comprises several different devices manufactured by different companies, so manually defining rules for parsing log data is unfeasible and would break as devices are updated. Preventive measures against malicious activity must be taken quickly, meaning that we need an online process to deliver insights that are useful for more than forensics.

At Adlumin, we’ve designed around these challenges and built a fast, parallelizable system capable of handling new log formats and deployable on streaming data. We own a patent that covers this method for ascertaining whether log data is anomalous and indicative of threats, malfunctions, and IT operations failures

Malicious activity nearly always produces unusual log data, so our system focuses first on finding anomalous data. Focusing on anomalous logs drastically decreases the volume of data that must be analyzed for malicious activity without running the risk of ignoring pertinent data. In this discussion, we’ll focus on how we determine whether log data is anomalous, as doing so enables a wide variety of techniques for searching for malicious activity.

As an overview, our system trains itself on-device log data that we’ve recently received. Based on the data, the system builds a set of templates that correspond to commonly seen log content and structure. The system also computes a measure of how rare each template is and builds an anomalous scoring threshold. When new data is received, it’s checked against this template set and assigned a score based on the template that best matches the data. If new data that does not directly correspond to a template arrives, then a measure of the difference is added to the score. Data with a score above the anomalous scoring threshold is considered anomalous.

Training

We begin by training our system in a batch process on recently ingested log data. We create a set of templates by grouping similar logs together. Automated systems generate logs, so they contain a mix of parameters (e.g., an IP address, a timestamp, or a username) and fixed messages (e.g., “connection opened” or “user logged in”). Our system uses a token-based parser tree to associate logs that have the same fixed messages, but that may have differing parameters.

Before applying the parser tree, logs are preprocessed. Logs are tokenized according to common delimiters. Then, they are preprocessed by applying pre-defined regex patterns that replace well-known parameters (e.g., r’ [0-9a-fA-F]{12}’ for a 12-digit hexadecimal value) with specialized parameter tokens. Typically, any token that contains a number is also treated as a parameter and replaced with a parameter token. Once preprocessed, the parser tree can determine log associations.

Thus, the intuition is that logs said to be similar in the content will have similar sequences of messages and parameters that can be represented as tokens for easy comparison. The first layer of the parser tree is assigned based on the total number of tokens in the preprocessed log. This step is utilized because parameters are typically a fixed number of tokens, meaning this step quickly groups associated logs. Subsequent layers of the parser tree are fit according to the token in the nth position of the preprocessed log, where n comes from a pre-defined set of token positions. To prevent parser tree explosion, if the number of branches at any given layer exceeds a threshold, then a wild card token is used for all new tokens.

Once the bottom of the parser tree is reached, if there are no other logs already at this position of the parser tree, then the incoming log is used as a new log format. Otherwise, the incoming log is compared to the log formats at this position using token edit distance.

If the incoming log is sufficiently similar to an existing log format, then the log is associated with that format. In addition, the log format is updated such that any dissimilar tokens between the log format and the incoming log are replaced with wildcard tokens. If the incoming log is insufficiently similar to all existing log formats, then the incoming log is used as a new log format.

Once all training logs have been processed, all the log formats generated by the parser tree are returned. Particularly rare log formats are dropped. For each log format, we generate a log template which includes: a regular expression pattern capable of matching logs associated with the template, a set of the tokens contained in the log template, and a log template score based on the frequency that the log template appeared in the training set.

Another set of recent log data is used to generate a score threshold. Logs in this dataset are scored using the log templates. To score, an incoming log is preprocessed and checked to see if it matches any log templates’ regular expression pattern. If the incoming log matches a regular expression pattern, then it is assigned the score associated with the log template that it matches.

Otherwise, the incoming log’s tokens are compared to each of the log templates’ token sets using Jaccard similarity. The incoming log is associated with the log template that has the most similar token set and assigned a score based on the log template’s score and the similarity between the token sets. This matching process allows previously unseen log formats to be assigned appropriate rarity scores.

Once all the score threshold dataset has been processed, all scores assigned to logs are considered. Based on these scores, a global score threshold is determined using the percentile score and standard deviation of the set of all scores.

Inference

In contrast to the training process, inference occurs in a streaming environment and finds anomalous records in near real-time.

As in the score threshold process, incoming logs are preprocessed and either matched to log templates using regular expression patterns or token set similarity. The incoming log is assigned a score of the matched log template or the matched log template and a similarity measure, respectively. If the incoming log’s score is greater than the score threshold, then the log is considered anomalous.

To facilitate real-time analysis, we utilize AWS Lambda for conducting inference and a DynamoDB table for template storage. We’re able to spin up additional Lambda instances automatically and adjust DynamoDB read capacity as needs demand them.

Classifying logs and assigning rarity scores opens a wide variety of analysis opportunities: keyword lists that would otherwise generate numerous false positives are more effective when applied to the anomalous dataset. Log template associations enable time series analysis of specific log messages. By determining the location of parameters, specific information can be extracted and analyzed, even in unseen log formats. At Adlumin, we utilize a variety of these techniques to provide preventative alerts of specific threats, malfunctions, and IT operations failures.

Cybersecurity Maturity Model Certification Assessment

/in /by

Adlumin’s Cybersecurity Maturity Model Certification (CMMC) Assessment feature is a tool to help streamline an organization’s preparation for the U.S. DoD’s CMMC.

CMMC is a unified cybersecurity standard intended to guide DoD contractors in implementing the cybersecurity processes and practices associated with the achievement of a cybersecurity maturity level. CMMC maturity levels range from Level 1 to Level 5, and cybersecurity maturity is assessed across 17 cybersecurity domains.

The CMMC is designed to provide increased assurance to the Department that a contracting company can adequately protect sensitive, controlled unclassified information (CUI) and/ or federal contract information (FCI).

Adlumin’s CMMC Assessment feature is an easy-to-use self-assessment tool that gauges an organization’s progress towards achieving the appropriate target CMMC maturity level. The feature’s core functionality includes:

  • A dashboard providing a high-level overview of an organization’s current compliance level across all 17 CMMC domains based on the answers to a self-assessment.
  • Visualizations to easily identify gaps in an organization’s cybersecurity processes and practices that will prevent attainment of the target maturity level.
  • The ability to note and manage tasks, which are required to improve an organization’s cybersecurity maturity.
  • On-demand PDF reports that reflect the results of the self-assessment and report the current compliance level across each of the 17 CMMC cybersecurity domains.

Generic Fields

/by

a:8:{s:8:”location”;a:5:{i:0;a:1:{i:0;a:3:{s:5:”param”;s:9:”post_type”;s:8:”operator”;s:2:”==”;s:5:”value”;s:4:”post”;}}i:1;a:1:{i:0;a:3:{s:5:”param”;s:9:”post_type”;s:8:”operator”;s:2:”==”;s:5:”value”;s:19:”events_and_webinars”;}}i:2;a:1:{i:0;a:3:{s:5:”param”;s:9:”post_type”;s:8:”operator”;s:2:”==”;s:5:”value”;s:13:”success_story”;}}i:3;a:1:{i:0;a:3:{s:5:”param”;s:9:”post_type”;s:8:”operator”;s:2:”==”;s:5:”value”;s:7:”article”;}}i:4;a:1:{i:0;a:3:{s:5:”param”;s:9:”post_type”;s:8:”operator”;s:2:”==”;s:5:”value”;s:8:”download”;}}}s:8:”position”;s:6:”normal”;s:5:”style”;s:7:”default”;s:15:”label_placement”;s:3:”top”;s:21:”instruction_placement”;s:5:”label”;s:14:”hide_on_screen”;s:0:””;s:11:”description”;s:0:””;s:12:”show_in_rest”;i:0;}

Adlumin Cybersecurity

1140 3rd St. NE, Suite 340
Washington, DC 20002
(202) 570-7907

Get a Demo Free Trial Contact Adlumin
Adlumin Inc 5000

Privacy Policy  Sitemap  GDPR Privacy Notice

GDPR Data Processing Addendum  GDPR Privacy Request Form

Copyright 2024 Adlumin, Inc. All Rights Reserved