Cybersecurity learning from Sheik

Top 10 tips to protect your personal information!

2023-02-18T03:53:54.403000Z

Protecting your personal information is essential in today's world, where cyber threats and identity theft are becoming increasingly common. Here are 10 tips that can help you protect your personal information in your daily life:

Use strong passwords: Use strong, unique passwords for all your online accounts, including your email, social media, and banking accounts. Avoid using easily guessable passwords like your birthdate, name, or any commonly used words.
Enable two-factor authentication: Two-factor authentication adds an extra layer of security to your accounts by requiring a code sent to your phone or email to log in. This makes it harder for someone to access your account, even if they have your password.
Beware of phishing emails: Be cautious of emails that ask you to provide personal information or click on links. Phishing emails can look legitimate but are designed to steal your information. Always verify the email source and hover over links to check the URL before clicking.
Keep your software up to date: Keep your operating system, web browser, and other software up to date with the latest security patches. This can help protect your computer from known vulnerabilities.
Use a VPN: A virtual private network (VPN) encrypts your internet connection and hides your IP address, making it harder for hackers to spy on your online activity.
Check your credit report regularly: Check your credit report at least once a year to ensure that there are no fraudulent accounts or transactions in your name.
Avoid using public Wi-Fi: Public Wi-Fi networks are often unsecured and can be easily intercepted by hackers. Avoid using them to access sensitive information like your online banking or email.
Use a password manager: Password managers can securely store your passwords and automatically fill them in for you when you log in. This makes it easier to use unique and complex passwords for each of your accounts.
Shred sensitive documents: Shred any sensitive documents that you no longer need, such as bank statements or credit card offers. This can prevent identity thieves from stealing your personal information.
Be cautious on social media: Be careful what you share on social media, especially personal information like your address, birthdate, or phone number. Scammers can use this information to steal your identity or target you with scams.

30 cybersecurity search engines

2022-11-26T11:16:46.621000Z

Here are 30 cybersecurity search engines that i liked in my learning:

Dehashed—View leaked credentials.
SecurityTrails—Extensive DNS data.
DorkSearch—Really fast Google dorking.
ExploitDB—Archive of various exploits.
ZoomEye—Gather information about targets.
Pulsedive—Search for threat intelligence.
GrayHatWarfare—Search public S3 buckets.
PolySwarm—Scan files and URLs for threats.
Fofa—Search for various threat intelligence.
LeakIX—Search publicly indexed information.
DNSDumpster—Search for DNS records quickly.
FullHunt—Search and discovery attack surfaces.
AlienVault—Extensive threat intelligence feed.
ONYPHE—Collects cyber-threat intelligence data.
Grep App—Search across a half million git repos.
URL Scan—Free service to scan and analyse websites.
Vulners—Search vulnerabilities in a large database.
WayBackMachine—View content from deleted websites.
Shodan—Search for devices connected to the internet.
Netlas—Search and monitor internet connected assets.
CRT sh—Search for certs that have been logged by CT.
Wigle—Database of wireless networks, with statistics.
PublicWWW—Marketing and affiliate marketing research.
Binary Edge—Scans the internet for threat intelligence.
GreyNoise—Search for devices connected to the internet.
Hunter—Search for email addresses belonging to a website.
Censys—Assessing attack surface for internet connected devices.
IntelligenceX—Search Tor, I2P, data leaks, domains, and emails.
Packet Storm Security—Browse latest vulnerabilities and exploits.
SearchCode—Search 75 billion lines of code from 40 million projects.

Good list for quick reference for future. Sharing my learning

17 Free Cybersecurity learning platforms

2022-11-26T11:17:57.912000Z

Here are 17 platforms where you can begin learning cybersecurity:

HackXpert - Free labs and training.
TryHackMe - Hands-on exercises and labs.
CyberSecLabs - High quality training labs.
Cybrary - Videos, labs, and practice exams.
LetsDefend - Blue team training platform.
Root Me - Over 400 cybersecurity challenges.
RangeForce - Interactive and hands-on platform.
Certified Secure - Loads of different challenges.
Vuln Machines - Real world scenarios to practice.
Try2Hack - Play a game based on the real attacks.
TCM Security - Entry level courses for cybersecurity.
EchoCTF - Train your offensive and defensive skills.
Hack The Box - Online cybersecurity training platform.
Vuln Hub - Material for practical hands-on experience.
OverTheWire - Learn security concepts through challenges.
PentesterLab - Learn web-application penetration testing.
PortSwigger Web Security Academy - Extensive learning material.

Some may be freemium, if you have any other platforms to add then let me know

MFA Fatigue

2022-08-16T06:26:13.645000Z

What is MFA Fatigue?

If you haven’t heard about CISCO cyber breach, it has also become a reality. With the other security incidents such as the recent Solarwinds cyberattack, cybercriminals have established again that not even best tech companies are immune from their sophisticated attacks. "MFA Fatigue" is the hot topic in cyber security space now after this attack method has turned out to be root cause of this "in famous" CISCO breach. Let’s examine more about MFA Fatigue now.

We all have heard about two factor authentication and it is getting popular day by day. 2FA is supposed to provide additional layer of security for your accounts by requiring that you prove two things before being granted access to your accounts.

Something that you know – your login credentials - username, password/PIN/Passphrase

Something that you have – Sharing One Time Security Code to your mobile device, hardware token, SMS, Call. Also, these days with mobile apps 2FA comes as pop up notifications.

MFA Fatigue refers to user via MFA Applications receiving multiple or rather overload of second factor notifications. The user is tricked (by overwhelming 2FA requests) and will start setting security best practices aside and become careless, putting their company and their accounts in danger of compromise.Usually it starts with basics, attacker get the targeted user’s valid credentials via brute forcing, password spraying or reusing tricks. Then they will perform the 2FA notification requestspamming repeatedly until the user approves the login attempt and lets the attacker gain access to the account. This usually happens because the user is distracted or overwhelmed by the notifications and, in some cases, it can be misinterpreted as a bug or confused with other legitimate authentication requests.

In this latest episode, the CISCO employee received multiple calls (vishing) over several days in which the threat actor claimed to be from a support organization trusted by the employee. Following this, the threat actor enrolled a series of new devices for MFA and authenticated access to CISCO VPN.

Like information security Practitioners often say – "Human is the weakest link in information security", in this attack also it is not the technical ability of attacker which succeeds, but the right exploitation of human factor of MFA usage. Many users who fell for this attack, had just wanted these 2FA mobile application notifications to disappear.

There are multiple advisories from tech gurus on how to detect & prevent these MFA Fatigue attacks such as configuring Service limits for MFA Services, customizing the alert rules from log in inspection queries etc. I would rather suggest to disable Push Notification features of such MFA applications will drastically reduce the likelihood of such attacks. An legitimate user who is trying to login to a account should be aware that he has to open the MFA application to further approve the transaction. Ofcourse it has an impact of user experience, but it is a question of security vs usability and the DATA or BusinessImpact should decide whether former or later should be deciding factor while designing MFA.

Thanks for reading it this far! Wish you a secure digital experience ahead!

This article is written by Sachin Babu

Head of Cybersecurity GRC – Oil & Gas Sector Company

An insider’s perspective: Who is the best fit for CISO post?

2022-07-31T15:36:27.504000Z

In this era where data breaches have a major setback on organizations due to the eye bouncing penalty, this is where a Chief Information Security Officer’s role becomes vital in upscaling the security infrastructure. CISO is a position which many may envy to indulge in the future and not to mention it is undoubtedly the head of the class in the IT Industry – literally and poetic.

But the million-dollar question is – who can do justice to the role in all its capacity?

As such, it’s a position that requires a recognized track record of extensive experience and knowledge, Awareness and understanding of the enhanced technologies and the eye to every notion of cyber security Industry. I would personally refer to the above statements to be the so-called C-Suite that the eagled corporates look for with in the industry. With the booming of Cyber Security in today’s generation, it still surprises me on most corporate giants on the hierarchy structure or reporting structuring of Cyber Security Officer to the CIO/ CTO where as it should be to the visionary of the organization which is the CEO. That is another topic to debate and may not be able to easily conclude.

In some of the pre-Y2K era pioneer Organizations we would have come across some of the ICT Engineers and IT Project managers turned out CISOs, probably after a major breach and then most of them are operating the cybersecurity function like a pure IT task. This will not help to eradicate the real cybersecurity risks of the company. Cybersecurity framework must not be established to just meet regulatory requirement or to clear Big 4 Checklist and rather it should be designed with an in-depth and futuristic defense in depth model. Only a good CISO can help to inject security aspects in all business elements. It needs a great vision and practical mission.

On the other side of corporate word - especially in recent expanded companies and startups, you may see a different breed of CISO office - with multiple years of experience as security auditor, security engineer, security analyst, ethical hackers grabbing the senior roles such as security director and finally reaching the CISO milestone. While the former technocrats get into these roles to fulfil an audit finding or after security breach and then they learn about security process and its functions, the later typically are with fine-tuned security knowledge from their experience, exposure to latest threat landscape, with security certifications etc.

Now, one must agree there is NO cybersecurity canon that who is the apt candidate to be chosen for this this CISO role. From my experiences with interacting with multiple CISOs in the past from work and consulting roles, I would suggest an experienced IT specialist, be it a programmer or network engineer whose has in depth interests and "aptitude" in cybersecurity can molded to become a senior cybersecurity professional. Such people will understand the IT issues while deploying a security process or employing security solution in to the company’s IT landscape. In this modern era, Management do not wish to see just gaps and audit findings, they need solutions and faster efficient counter measures to detect and prevent any security mishaps from materializing. With a pinch of project management experience, the CISO recipe should yield good results meeting any organization’s cybersecurity risk appetite. At the end of the day, any security investment should be deployed at the earliest and run in the most efficient manner for detecting and preventing any security vulnerabilities from being exploited.

However, in reality we often say any C-Suite roles involves only P&P – "Power Point Slides and Politics", to me a matured cybersecurity KPI matrix and external assurance (ISO27K, SOC2 etc.) should do the lip service for any CISO in the board meetings. On a subtle note, a modern CISO should have strong technical and security knowledge and must be able demonstrate- it is aligned with the organization’s strategic and business objectives.

This article is written By Sachin Babu

Head of Cybersecurity GRC – Oil and Gas Sector Company

How to secure your android device?

2021-08-09T15:48:41.847000Z

Introduction

Android is am opensource mobile operating system. If you are here reading this then you would really know what is android and does not need introduction of android in detail. But what most dont kow compared to iOS android also strives to be the most secured mobile OS and the race continues with iOS in every release of the android version. Android incorporates industry-leading security features and works with developers and device implementers to keep the Android platform and ecosystem safe.

Some common android devices

Android is becoming increasingly popular with major device manufacturers and some of the devices apart from Phones and Tablets

Watches
Smart glasses
Home appliances
Cars
Home Automation Systems
Camera
Smart TVs
DECT Phones
Games Consoles
Mirrors

Android is on quite a ride as the list of possibilities keeps increasing every day

What are the common threats of android devices and iOS

Android devices are hugely popular which makes the developers build more apps for android. This also makes android devices the most targeted by the hackers.

The threats can be

Malwares and Spyware
Exploits to gain root access
Identity theft
Phishing in app
Smishing attacks
Supply chain compromise
Cryptominer
Click fraud advertising

Framework of Android

As a user of android device you will be most interested on Apps which is enduser touchpoint.

The two primary sources of apps are:

Preinstalled apps: Android includes a set of preinstalled apps including phone, email, calendar, web browser, and contacts. These function as user apps and they provide key device capabilities that can be accessed by other apps. Preinstalled apps may be part of the open source Android platform, or they may be developed by a device manufacturer for a specific device.
User-installed apps: Android provides an open development environment that supports any third-party app. Google Play offers users hundreds of thousands of apps.

What to do to secure your device?

Use Authentication to login: Biometric fingerprint or facial or Iris , your choice but use it.
Apps from Google Play only: Use only apps from Google Play. Android allows you to download and use third party apps which are not reviewed and licensed by google. If you are unsure about an app and you are trying to download it off the internet, then just avoid it if you do not know what you are doing.
Updates: The Android update service delivers new capabilities and security updates. Make sure your device have auto update enabled for your apps and devices.
Verify Apps: Warn or automatically block the installation of harmful apps, and continually scan apps on the device, warning about or removing harmful apps.
Review Permissions: Check the permissions you have provided to apps. If any app unnecessarily requires a permission then immediately be suspicious about it and remove teh permission.
Monitor Network Traffic: Check for unknown traffic your apps generate. How to check that either by android app monitor or you also use Glasswire( my personal favourite, Note: it is not sponsored🙂 )

A small tip for physical security, you can use Android Device Manager on web app and Android app to locate lost or stolen device.

Conclusion:

No devices are fully secured and it is always a race between attackers and defender. At the best we can do is to take the necessary steps to protect our devices known to our knowledge and keep our data safe. Both Android and iOS are equally popular and we shall cover the iOS security on a different day. I hope this article would have given you a brief overview of android framework and how to be secured using Android device. You can find more information on android security page here if you are interested to go deep on it.

How to defend against "Zero-day" attacks?

2021-07-28T18:16:18.805000Z

One attack that no one can predict the impact and criticality are the Zero day attacks. It is important to understand and know how to be prepared for "Zero-day" attacks once it is published. Let us look into details.

What are "Zero-day Attacks"?

Zero-day or 0-day used interchangeably throughout the security industry, this is basically a vulnerability of a software that is not known to the developer or maker(vendor of the software). Such vulnerabilities in the software when used by the bad actors to attack the system are called as "Zero-day attacks"

What are the timeline of the vulnerability?

Let us split the timeline of the vulnerability

t₀: The vulnerability is discovered (by anyone).
t_1a: A security patch is published (e.g., by the software vendor).
t_1b: An exploit becomes active.
t₂: Most vulnerable systems have applied the patch.

The window of the vulnerability is t₂-t_1b

t_1b-t_1ais the best timeline for an organization to protect their system by applying the patches on the affected systems.

When it is known as Zero-day as per the timeline above?

Let me introduce a new timeline t_{-1 ,}which is not said or talked about in generic forums

t_-1: The vulnerability that is not yet discovered by anyone (but could be used by bad actors)

t₀ and t_-1of a vulnerability are considered as Zero-day for vulnerabilities

In short, any software could be on the t_-1 vulnerability and is yet to be discovered by security researcher or developer or published by any hacker.

(On a side note, NSO guys may be playing on the t_-1vulnerabilities for their spyware activities. Let us discuss that on a different topic)

How to Defend against the Zero-day attacks?

Let us look into simple steps on how to defend

Step1: Know your assets(KYA) - Make an inventory of all your software and hardware assets.

To help you follow only the necessary vendors of the software and their latest updates.

Step2: Control your software installations on your critical devices and end points

To avoid unknown softwares installed without your knowledge

Step3: Follow the security special interest groups or the vendors of the software constantly through subscriptions and alerts

To get the latest alerts on the published Zero-day vulnerabilities

Step4: Monitor patches of your software and keep your assets up to date

To know the status of the updated softwares

Step5: Be proactive and take immediate actions when there is a patch released

The faster the patch the better you avoid getting attacked

Step6: If patch is not available from the vendor yet, then look for workaround for the Zero-day and mitigate the vulnerability

Workarounds always help to stop the immediate impact from the critical Zero-day attacks.

Still unsure on how to manage vulnerabilities and Zero-days reach out to your friendly security professional me😉

Conclusion:

You cannot fully prevent Zero-day but be prepared for it. Be alert and follow security alerts of your software vendors and make sure all your softwares are updated immediately when the vendor releases a patch.

Who are Information Security Architects and what are their Skills

2021-07-26T05:16:34.359000Z

Cybersecurity Roles and titles are ever evolving. This is good in a way where cybersecurity professionals can actually start focusing on their expertise.

Let us discuss about "Information Security Architect"

Any cybersecurity role, must have a basic skill "Think like a Hacker". It is no different for Information security architects and in-fact it is extremely important if you are able to cover the 360 degrees of "Think like a Hacker" when you deal with this role.

What are the skills required to be an Information Security Architect?

Its a mixed bag of skills,

Leadership
Administrative
Budgeting
Hiring Security Professionals
Wired and Wireless Security
System and Network architectures
General information technology
Risk Management and Assessment
Cybersecurity Laws and guidelines in their region
Know how of when and where to apply security concepts and controls
Knowledge on standards and frameworks like COBIT/ITIL/ISO27001/PCI DSS/ Privacy Law
Familiarity with Organization policies
Familiarity with Government regulations
Strong IT and security ethics
Team management to guide the security analysts
Soft skills on verbal and communication
Incident Management

What are the certifications that an information security architect can do?

There could be many opinions on different security certification that could be done and there is no substitute for experience , i do believe it is good have one of the below certificate as bare minimum for an security architect.

CISSP/CISM/ CASP+
ITIL/COBIT/ISO27001 LA or LI
Or any Masters degree on cybersecurity field

What would be the experience of Information Security Architect?

On my personal opinion, a minimum of 12 to 15 years is required for an architect to get into this leadership position. However, there could be really young talented people who break barriers and display their grit in this challenging domain.

What is the the seniority level of an Information Security Architect and whom do they report too?

A Security Architect will be on the leadership level reporting to the management and must be working closely with the C level team. They are the key members on the security team who can work with the CISO and the business stakeholders. Depending on the size of the organization it may change on the seniority level. A CISO can also play the role of a security architect if the organization is small.

Conclusion

These are my opinion on the Information Security Architect Role. If you are passionate about the role and have just started, please keep a tab of knowing all security matters and keep developing your skills. It is absolutely ok to upskill or reskill as per the needs of the situation and it is neccesary to constantly update yourself.

If there are any comments to add on please feel free to write below.

Pegasus, the Spyware - A quick introduction

2021-07-21T16:27:10.764000Z

With all the craziness going around pegasus. Let us have a quick look about it.

What is Pegasus Software?

It is basically a spyware which can secretly be installed on a smartphones(apple or android) by exploiting a Zero day vulnerabilities. The installed software can later spy on the files, mic, camera basically the whole phone can be under the control of pegasus completely in stealth mode.

Who uses Pegasus?

It is used officially only by many law enforcements and intelligence agencies vetted by the government.

As per pegasus claims "It only sells to government and no private organization"

Why was is it developed?

NSO says their "mission of saving lives, helping governments around the world prevent terror attacks, break up pedophilia, sex, and drug-trafficking rings, locate missing and kidnapped children, locate survivors trapped under collapsed buildings, and protect airspace against disruptive penetration by dangerous drones"

When was it developed?

NSO group was formed in 2010. However spyware came to light in 2016

How is it legal and allowed?

Well, as per the claim of NSO, it is used for good intention and transparency is clear. They are responsive for the queries and tensions going around.

Some vulnerabilities the pegasus used to exploit are below

As of July2021, we know Pegasus does use other vulnerabilities to exploit which is not yet listed in CVEs.

What can cybersecurity industry learn from this?

There could be more such spyware which may be run by illegal groups. Let us keep up the good work and keep researching and finding out vulnerabilities to fix it sooner. We need to pace up a lot more than the criminals.

A side note to Cybersecurity professionals, What can we learn from this?

Those who came to read about the controversies and clarifications, let me not disappoint you and i do not want to comment on it as there are no direct facts to prove certain claims. Please go through the links below on your own time.

Amnesty International Article

Ransomware Gang most exploited vulnerabilities

2021-07-20T13:28:07.578000Z

I read this interesting article on threatpost where the ransomware gangs still use the old vulnerabilities to exploit and target the victims.

So what are those vulnerabilities and what do they do? How can you be safe from these vulnerabilities.

Below are the top 7 vulnerabilities used by the ransomware gangs.

These are not new "0-days" that is threatening the industry. A strict discipline of software patch management can help you fix the vulnerabilities from the common threat. Yes you read it correct, the solution is already available. Check if you need these patches and start doing it now. Seriously, Patch now after you read this.

If you are a business owner reading this and does not understand what the above means then do not worry, just send this blog to your IT team or security team. I am sure they will be able to get it.

Have you seen my old blog yet? Checkout here

2021-07-25T17:02:04.312000Z

I have my old blog with not so many posts. I thought it would be better to link it up here.

http://learninfosecurity.blogspot.com/

If you are interested in any of the below topics then checkout in my blog directly.

(Note this is really an outdated blog so please don't tell me i did not warn you earlier🙂 )

Getting Started!

2021-07-19T05:49:26.303000Z

So this is my first post here. Testing it out on how cool this platform is.

Posting via Evernote.