tamanho-site-hardsecure-3-.png

Sector News & Trends

BLOG

Hardsecure presente no evento de Lançamento Publico do NOSI-CA (Certification Autority)

NOSI-CA.png

Hardsecure present at the Public Launching event of the NOSi CA

Hᴀʀᴅsᴇᴄᴜʀᴇ ᴘʀᴇsᴇɴᴛ ᴀᴛ NOSɪ CA (Cᴇʀᴛɪꜰɪᴄᴀᴛɪᴏɴ Aᴜᴛʜᴏʀɪᴛʏ) Pᴜʙʟɪᴄ Lᴀᴜɴᴄʜ Eᴠᴇɴᴛ&nbsp;Hardsecure is pleased to inform that we attended the public announcement of the launching of the NOSI-CA (Certification Authority), took place this Wednesday, March 30, in Cidade da Praia, Cape Verde.&nbsp;The event was presided by the Deputy Prime Minister, Minister of Finance and Business Development and Minister of Digital Economy, Dr. Olavo Correia. The event was also attended by the Minister of Justice, the Secretary of State for the Economy, representatives of Public and Private entities, the Board of Directors of NOSi and the project implementation team.&nbsp;Learn more at the NOSi <a href="https://www.nosi.cv/en/w/public-launch-of-the-nosi-ca-digital-certification-authority" target="_blank" rel="noopener noreferrer">website</a>&nbsp;

31/03/2022

Cyber Insights The relationship between Marketing and Cybersecurity.png

10 Things to know about cloud security

<div class="raw-html-embed">Cybersecurity is a hot topic, which has been gaining more and more attention. Global confinement due to the Covid-19 pandemic “forced” organizations to enter the digital world without prior preparation. Confinement brought telecommuting, turned previously manual procedures into automatic processes, and made organizations adapt their business to the digital world. That said, it seems that the containment has brought advantages, however, the lack of preparation has made organizations more exposed to cybercrime, causing it to increase the attacks of Malware, Ransomware, Phishing, among others.
 
 
With the rise of cybercrime, topics such as GDPR and Data Breach gained prominence and organizations felt the need to protect their data and increase cybersecurity.
 
 
In addition to being an issue under the responsibility of IT teams, it is also necessary to involve Marketing, so that it can learn and contribute to the dissemination of the organization's protection against cyber-attacks. This article will help you understand why it is critical to involve the Marketing department in the process of implementing cybersecurity measures in your organization.
 
 
 
<green-text>Data Usage</green-text>
 
 
The collection and processing of data are fundamental for Marketing because this is the only way to communicate assertively and more efficiently. Data collection allows you to trace the consumer's journey(know what communication channels are used, the tone, the type of message with which you identify, your behavior, your interests…) and create a persona that corresponds to your audience target.
 
 
Consumer journey and persona definition allows you to create personalized campaigns and experiences that increase conversion and drive better results. Consumers are more likely to buy products from companies they identify with and trust, hence the importance of communicating transparently, sending a personalized message, and conveying trust.
 
 
If on the one hand, the provision of data allows the consumer to have a unique experience, on the other hand, it causes them doubts about how organizations protect their data, due to the increase of cyber-attacks that expose millions of customer data. Check if your data is compromised via this <a href="https://haveibeenpwned.com">link</a>.
 
 
The increase in cyberattacks aroused concern in several positions within organizations, namely: CIO, CISO, CTO, Board, and CMO prompting them to strengthen their cybersecurity measures. (Want to know your organization's maturity level? Find the answer at <a href="https://www.hardsecure.com/en/cybereffect">CyberQuiz</a>).
 
 
 
<green-text>Involve the Marketing and IT departments</green-text>
 
 
To communicate more effectively, Marketing uses several tools that allow you to analyze, customize and optimize your campaigns.
 
 
However, sometimes the selection and use of these tools is something that goes beyond the IT team and thus undermines the organization's cybersecurity.
 
 
To avoid unnecessary risks, the two departments must review the tools together before the organization acquires them. Something that is often not done, when marketing only informs about the use of a certain tool.
In addition to the joint analysis of the tools, it is essential that Marketing acquire technical knowledge about some aspects of the cybersecurity area, so that it can protect and prepare for crisis management.
 
 
 
<green-text>Database Management</green-text>
 
 
To facilitate data management, Marketing often uses data management platforms (DMP). Although Marketing frequently monitors the data, it cannot constantly monitor its protection, which could be victims of cyberattacks, such as SQL Injection (the most common cyber-attack in these cases). The solution lies in opting for the use of a database, which automatically encrypts data, provides security updates, and protects against external attacks. This way, Marketing manages to monitor the data and guarantee its protection, without extra time or effort.
 
 
 
<green-text>What to do in case of a breach date?</green-text>
 
 
Regardless of the number of cybersecurity measures implemented, no organization is 100% safe from cyber-attacks. In the event of a data breach, Marketing must follow the crisis management plan, which already includes measures to minimize damage from losses, communication in times of crisis, and support procedures for customers, partners, employees, suppliers, and others.
 
 
In short, with the increase in cyberattacks, cybersecurity is a topic that has gained greater relevance for organizations, having an impact on all areas of the business.
 
 
From the point of view of Marketing, which works on the organization's reputation, it is essential to take measures to ensure the protection of its customers' data, to transmit trust, which in turn generates success for the business.
 
 
By: <a href="https://www.linkedin.com/in/laura-estevens">Laura Estevens</a>, Digital Marketing Manager at Hardsecure.
</div>

04/01/2022

The relationship between Marketing and Cybersecurity

img4.jpg

What is the difference between Forensic Analysis and Security Audit?

<div class="raw-html-embed">Sometimes the concepts of Forensic Analysis and Security Audit are confused, as they both conduct an in-depth investigation and analysis of an organization's internal security documents and procedures. However, these concepts are not synonymous and there are several differences that we will present in the article “What is the difference between Forensic Analysis and Security Audit?”.
 
 
<a href="/en/services/cyber-security-forensic-analysis-service">Forensic Analysis</a> consists of collecting, preserving, and analyzing digital traces, which are found in different storage and communication processing devices.
 
 
The main objective of this procedure is to carry out a retrospective reconstruction of the events, scientifically supported, to be able to answer the questions: Who? Like? When? At where? it's because? performed certain actions in the organization's assets. In addition, the Forensic Analysis Service provides CIS Forensics and Malware analysis which are conducted to better understand security threats, to support the understanding, mitigation, and remediation of incidents.
 
 
The Forensic Analysis service is comprised of the provision of resources to perform online (OCF) and autonomous (SCF) computer forensic analysis and expertise for incident management; and malware analysis by providing capabilities to perform technical analysis on suspicious operating systems, code, and applications to identify any malicious content. Sharing technical characteristics of malware within a trusted community, either on an ad hoc basis or through dedicated platforms.
 
 
Findings are entered into a report that will be presented in the judicial evidence-building process and can exonerate or blame the suspect.
 
 
A <a href="/en/services/security-audit-support-service">Security Audit</a> guides and supports an organization's security accreditation and re-accreditation activities. It is based on the preparation, implementation, and verification of documents and processes necessary for security accreditation under ISO27K standards.
 
 
A Security Audit is composed of the following elements:
 
 
<green-text>1- Accreditation, Preparation, and Documentation (New Systems):</green-text> after collecting and analyzing the organization's security documentation and procedures, it is necessary to adjust them to the accreditation models defined by the ISO27K standards.
 
 
<green-text>2- Support:</green-text> Guidance and support in security accreditation and re-accreditation actions until final accreditation. Review and technical assessment of safety-related documentation and technical controls required in the accreditation process.
 
 
<green-text>3- Security compliance:</green-text> Support for formal certification that security measures are up to date at the technical, procedural, and procedural level, complying with the requirements of the ISO27K standard.
 
 
In short, the Forensic Analysis service is characterized by reconstructing an event to gather evidence and fulfill a purpose. A Security Audit analysis supports the implementation and checks procedures and documentation, to accredit the organization based on the standards required by the ISO27K standard.
</div>

21/12/2021

Clickjacking.jpg

Clickjacking

Listen to this article at the Podcast "CyberCast". 

<div class="raw-html-embed">A website is a set of HTML files connected through hypertext links, stored on a web server, i.e., a computer permanently connected to the Internet. With the advance of technologies, the use of websites has become part of our daily lives. In this context, website security has become one of the main requirements for users, developers, and organizations. Malicious users are using increasingly sophisticated methods to compromise the security of websites, and one of the techniques used by these malicious users is clickjacking.
 
 
Clickjacking, also known as a "UI redress attack", is a malicious technique whose goal is to trick a web user into selecting something other than what the user perceives they are selecting, thereby revealing confidential information. Clickjacking allows a hacker to insert an invisible layer into the website, between its commands and what the user sees on the device's screen.
 
 
One of the best-known examples of clickjacking was an attack against adobe flash's plugin settings page. By loading this page in an invisible iframe, an intruder could trick a user into changing Flash's security settings, allowing any Flash animation to use the computer's microphone and camera.
 
 
According to the nature of the attack, clickjacking has several types:
 
 
<green-text>- Cursorjacking:</green-text> This technique allows changing the position of the cursor to a place other than where the user perceives it. Thus, the user believes he is doing one action while he is doing another.
 
 
<green-text>- Likejacking:</green-text> This type of attack aims to collect users' clicks and direct them to "likes" on Facebook pages or other social networks.
 
 
<green-text>- Cookiejacking:</green-text> In this case, the user is tricked into interacting with a UI element by providing the intruder with cookies stored in the browser. This way an intruder can perform actions on the target website on behalf of the user.
 
 
<green-text>- Filejacking:</green-text> With this type of attack, the user allows the intruder to access their local file system.
 
 
<green-text>- Password manager attacks:</green-text> This type of attack aims to trick password managers to take advantage of their autofill feature.
 
 
It is difficult to recognize clickjacking because it is often invisible, however, it may contain elements that reveal its presence to the user. For example, some ads and calls with spelling mistakes may be an indication that there is an attempt at clickjacking. On social media, clickjacking can be recognized when someone shares strange content, usually with a link to access it.
 
 
Tests should be conducted to determine if the site's pages are vulnerable to attacks from this type of vector. Pentesters can investigate whether a target page can be loaded into an iframe by creating a simple web page that includes an iframe containing the target page. An example of HTML code to create this test web page is shown below:
<img src="https://backoffice.hardsecure.pt/uploads/Clickjacking_31d454975d_c841d1b6bf.png?updated_at=2022-01-22T12:14:38.597Z" alt="Clickjacking">
 
 
There are three methods you can use to defend against clickjacking:
 
 
-Prevent the browser from loading the page in an iframe using HTTP headers (X-Frame-Options or Content Security Policy- CSP).
 
 
- Prevent session cookies from being included when the page is loaded in an iframe using the SameSite cookie attribute.
 
 
- Implementing JavaScript code on the page to try to prevent it from loading in an iframe (known as "frame-buster").
 
 
These methods are all independent of each other, and whenever possible more than one of them should be implemented to provide the defense in depth.
 
 
The action of clickjacking can cause various damages since through one-click, we can be infected by different malware and even allow third parties to make use of the camera or microphone of our device. Not even our email and social networks are immune to this type of attack.
 
 
By: <green-text>Daniel Morais</green-text>, Pentester at Hardsecure.
</div>

07/12/2021

Round Table.png

Should you pay the Ransomware or not?

Round Table

<div class="raw-html-embed">On the 18th of November, Hardsecure organized and held the first virtual Round Table. In a relaxed and informal conversation, we gathered decision-makers and technicians at the table to talk about Ransomware. For 45 minutes, we heard different points of view and interactions during the debate.
 
 
The conversation, moderated by David Oliveira, was attended by Lennig Pedron, Trust Valley Executive Director at <a href="https://epfl-innovationpark.ch">EPFL Innovation Park</a>, Victor Gamra, CEO at <a href="https://fortifydata.com">FortifyData</a>, Jochen Link, cybersecurity consultant at <a href="https://www.sonarlock.eu">Sonarlock</a>, and Pedro Lobo, Incident Response &amp; Forensic Analyst at <a href="https://www.hardsecure.com/en">Hardsecure</a>.
 
 
The topics covered were:
To the question “How does a ransomware attack occur?”, Pedro Lobo from Hardsecure explained that a Ransomware attack occurs through file encryption. The public key can encrypt the files, but only the private key can decrypt them.
 
 
Victor Gamra alerted us to the importance of identifying potential security gaps and flaws through tools such as those provided by FortifyData. By identifying the weaknesses, which a hacker could exploit, you will be taking preventive measures for your organization’s security.
 
 
According to Lennig Pedron, the bad guys (criminal hackers) are very organized and share information. The good guys (ethical hackers) don’t do that. To combat the criminals, we need to share our knowledge and experience.
 
 
Jochen Link mentioned that it is very important to define procedures, where we start by defining how we can protect our data and then we create an emergency plan, which includes the risks and measures that may reduce the impact of the attack on the organization.
 
 
Faced with the question "Should you pay the Ransomware or not?" all guests defend that we should not do it, because by paying the ransom we are supporting the criminal practice. To combat this practice, it is illegal to pay for ransomware in some countries, such as the USA and Germany. Furthermore, by saying they are putting themselves on the “client list” of criminal hackers because they are showing that they pay. When they pay the ransom, they may be attacked again in the next 6 months or 1 year, which has a financial impact on the organization and wears down the technical teams.
 
 
During the Round Table, some questions were asked to the public, such as "Which is the most common ransomware attack vector?" with most of the public responding to Email Phishing (84.62%). Faced with the question “What do you think is the most effective control to prevent ransomware attacks?” the audience was divided between “Critical data backups” (30.77%), “Continuous Risk Assessments” (30.77%), and “Privileged access management” (23.08%). At the end of the session when asking the audience “Should you pay for Ransomware?” 61.54% defends “in some cases” and 38.46% defends “No always”.
 
 
In short, the most important thing is to prevent and be proactive in monitoring your organization's cybersecurity. Investing in cybersecurity through services such as <a href="/en/services/cyber-security-incident-response-service">Incident Response</a> and <a href="/en/services/cyber-security-pentest-service">Pentest</a> services will always be more affordable compared to paying for Ransomware and the impact that its consequences could have on your organization.
 
 
With a panel of international speakers, the event had participants from approximately 15 countries, whose profiles belong in the technology and cybersecurity areas, occupying leading positions.
 
 
The next Round Table will take place in January 2022 and will be about “Artificial Intelligence in Cybersecurity”.
 
 
<green-text>View the "Round Table: Should you pay the Ransomware or not?" recording here:</green-text>
</div>

23/11/2021

Round Table: Should you pay the Ransomware or not?

Is Cyber Insurance making Ransomware attacks worse.jpg

Is Cyber Insurance making Ransomware attacks worse?

<div class="raw-html-embed">Unsurprisingly, Ransomware remains the most common cyber threat and no company or network is safe from it. What started with some compromised floppy disks where victims were asked to pay $189, is now a billion-dollar cybercrime industry with the potential to cause damage worldwide.
 
 
According to SonicWall reports, 2021 has been the most active year for ransomware on record, with attacks increasing 148% in Q3 2021, and ransom demands being the largest to date.
 
 
Given how cybercrime rages on, organizations start to shift to a cyber resilience approach and adopt an ‘assumed breach’ mentality. Defense strategies improve, backing up business-critical data is almost a standard now, and cyber-insurance protection is also on the rise.
 
 
Cyber insurance exists to safeguard companies from the consequences of cyberattacks, including covering the financial costs of dealing with incidents. But many experts claim that Insurance might be fuelling the cybercrime industry since organizations are relying on their cyber-insurance policies to simply pay the ransom demand instead of adopting the security measures that could prevent such an attack in the first place.
 
 
We know why the Cybercriminal Underground is so successful (beyond being a trillion-dollar industry) … They are highly organized; they share information and knowledge, and they know who to target: the organizations they recognize as potentially the most profitable or most likely to pay a ransom. So, it only seems logical for ransomware gangs to actively pursue organizations with cyber-insurance policies since it’s the best way to guarantee they'll make money from encryption campaigns.
 
 
The Insurance Industry is also concerned, since the ransomware claims and demands are not only becoming more frequent, but they’re also a lot more expensive. As a result, Insurers are already increasing premiums and demanding to see detailed proof of cybersecurity strategies used by companies that want to buy cyber insurance. The multinational firm AXA even announced it would no longer write new cyber-insurance policies covering extortion and, coincidentally or not, was hit by a Ransomware attack a few weeks later.
 
 
We also have new types of extortion now, like Double-extortion, which has since become standard. Before encrypting data, gangs like REvil exfiltrate sensitive information from the network before encrypting files. That way, in addition to holding encrypted data for ransom, they can encourage their targets to pay the ransom to avoid public exposure of the exfiltrated data.
 
 
The availability of cyber insurance doesn't seem to be helping to improve cybersecurity, at least right now. For many companies, the thought of a breach and data becoming publicly available on the internet makes a high ransom seem worth it, and if Insurance will cover it, they won’t think twice about relying on it.
 
 
By: <green-text>Mara Melão</green-text> , Cybersecurity Account Executive for EMEA at Hardsecure.
</div>

11/11/2021

Wordpress.jpg

WordPress

Listen to this article at the Podcast "CyberCast".

<div class="raw-html-embed">Most of institutional websites delivered to Hardsecure for testing use Wordpress as his own CMS (content management system) most of it because it's the simplest and most popular service to create your own website or blog, powering 42% of all websites on the internet. Even if you're not a developer, you can easily change your site with the vast ecosystem of WordPress themes and plugins.
 
 
In the section below, we'll live some of the most common vulnerabilities experienced during pentests.
 
 
<green-text>COMMON VULNERABILITIES:</green-text>
 
 
<green-text>Brute Force Attacks,</green-text> that involves multiple trial and error approach using hundreds of combinations to guess the correct username or password. 
 
 
<green-text>Cross-Site Scripting,</green-text> also known as XSS attack. In this type of attack, the attacker loads malicious JavaScript code that, when loaded on the client side, starts collecting data and possibly redirecting to other malicious websites. 
 
 
<green-text>Outdated WordPress/plugins</green-text> are more likely to be affected by a security threat. Over time, hackers find their way to exploit its core and ultimately execute the attack on sites that still use outdated versions.
 
 
<green-text>User Enumeration</green-text> is a way to fetch user data from your website. These three enumeration techniques are a very fast way to identify users of a WordPress: JSON API, Login Form and Author Archives.
 
 
<green-text>Malware</green-text> is a malicious code that is injected into themes, outdated plugin or script and extract data from the website or insert malicious content.
 
 
<green-text>DoS/DDoS, DoS</green-text> is performed using a single source, while DDoS is an organized attack performed by multiple machines around the world.
 
 
 
<green-text>HARDENING FRAMEWORK</green-text>
 
Security must be something recurrent! You can have serious problems once you stop checking your website security. In this chapter, we'll talk about the main measures to protect your WordPress or others CMS's.
The first measure refers to strong passwords, two-factor authentication and how often do we change our passwords. This are three easy tips that if you should use your day to day
 
 
The second measure focus on updates. This aren't always related with new features; this could contain security and stability fixes which are essential. In WordPress, we've to pay attention to plugins, themes, and PHP that each version has 2 years of support.
 
 
If your site has several users, it is not recommended to make everyone as administrators. As well as changing the login path, it won't solve all problems, but it can help against bots and/or scripts. Blocking URL paths with the help of WAF is a good step to keep unknown IP's out such as the login page.
 
 
The most important file is config.php, you can move this file, update WordPress security keys to improve encryption, change permissions on these files, disable XML-RPC, hide WordPress versions (The less people know about your WordPress site setup, the better), add security headers such as:
 
<green-text>•</green-text> Content-Security Policy
 
<green-text>•</green-text> X-XSS-Protection
 
<green-text>•</green-text> Strict-Transport-Security
 
<green-text>•</green-text> X-Frame-Options
 
<green-text>•</green-text> Public-Key-Pins
 
<green-text>•</green-text> X-Content-Type
 
 
Use security plugins Like iThemes Security and/or WordFence Security and don't forget to always use secure connections (HTTPS, SFTP).
 
 
<green-text>FINAL NOTES</green-text>
 
There are over 55,000 WordPress plugins! The best choice you can make is to use the ones that has high satisfaction ratings and that are frequently updated because, as we've seen above, these updates are important to the integrity of your site. Remember to install only the necessary ones and if you want to play it safe, it’s best to create a development or staging instance for testing it first.
 
 
By: <green-text>Ricardo Araújo</green-text>, Pentester at Hardsecure.
</div>

26/10/2021

The Wolf Pack.jpg

The Wolf Pack

<div class="raw-html-embed">I have met different people in the Cybersecurity field. From the resigned ones to the more enthusiastic quest seekers who fought against the low budgets and lack of awareness for all Security matters, I have seen it all. I also met some people from the other side, the dark side of the force if you may, and I found some interesting capabilities of theirs that can be of great help for the good side of the force. The guys from the dark side of the force moved throughout the cyber world in wolf packs. They shared important information among each other and attacked their victims in teams and that brings a question in my mind, why can´t we, from the good side of the force, do the same?
 
 
This leads me to one of the biggest challenges we face currently in Cybersecurity, being able to obtain valid, coherent, and contextualized information that will place us in a less reactive position compared to where we are at now when it comes to cyber-attacks. The same way the dark side of the force guys furnish contextualized and coherent information about potential victims with each other so must we also do the same. No man is an island, and this also applies to Cybersecurity, relying only on yourself and to a specific set of technologies is leading towards disaster. Technology will bring you very high-level information that might not be fully contextualized to your own reality if furnished in bulk. The information from CTI enabled technology need to be contextualized to each single reality but that´s a hard endeavor to accomplish, specially alone. Here is where we should act as a wolf pack with several types of different people with different skills sharing in real-time contextualized information about recent and ongoing attacks and do´s and don´t in these situations. The benefit of this is, like in nature, the survival of the herd even if a few members might be lost in the way. Giving a clear message that in a specific Industry or region companies are responding together and being able to receive more contextualized information because they share information with each other will increase their overall resilience to cyber-attacks. This way the first Wolf packs can emerge and divert the Dark side wolves towards more easy targets to attack. 
 
 
I have seen throughout these years the technology centric approach dwelling with cybersecurity issues that, cyclically, are completely trashed by the newest exploit available and these show up faster than you can imagine and even more dangerous than before. Have you ever wondered why? Why do exploits hit so many infrastructures at once successfully? Behind the clever idea of producing the exploit there is team effort of sharing and learning within the dark side community ways to exploit that helps them to understand where and how to hit. They form wolf packs exploring the weak spots of their prey and where who might be the most vulnerable, and they pass it on this information to others from the pack. They form in true sense wolf packs well organized and feeding each other with information vital to their success, it is clever I must admit.
 
 
The technology centric approach of the good side of the force opened gaps to be explored by the Dark side common to each other and that explains, in part, their success. I´m not advocating that technology is not good or that it shouldn´t use but it is clearly not enough, nor the effort should rely only on it. Using the trendy technology because everybody is commenting that might be good it is not guarantee for a sure miracle. In fact, the same way you might adopt a certain technology so will the guys from the Dark side explore it´s gaps and build the next exploit that will hit the largest number possible of Infrastructures throughout the World. Somebody once said to me that the CISs role is the one of the loneliest ever, and it is true, but should it be so, or can we change that? Easier said than done right?! Well, it is true in part, but it is also true that we need to change the mindset of other people not related to Cybersecurity. My first notion being in contact with Cybersecurity professionals is that they lack on few important things that bad guys excel and I´m not referring to technical skills. 
 
 
<green-text>Here are a couple of things need to be changed:</green-text>
 
 
<green-text>1.</green-text> Don´t isolated yourselves, share important tips regarding Security.
 
 
<green-text>2.</green-text> Learn to speak the Board language by trying to explain efficiency and cost reduction by including People and Processes in the equation.
 
 
<green-text>3.</green-text> Don´t rely in a technology unless you have the full notion of what might be its impact in processes and if people will use it efficiently. (I have seen tools of hundreds of thousands of euros being put in shelf because were not used correctly).
 
 
<green-text>4.</green-text> Expecting that a certain technology itself will produce miracles is also not a good idea.
 
 
<green-text>5.</green-text> Be motivators, lead the way into a secure state of mind of all people around you. Security is a State of Mind starting by the people who use technology.
 
 
<green-text>6.</green-text> Acquire as much information as you can from outside sources such as CTI.
 
 
<green-text>7.</green-text> Don´t rely in data that is reactive.
 
 
<green-text>8.</green-text> Don´t think about securing, think about how you can and how fast you can save your precious data and get it back running as soon as possible. 
<green-text>9.</green-text> Inventory of assets according to its criticality.
 
 
<green-text>10.</green-text> Regular assessments one just once a year for compliance purposes and afterwards keep the report inside the drawer. Remember you can´t improve if you can´t measure!
 
 
Keep in mind that the better you plan and evolve all stakeholders the better:
 
<green-text>“Hope is not a strategy. Luck is not a control. Panic is not an option.”</green-text>
 
 
By: <green-text>David Oliveira</green-text>, International Sales Manager at Hardsecure.
</div>

19/10/2021

When to do Pentest.jpg

When to do Pentest?

<div class="raw-html-embed">There are multiple reasons why you should have your network pent tested. From a compliance perspective where you should have, at least, once a year a pen test being made, to a more frequently pen-testing like <a href="/en/services/cyber-security-pentest-service">Pentest as a Service</a> type for websites and applications. In either case, it is important you can have the findings logged into an incident response capability of your own or outsourced as a Service. 
 
The article “When to do Pentest?” will help you identify in which cases you must take a Pentest or a <a href="/en/services/cyber-security-pentest-service">Pentest as a Service</a>.
 
 
<green-text>5 cases where Pen test is required</green-text>
 
 
<green-text>1 – Test the security of an application or website</green-text>
 After the first version of the project is done, you should pen test it will allow you to detect and fix vulnerabilities before the project goes online. However, to ensure a solid and secure foundation, it is recommended that several Pentests be run during the run process as soon as the core features are ready. The analysis of vulnerabilities during project execution allows avoiding the reproduction of some errors and reducing the time spent on later security fixes, which could delay production. For smaller projects with less coding, a Pentest at the end of the development phase is enough.
 
 
<green-text>2- Start with a more basic Pentest</green-text>
Thinking that you must have at least 10k for a pen test is not right. Pentest can vary in price according to the scope and methodology applied. Always suspect of providers that claim they can do it quicker than anyone else because you might be facing a fully automatized pen test delivering tons of false positives. Always look for the possibility of having a provider that will also hand correlate the findings because that is where you can extract more value from the money you have spent. 
 
It is completely feasible to make a Pentest more accessible, to start the first audit, or get the first feedback on the security level.
 
This more basic version of Pentest allows start-ups and small businesses to set up security tests with a smaller budget and as they grow and their level of risk exposure increases, strengthen resources.
 
There are different types of Pentest, which can be adapted to your organization's needs. See the article: <a href="/blog/white-box-gray-box-and-black-box-what-is-the-difference">“White Box, Gray Box, and Black Box, What is the difference?”</a>.
 
 
<green-text>3- Connection between Pentesters and Developers</green-text>
As a rule, the teams' priority always goes to deliver projects, leaving security behind at times. However, it is necessary not to leave Pentest only for the end, otherwise, you will miss some critical flaws, which could have been identified at an earlier stage of the project.
 
Furthermore, the work of a Pentester does not involve much of the development team, as Pentesters are autonomous in carrying out the security audit. After identifying the vulnerabilities and necessary fixes, the Pentest team passes this information to the development team, which will start working on the fixes.
 
 
<green-text>4- "Not being exposed to attack risks at the moment"</green-text>
There are organizations that are more exposed to the risk of cyber-attacks than others. However, not all cyber-attacks are targeted, some bots scan the web on a large scale to find vulnerabilities especially in servers or CMS. In addition, there are mass phishing campaigns, for scams or for spreading malware. Therefore, regardless of the sector in which you operate and the size of your organization, it is important to protect yourself as little as possible against the main risks. Learn more in the article: <a href="/blog/how-to-protect-your-organization-against-ransomware-attacks">“How to protect your organization against ransomware attacks?”</a>.
 
Be proactive and test your organization's security at a stage where you're not too exposed, so you can start building a solid foundation.
 
 
<green-text>5- Be proactive</green-text>
Conducting Pentests before your customers' demand shows that your organization is proactive, credible, and trustworthy. In addition to adding value, it is also a way to differentiate yourself from your competition. Security creates value, which in turn drives sales.
 
 
Conducting a Pentest is one of the most proactive measures you can take and will undoubtedly impact the solidification of your organization's security measures. Learn more about the benefits of the Pentest service in the article: <a href="/blog/7-main-benefits-of-pentest-as-a-service">“7 main benefits of Pentest as a Service”</a>.
</div>

14/09/2021

cloud (1).png

<div class="raw-html-embed">There is a clear trend and an increasing demand for Cloud Security services, common to all Industries and countries. According to <a href="http://www.forbes.com/sites/louiscolumbus/2018/08/30/state-of-enterprise-cloud-computing-2018/?sh=7edc0dd3265e">Forbes</a>, 73% of organizations have at least one application or part of their computing infrastructure stored in the cloud.
 
 
Talking about Cloud Security makes us think about some questions, namely: To what extent is data stored in the cloud more advantageous compared to traditional storage on local physical systems? What are the advantages of purchasing a cloud security service? These are some questions you will see answered throughout the article <green-text>“10 things to know about cloud security”</green-text>.
 
 
When talking about Cloud Security services it is impossible not to talk about cybersecurity measures. Cloud Security is a system of policies, procedures, technologies, and control techniques that help protect systems, infrastructures, and data stored in the cloud against unauthorized access, theft, leakage, and deletion.
 
 
In addition to protecting data, the Cloud Security service provides authentication rules for users and devices.
However, there are still some reticence’s regarding cloud data storage due to the system being vulnerable to breaches. This vulnerability can be easily addressed through the Cloud Security service, which allows guaranteeing the security of all applications in the cloud via a unique proxy analysis mechanism, which gathers information from a wide range of activities to create mapping files for applications in the cloud. In addition to collecting information, the cloud security service allows: to analyse advanced and customized risk metrics; assign an application risk score; automated application update (maintains security compliance); data classification; identify inactive accounts and external users (User Governance); identifies security gaps and lack of compliance (Application Governance); built-in correlation workflow; activity monitoring/analysis in the shortest possible time; automatic anomaly detection; Data Loss Prevention (DLP); location-based and device-based access control; and integration with third-party solutions.
 
 
<green-text>10 reasons why organizations are opting for the Cloud Security services</green-text>
 
 
<green-text>1- Saves space and time</green-text>
 
By storing your data on an external cloud account, you don't need to purchase an external hard drive and you can access your data anytime, anywhere.
 
 
<green-text>2- Cheap and affordable service</green-text>
 
Cloud security is a cheap and accessible service, regardless of the data that is stored.
 
 
<green-text>3- Control over data</green-text>
 
All clouds are associated with a physical location. Make sure your cloud provider uses the right hardware and ensures a physical location is secure.
 
 
<green-text>4- Increased useful life of computers</green-text>
 
Computers are often replaced regularly due to software updates. With cloud storage, it will not be necessary to change computers with the same frequency, because the software will be in the cloud.
 
 
<green-text>5- Cloud Customization</green-text>
 
There are different types of cloud, the three main ones being: the private cloud, the public cloud, and the hybrid cloud. Each type of cloud has its advantages and limitations. It is up to the organization to match its software, security and storage need to the most appropriate type of cloud.
 
 
<green-text>6- Backups are always needed </green-text>
 
There are not completely fool proof security systems, so prevention is always a must-have. Protect your data with a backup. Find out how best to do it through the article: <a href="/blog/the-importance-of-backup-and-the-best-way-to-do-it">“The importance of backup and the best way to do it”</a>.
 
 
<green-text>7- The Cloud is the most secure and protected system </green-text>
 
The building blocks of cloud security architecture include enterprise-class hardware, such as servers protected by enterprise-class security systems.
 
 
<green-text>8- Payment flexibility </green-text>
 
Regardless of the size of your organization, you can protect your data and reduce the costs associated with physical infrastructure. Unlike physical on-premises systems, which require payment upfront before installation, cloud storage has minimal setup costs.
 
 
<green-text>9- Use of Pentest</green-text>
 
Being present in the cloud means overcoming new challenges, namely related to access security, data theft, ransomware... Access management services to the cloud infrastructure can be compromised and it is necessary to carry out periodic assessments such as <a href="/services/cyber-security-pentest-service">Pentest</a>, to ensure that your data is secure.
To strengthen your organization's security, we suggest adding the Pentest service to the Cloud Security service, which allows you to detect and combat vulnerabilities. Learn more about the benefits of the Pentest service through the article: <a href="/blog/7-main-benefits-of-pentest-as-a-service">“7 main benefits of Pentest as a Service”</a>.
 
 
<green-text>10- Analyse security and cybersecurity service providers</green-text>
 
When purchasing a Cloud Security service, review different security and cybersecurity service providers so you can make an informed decision. Make sure that the security and cybersecurity service provider offers you a personalized service that is tailored to your needs and that it guarantees you access to all the additional protection measures that your organization may need.
 
 
In short, the Cloud Security service has brought several benefits, in terms of data protection, to organizations, regardless of their sector, location, or size.
The most important thing in the cloud data storage process is to ensure that your security and cybersecurity service provider guarantees a personalized service that is tailored to you and that all security standards are met, managing the detection and correction of vulnerabilities between other measures.
</div>

01/09/2021

cti (1).png

WHAT ARE THE DIFFERENCES BETWEEN CTI AND CI?

<div class="raw-html-embed">Today, organizations are exposed to several attacks (Zero-Day attacks, crypto viruses, botnets, exploits…) it’s common to come across concepts such as <a href="https://www.hardsecure.com/en/services/cyber-threat-intelligence-analysis-service">Cyber Threat Intelligence (CTI)</a> and Cyber Intelligence (CI). This article will help you understand the difference between these two concepts that in practice seem very similar.
 
 According to <a href="https://www.gartner.com/en">Gartner</a>, "Cyber Threat Intelligence is evidence-based knowledge, including context, mechanism, indicators, implications, and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard ".
 
 Cyber Threat Intelligence (CTI) delivers to the organizations, information about threats and threat actors that help mitigate harmful events in cyberspace. Cyber threat intelligence sources include open-source intelligence, social media intelligence, human intelligence, technical intelligence, or intelligence from the deep, surface &amp; dark web/darknet, Tor, Freenet, I2P, Riffle, and others.
 
 
 <green-text>CTI PROVIDES INFORMATION ABOUT:</green-text>
 <green-text>•</green-text> Identifying types of attacks;
 <green-text>•</green-text> Defining, guiding, and prioritizing operational requirements;
 <green-text>•</green-text> Understanding threat actor capacity, tactics, techniques, and procedures;
 <green-text>•</green-text> Deploying detection systems;
 <green-text>•</green-text> Developing defense strategies.
 
 Cyber Intelligence (CI) is the mechanism of translating the data obtained from the attackers’ networks into an operative report through “standard intelligence approaches”.
 
 <green-text>WHY CTI IS SO IMPORTANT?</green-text>
 Cyber Threat Intelligence delivers transforming data, gathered by ‘traditional methods of intelligence’ from the platforms of the attackers, into an actionable report for the target customer. The traditional intelligence methods may include passive follow-ups or actively created ‘persona’ to find out what the attackers are talking about, their new methods, their stolen information, and all other operational details. Surely these methods require a high level of knowledge and experience where the customers can get to perform proactive decisions in their IT infrastructure. Threat actors operate in “wolf packs” spread in different locations being difficult to track them down in previous information regarding the gathering of the “wolf pack” is not collected and that is one of the added values of this service.
 
 CTI is an essential capability in an organization's security program. Used properly, CTI can enable better-informed security and business decisions and ultimately allow customers to take decisive action to protect their users, data, and reputation against unknown elements.
 
 CTI often includes signature, reputation, and threat data feeds but goes beyond them in almost every way. Our typical activities involve:
 <green-text>•</green-text> Constant human and technical information gathering on a global scale.
 <green-text>•</green-text> The provision of adversary-focused and forward-looking rich contextual data.
 <green-text>•</green-text> Customization for our customers' organizations.
 
 <green-text>CTI BENEFITS</green-text>
 Here are some of CTI benefits:
 
 <green-text>• Valuable insight and context:</green-text> Detailing information on what threats are most likely to affect an organization or industry, and indicators to help prevent and detect more attacks.
 
 <green-text>• Improved incident response times:</green-text> Prioritizing alerts, which enables an organization to respond faster to real threats and reduce the risk of serious breach consequences.
 
 <green-text>• Improved communication, planning, and investment:</green-text> Security teams can communicate real risks to the business and focus on protecting high-risk targets from actual threats via additional security investment and planning.
 
 In short, the skilled, well-funded, well-organized, and highly sophisticated cyber attackers use techniques that reveal security strategies to the technology alone. To develop a defense strategy against attackers, organizations need to know how hackers operate, how they function, and what techniques they use.
 
 Cyber-threat intelligence allows companies to identify the dynamics and consequences of risks, improve security plans, structures, and reduce their attack potential to minimize damage and defend their network.
</div>

17/08/2021

What are the differences between CTI and CI?

CyberInsights_Hardsecure_importance of centralized communication_SOC.png

The importance of centralized communication - SOC

<div class="raw-html-embed">When an organization plans its strategy and internal communication processes, it is common for doubts to arise about which is the best way forward, especially if it is intended to create centralized communication mechanisms.
 
 
Communication is extremely important for cybersecurity companies and especially for SOC teams, which are the first line of computer defense in real-time, because structured information, besides reducing possible operational errors, simplifies relations between the different teams and departments that act towards the same end (example: SOC, Pentest and Cyber Intel teams/departments), as well as ensuring a better understanding of the environment, defense and protection of their customers' infrastructure.
 
 Thus, the following question arises: 
 "should companies providing cybersecurity services centralize communication or keep it decentralized?" 
 
 To help answer the question, the following are some of its characteristics.
 
 In general, Centralisation enables:
<ul>
<li>Increased communication between employees;</li>
<li>Facilitated interdepartmental communication, thus contributing to a common overall objective;</li>
<li>Management of documents, data, emails, and transmission of communications;</li>
<li>Sharing information in the means that they consider most appropriate and effective;</li>
<li>Better supervision of shared internal information.</li>
</ul>
 Already in Decentralisation:
<ul>
<li>Decision-making and information divided between departments;</li>
<li>Superior responsibility in management, by the department;</li>
<li>Greater autonomy for employees, which in this way appeals to the contribution of each one, with ideas, products, or processes, but only in their activity;</li>
<li>Limited access to information (documents, data, etc.) in relation to other departments;</li>
<li>Less interdepartmental information sharing;</li>
<li>Risk of information mismatch;</li>
<li>Increased probability of duplicate information (data, emails, among others).</li>
</ul>
 These are just some of the advantages and disadvantages when adopting centralized or decentralized communication.
 
 Centralization reduces costs and time with possible errors due to lack of information, such as, for example, the repetition of work or the creation of security incidents (False Positives) generated by the activity of an employee of the Pentest department during his "normal activity", without there being any internal communication about what is going on because when testing the systems of a client, they end up generating various alarms for the technicians who are monitoring the network of that client.
 
 
Although decentralization is a practice widely used by several companies, in the area of cybersecurity the centralization of communication and information is a crucial factor for a better operation and global contribution of the various services provided.
 
 
 
By: <green-text>Hugo Moreira</green-text>, Incident Response Analyst at Hardsecure
</div>

03/08/2021

CyberInsights_SOC as a Service.png

Soc as a Service

Listen to this article at the Podcast "CyberCast"

<div class="raw-html-embed">With the digital evolution, the number of attacks and threats to organizations has increased exponentially. As a response, these have decided to take appropriate measures to protect their data and security systems, thus avoiding losses and damages.
 
 This is how SOC as a Service emerged, consisting of continuous monitoring, detection, analysis, and reporting service, responding to incidents, and managing vulnerabilities, thus enabling innovative behaviour, and bringing various advantages to the Information Security area.
 
 
 <green-text>How does SOC as a service work?</green-text> 
 
 SOC as a service is a service based on monitoring, executed remotely on networks, applied to all equipment and other assets connected to the organization being monitored (within a pre-established scope). In other words, the SOC collects events from different sources, analyses, identifies anomalies, and filters this process to generate alerts.
 
 Whenever the equipment produces logs and events, these are collected and correlated through security rules allowing a quick assessment of millions of events, to identify irregularities and later being analysed by the SOC operators.
 
 The added value of the SOC as a service is due to the constant monitoring of the events together with the security resources used in the organizations, resources that can be diverse, among them Firewalls, Antivirus, network assets, servers, applications, among others. 
 
 Through correlation mechanisms, this analyses the data on events, sending these results to a platform called Security Information and Event Management (SIEM), to transmit all the attacks to a system or network.
 
 
 <green-text>Advantages of SOC as a service</green-text>
 
 Nowadays, where there are more and more attacks on infrastructures or even information theft, it is necessary to have constant visibility of the environment to protect and reduce the exposure of information and mitigate risks.
 
 Thus, through the SOC as a service, all these components are covered, as the SOC provides a generalized view of the entire environment safely and robustly, through a 24x7 operation, thus protecting against criminals that may remain hidden within our corporate environment.
 
 Therefore, we can determine several benefits with the acquisition of SOC as a service, such as:
 • Constant Surveillance - 24x7 systems monitoring.
 • Security - analysis, and identification of offenses originated by third parties.
 • Guaranteed Integrity, Availability, and Confidentiality.
 • Flexibility in service management model - 100% outsourced, hybrid or in-house team.
 • Evaluation and continuous improvement as a preventive component.
 • Access to highly qualified Cybersecurity professionals.
 • Access to monitoring and intelligence technologies.
 • Strategic reports to share with C-levels.
 • More qualified information to support decision-making.
 
 
 SOC as a Service assumes continuous detection, containment, visibility, correction, and aggregation of intelligence. It can therefore be concluded that organizations with this service are much more efficient when it comes to identifying attacks and responding to incidents, having a preventative capacity in the face of new attack vectors.
 
 
 By: <green-text>Renato Rodrigues</green-text>, Incident Response Analyst at Hardsecure
</div>

20/07/2021

SOC as a Service

could-ai-systems-be-ethically-correct.png

COULD AI SYSTEMS BE ETHICALLY CORRECT?

<div class="raw-html-embed">If it is true that Artificial Intelligence (AI) is not a new concept, nor a recent one, it is also a fact that this branch of Information Technology assumes greater relevance as it impacts our daily lives and society, in an increasingly complex way and controversial, as its main objective is the execution of tasks that would be considered intelligent if performed by a Human.
 
 At the same time, respect for the Fundamental Rights of Human Beings, such as Privacy and Personal Data Protection, is also a non-recent issue and with growing importance, which acquire legal contours and impose technical requirements for their compliance, which are increasingly defined and unavoidable.
 
 The dichotomy between the development of AI systems and ethical values is a constant nowadays and the search for balance is a theme to which, naturally and progressively, we dedicate more time, as the perception that it is vital for our survival imposes it.
 
 Going through the Fourth Industrial Revolution (Industry 4.0), the pace at which Society evolves, along with the emerging possibilities and technological and IT solutions, the collection of large-scale data (Big Data), namely through devices connected to the Internet ( IoT), the need for these to resort to AI to interpret the information they collect and generate responses, creating intelligent networks, is no longer compatible with the inertia regarding the requirements of privacy and information security, nor with the exemption from liability, whether individual or collective, regarding our actions and regarding the information that we are or have become responsible.
 
 Indeed, our critical sense and the way we act and react, determine our choices and our path and evolution as individuals. Allowing us to assume parallelism at this level, we could say that artificial AI makes “choices” based on algorithms, while human intelligence, with all its complexity, allows us to consciously assume our choices, our decisions, and our behaviors, through the context and our values.
 
 <green-text>Being ethically correct is one of those choices and is, without a doubt, in its genesis, a human characteristic.</green-text> 
 
 We often assume, and the fruit of some speculation, that AI systems are closer to the reasoning of a Human and the fullness of the human brain than they are. Proof of this fear is the constant need to delimit the limits of action and of the development itself / its repercussions, to prevent roles from inverting. Algorithms effectively allow problem-solving, based on reading and language comprehension and learning, using logical reasoning. But, what is the way to go until obtaining information that allows the generation of algorithms to the point of reaching this level? The Human Being Himself, the way thoughts and decisions are organically generated, will it ever be possible to “replicate” or mechanize?
 And if so, aren't we distorting the principles of Individuality, respect for the rights and freedoms of Human Beings, and subverting the ethical principles that must precede and accompany any (technological) development process?
 
 On the other hand, could an algorithm someday define what precedes individual decision-making and all the experiences and variables, whether environmental or individual, that determines it?
 
 When software developed based on AI, for example, “machine learning”, “makes decisions” using an algorithm, it will not be considering the Human Being just an “artificially intelligent robot” and reducing it to a set of information and logical reasoning, underestimating its genesis?
 
 When we define a profile, based on inputs and information collected from an individual, as in the case of what is obtained from the personal data that we have access to and can process, we are also not assuming exactly this assumption, like that or those guys?
 
 It won't be entirely unrealistic to consider the hypothesis that AI might resemble “Human Consciousness” in decision-making. But this similarity presupposes human action and programming and, in the case of “machine learning”, for example, is limited to thelearning information that has been collected and processed so far and that allows inferring results.
 
 Although there are already controversial examples that lead us to question the ability of AI systems to communicate in their language and learn to be creative, so far, we can consider that recreating the human brain in all its valences and being able to recreate one of its greatest potential, the one that allows the development of creativity, while, will still be a complete utopia, and each AI system is limited to a set of actions for each purpose, within the scope in which it is created.
 
 Thus, we would have to rethink the very concept of creativity and the act of creating, which presupposes creating something new without starting from any pre-existing information or if learning by repetition a creative process can be considered a new approach to the definition of creativity.
 
 <green-text>From either perspective, CREATE implies BEING and FEELING…</green-text>
 
 Andreas Kaplan and Michael Haenlein define artificial intelligence as “a system's ability to correctly interpret external data, learn from that data, and use that learning to achieve specific goals and tasks through flexible adaptation”.
 
 However, and if it is not possible to predict how science and neuroscience will evolve, and how this “integration” may become possible, it is necessary to be aware of the risks associated with the benefits, when we talk about progress and development.
 
 Ideally, we should try to anticipate harmful and harmful consequences that detract from the benefit that should be the primary focus of development.
 
 The ability to collect, process, interpret all the information, coming from all our senses, allowing us to have emotions, memories, and BEING, is what defines us as Individuals and distinguishes us from a "machine or system", but also what defines us as individuals. makes it permeable to influences and to be “partially programmable”.
 
 The balance between the development of AI systems, their influence on human behavior, and the collection and processing of information about that same human behavior defining profiles, to allow this "cycle of influence" and results through programming and learning by logical reasoning, must be a constant when we talk about AI and development.
 
 How can we ensure respect for Human Beings' fundamental rights, such as their privacy, if we assume that Human Beings are at the service of technology and development and not the other way around?
 In addition to the basic questions of legality and legitimacy in the processing of personal data, is it possible for us to recognize the limits inherent to a purpose when we talk about the development of AI systems? 
 
 Data protection regulations, such as the RGPD… have also emerged to impose these limits, to sandardize procedures, to promote the implementation of control measures, and to promote the development of ethical standards, appealing to a sense of personal responsibility, corporate and collective. The reflection that is needed: will the current measures, existing mechanisms, and legislative frameworks in force be sufficient so that, in the race for development based on AI, where we seek to reproduce and improve human behavior/actions, we safeguard respect for Individuality, for the privacy and the rights and freedoms of the Human Being? Inevitably, the motivations that drive development, namely that based on AI, reflect how the markets condition organizations to disregard ethical principles in favor of financial return. It is urgent to achieve this balance, imposing and adjusting the limits and legal requirements, but also promoting and assuming increasingly humanistic, more conscious, responsible, and ethically correct visions and postures, which aim at the development of technology and AI as a lever for growth and evolution of Societies and the Individual.
<blockquote>
“a system's ability to correctly interpret external data, learn from that data, and use that learning to achieve specific goals and tasks through flexible adaptation”.
</blockquote>
</div>

15/06/2021

Could AI systems be ethically correct?

ransomware.png

HOW TO PROTECT YOUR ORGANIZATION AGAINST RANSOMWARE ATTACKS?

<div class="raw-html-embed">Did you know that 27% of malware attacks in 2020 were the result of ransomware, according to <a href="https://www.gartner.com/en">Gartner</a>?
 
 
Ransomware is malware that encrypts the victim's files. The attacker demands payment of a ransom in exchange for a decryption key. The victim is threatened with the disclosure of public data if he fails to pay the ransom.
 
 
According to the <a href="https://notified.idtheftcenter.org/s/resource#annualReportSection">ITR</a>, ransomware was one of the most common attack vectors in the last quarter of 2020. The popularity of this malware is due to its profitable nature.
 
 
<green-text>HOW TO PROTECT YOUR ORGANIZATION?</green-text>
 
 <green-text>Employee Awareness</green-text>: The best way to protect your business from social engineering attacks is to train employees so they have the knowledge they need to not be tricked into reporting these scams. In addition, employees must be aware of the company's procedure in the face of attempted social engineering. Should they simply delete the email? Should they forward the email to the IT department? What should they do? Employees must always report these situations to ensure their protection and the protection of the organization. 
 
After several awareness actions, employees should have no doubts about what a suspicious email is, think before clicking, not provide personal and confidential information, analyse file extensions, be careful with email attachments, block suspicious emails, among other preventive measures.
 
To ensure that employees are informed and prepared to defend themselves against a potential attack, the organization should test them by simulating suspicious messages and encourage them to report them.
 
 <green-text>Asset Inventory</green-text>: to ensure the protection of its network, the organization must carry out an inventory that contains all its assets (software and hardware). The inventory of devices and solutions connected to the network must always be updated as a preventive measure.
 
 <green-text>Fix and update your software regularly</green-text>: Bad actors are always looking for holes in your defences, and they are counting on your team not to patch your software and operating system in a timely fashion. The longer it takes to patch a vulnerability, the more of a chance a bad actor has of finding and exploiting one.
 
 <green-text>Antivirus and Firewalls</green-text>: Installing anti-virus and malware software on your email server can help to stop those viruses before they get started. The firewalls keep unauthorized users out of networks and devices and can protect your network from ransomware attempting to infect your machines.
 
 <green-text>Blocking Plug-ins and Pop-ups</green-text>: Cybercriminals often target plug-ins to infect devices. The solution is to update plugins regularly or block them.
Pop-ups are also a common attack vector. Use a browser add-on to block pop-ups.
 
 <green-text>Disable the web the instant you detect suspicious activity</green-text>: If you detect that you are suffering from a ransomware attack, turn off the internet immediately. Most ransomware needs to establish a connection to their command and control (C&amp;C) servers in the early stages of an attack so that they can complete their encryption routine. If the ransomware cannot contact the Internet, it will not be able to do that.
 
 <green-text>Limit access to trusted apps</green-text>: Create a list of trusted apps. Users can only use applications from this list. Applications that are not on this list should be blocked.
 
 <green-text>Disable remote services and unused Bluetooth connections</green-text>: To protect your machine from the control of a cybercriminal you should disable remote services to help keep them off your machine. When you are not using any Bluetooth connections, you should turn them off, to prevent malicious people from using these connections to infiltrate your device.
 
 <green-text>Backup</green-text>: Protecting your organization's data is essential, so having a backup of your system, both locally and externally, is imperative. The rule is to have three backups in different locations so that attackers cannot access at least one of them. Having the information secure in three different places allows you to not have to pay ransom to hackers to recover your data. Learn the best way to make a backup with the article: <a href="https://www.hardsecure.com/en/blog/the-importance-of-backup-and-the-best-way-to-do-it">"The importance of Backup and the best way to do it"</a>.
 
 <green-text>Third Parties</green-text>: It is common for attackers to try to use a less protected third party to compromise your organization's data and network. From the moment that third parties gain access to your systems and networks, it will also be affected when they suffer a ransomware attack. Combat this by scrutinizing your vendors before integrating them and making sure they only have access to protected segments of your network.
 
 
 In conclusion, due to its profitable nature, ransomware malware is becoming popular. The best solution to ensure the protection of your organization is to prevent, make a copy to protect the data in different places (backup), and train your employees, since human error is one of the main causes that weakens an organization.
</div>

08/06/2021

How to protect your organization against ransomware attacks?

cyber-summit-chemical (1).png

 The 1st International Conference on Security and Chemical

Cyber Summit: Chemical

Listen to this article at the Podcast

<div class="raw-html-embed">On the 23rd and 24th of June Hardsecure organized and held the CyberSummit for the Chemical Industry.
This event was to bring more information gathering around CyberSecurity issues relevant for the current times and to increase the fast paced networking amongs professionals. The Summit had eight speakers touching the most important fields of CyberSecurity and Chemical Industry.
 
 
The topics covered were:
 
<ul>
<li>"The Biggest Challenges Facing the Chemical Industry", by Patrick Hochfeld and Fabian Ruehrnschopf, from <a href="https://acopa.de/en">ACOPA GmbH</a>. The focus of this presentation was the supply chain disruptions and Trending Challenges for the Chemical Industry.
 
 </li>
<li>“Third Party Risk Management in Chemical" was presented by the President of International Sales at <a href="https://securityscorecard.com">SecurityScorecard</a>, Matthew McKenna. Mr. McKenna presented how low Security Ratings can be correlated to the major Databreaches occurred in the Chemical Industry by showing evidences of this correlation. Increasing concerns about Supply Chain disruptions and even more correlate with Cyber-Risk and this was one of the biggest concerns evident in this Summit.
 
 </li>
<li>“Deep and Dark Web Trends for Chemical Industry" was presented by Mr. Reshid Ramadan, Global MSSP Account Manager at <a href="https://socradar.io">SOCRadar</a>. Reshid raised awareness about the danger of data collection in chemical and how this collection and sale is done through the Deep and Dark Web. The importance of retrieving information from the Deep and Dark Web as a forma of protecting all your assets was another concerned raised in this Summit, being, the need to be more proactive rather than reactive since the challenges of this Corona brought us new cyber-threats like governmental spionage for example.
 
 </li>
<li>"Compliance Cyber Risk and Digitization in Chemical" presented by Thorsten Breuer, Executive Director at <a href="https://www.sonarlock.eu">Sonarlock</a>, refers the importance of the 5 pillars model of compliance (Leadership, Risk Assessment, Satndards &amp; Controls, Training &amp; Communication and Monitoring, Audit &amp; Response).
 
 </li>
<li>"Incident Response in Chemical" by David Oliveira, International Sales Manager at Hardsecure spoke about<a href="/services/cyber-security-incident-management-service"> Incident Response as a Service</a> and<a href="/services/supply-chain-and-third-party-risk-assessment-service"> Third Party Risk Management as a Service</a>. These two components are absolutely critical in these dire times where both you and your supply chain are targets for disruption asnd need a more proactive towards CyberSecurity Issues. 
 
 </li>
<li>“Pentest as a service in Chemical" was presented by Rafael García, Quality, Information Security and Privacy Manager at <a href="https://www.exevi.com">Exevi</a>. Rafael identified the importance of Pentest as a service as an answerfor a more proactive approach towards CyberSecurity Issues. If can´t measure you can´t improve therefore more companies are adopting the Pentest as a Service as a mean to keep improving the Security measures.
 
 
With a panel of international speakers, the event had about 50 participants, from approximately 14 countries, whose profiles belong in the technology and cybersecurity areas, occupying leading positions. 
The next Cyber Summit will take place in October and will be about “What impact of Ransomware attack in a company?” and this raises the big controversial question: "Should you or should you not pay the Ransomware?"</li>
</ul>
</div>

30/06/2021

Cyber Summit: Chemical – The 1st International Conference on Security and Chemical

CISO: AN EXTREMELY IMPORTANT ROLE IN AN ORGANIZATION

<div class="raw-html-embed">The Chief Information Security Officer (CISO) is the executive responsible for an organization’s information and data security.
 Not every company has a CISO, yet according to <a href="https://resources.idg.com/download/2020-security-priorities-executive-summary">IDG´s 2020 Security Priorities</a>, the number has increased up to 80% in the case of Large Enterprises and so is expected in smaller companies. The CISOS, play an important role because they keep the employee´s security training adequate, and their security strategy is far more proactive compared to those who have not such officers.
 
 
 WHAT IS DEMANDED TO A CISO?
 • Security operations: real-time analysis of immediate threats, and triage when something goes wrong.
 
 • Cyber risk and cyber intelligence: Keeping updated to the newest threats and building strategies to minimize the potential impact of them if such incidents might come about.
 
 • Data loss and fraud prevention: Assuring that the critical data is a much secure as possible and having tools and strategies to reduce critical incidents from disturbing business activity or data loss.
 
 • Security architecture: planning, buying, and rolling out security hardware and software, and making sure IT and network infrastructure are designed with best security practices in mind, and updating all tools with the latest security patches. 
 
 • Identify and access management: ensuring that only authorized people have access to restricted data and systems.
 
 • Program management: keeping ahead of security needs by implementing programs or projects that mitigate risks-regular system patches, for instance. Bringing awareness to all employees towards the essential security measures.
 
 • Reporting Security to the Board: One of the hardest tasks is to explain security issues to non-technical people but that is challenging any CISO needs to overcome in his role. Having more precise and clear data on what and how Security issues are being carried out is vital.
 
 • Governance: Connecting to the Compliance teams to assure that data handling complies with all legal obligations.
 
 • Risk Landscape: Keeping track of the cyber-risk in their data landscape by monitoring Third parties and their infrastructure.
 
 
EVOLUTION OF THE ROLE OF CISO
 Initially, CISO were directors of information security and reported directly to the CIO (Chief Information Officer), which is considered an extension of IT.
 
However, as the CISO position evolved, so did its visibility and importance for top management. The result of this evolution was, in the case of some organizations, the CISO started to report to the CEO (Chief Executive Officer).
 
We currently have CISO reporting to several executives (CIO, CEO, Risk Director, Audit Committee...), that is, to whom CISO reports depends on the size, dynamics, and sector of the organization.
 
 
In short, regardless of the position to which CISO reports, CISO has a fundamental role in an organization in that it is to assure security, sensitizing all internal stakeholders on the importance of implementing security measures proactively and reporting Security to the Board.
</div>

25/05/2021

CISO: an extremely important role in an organization

pentest (1).png

7 MAIN BENEFITS OF PENTEST AS A SERVICE

<div class="raw-html-embed">Pentest came to help companies test their resilience towards the even more constant threats perpetrated by the cyber-criminals. The result of that was the improvement of their resilience and the optimization of the effort carried out by the understaffed teams of the Cybersecurity Departments.
 
 
 Even so, soon, all companies realized that the fast-pacing changes in the attack vectors and the building of newer and more dangerous threats made them feel the need for more continuous assessments, or in this case <a href="https://www.hardsecure.com/en/services/cyber-security-pentest-service">Pentest as a Service (PTaaS)</a>, providing them with the technical and human resources necessary to detect and tackle the fast-paced changes in the threat landscape.
 
 
 The main reasons that lead organizations around the world to use the Pentest as a Service where the ability to become more proactive towards the newest threats without having to grow their teams, better resources allocation, consequences of security audits in the information system, a better understanding of how they could live with risk.
 
 
 <green-text>7 BENEFITS OF PENTEST AS A SERVICE:</green-text>
 
 <green-text>1- IDENTIFIES VULNERABILITIES</green-text>
 Pentest exploits weaknesses in the system or application configurations and network infrastructure. It also analyses the behavior of employees to see which ones are vulnerable to data breaches and malicious infiltrations.
In the end, a report is issued with the breakdown of the vulnerabilities identified in the Information System as well as a mitigation plan.
 The report obtained after the evaluation allows the organization to make all necessary adjustments to improve its operations and business to minimize the risk.
 
 
 <green-text>2- REVEAL REAL RISKS</green-text>
 Pentesters exploit real vulnerabilities, just as a hacker would. Upon accessing confidential data and entering the operating system, Pentester can classify the risk of the threat. The risk of the threat can be classified according to the impact that it may have on the organization.
 
 
 <green-text>3- TEST CYBER DEFENCE CAPABILITIES</green-text>
 After detecting and responding to attacks, you must proceed in the investigation, discover the attackers, and block them. After this procedure, Pentest will suggest some actions to improve the organization's defense.
 
 
 <green-text>4- ENSURING BUSINESS CONTINUITY</green-text>
 In the event of an attack, every second counts to the organization that is under attack, especially if there was the need to shut down systems partially or totally and therefore minimize damage.
 The Pentest as a Service is performed remotely in a quality environment reducing the impact on the network performance. All information discovered and filtered from false positives can be logged in SIEM systems for quick mitigation or hardening measures.
Pentest works almost like a business continuity audit.
 
 
 <green-text>5- OUTSOURCED EXPERT OPINION</green-text>
 When the problem is mentioned by someone inside the organization, sometimes management may not react or act on the spot.
 However, when a report from a third-party specialist is sent, the impact of the information is greater and additional measures and funds may be channeled to solve the problems.
 
 
 <green-text>6- REGULATIONS AND CERTIFICATIONS</green-text>
 Some regulations and certifications require a certain level of penetration testing (Ex: ISO 27001), in particular, that all managers and system owners conduct regular penetration tests and security analyses with qualified Pentesters.
 
 
 <green-text>7- ORGANIZATIONAL REPUTATION</green-text>
 A computer attack can have serious consequences for an organization, both in functional and reputational terms.
 The loss of data or exposure to confidential information may affect the trust that customers, partners, and suppliers have in the organization.
 To convey confidence, the organization may have Pentest as a Service, to guarantee regular and rigorous penetration tests.
 
 
 By performing Pentest continuously and using different methodologies and attack vectors, the organization's IT teams can focus on the desired systems/applications and, at the same time, obtain information on the most likely types of attacks and their consequences, to eliminate or mitigate the risk.
 Pentest as a Service increases confidence in companies and improves the information protection system.
</div>

18/05/2021

7 main benefits of Pentest as a Service

pentest.png

What is the difference?

WHITE BOX, GRAY BOX AND BLACK BOX

<div class="raw-html-embed">Cybersecurity is an important issue for organizations, especially now since we are in remote work, servers are being migrated to the Cloud and most of the confidential data is in digital format.
 
 The technological acceleration, verified in the last years in a COVID-19 pandemic scenario, has meant that some steps to implement security measures were ignored. This lapse could bring serious impact to organizations, making them more vulnerable to cyber-attacks.
 
 Pentest emerged as a measure that helps organizations test their cybersecurity resilience and overcome their vulnerabilities, making them more protected and secure.
 Pentest can be carried out in different viewpoints, each of which will have different goals. Among them, we can highlight the White Box, Gray Box, and Black Box.
 
 Next, we show the differences between these three types of Pentest.
<img src="https://backoffice.hardsecure.pt/uploads/pentest_981b619153.png" alt="pentest.png">
 <green-text>WHITE BOX</green-text>
 The White Box test is the most complete Pentest because it performs a complete analysis, which evaluates the entire network infrastructure.
 
 When Pentest starts, the Pentester has access to all essential organization information, such as topography, passwords, IPs, logins, among other data regarding the network, servers, structure, potential security measures, firewalls, etc. Access to information makes this a deeper attack.
 
 Access to preliminary information allows the Pentester to target the attack accurately and find out what needs to be improved and refocused. The White Box provides a comprehensive assessment of internal and external vulnerabilities.
 
As the Pentesters have access to information, the approach is different from the Black Box and, therefore, some vulnerabilities may not be detected.
 
 This type of Pentest is usually carried out by the organization's IT team.
 
 
 <green-text>GRAY BOX</green-text>
 The Gray Box is a mix of White Box and Black Box instrumentality tests, since it has specific information, although it does not have full access to information like the White Box. The Pentester aims to explore the partial information to get more data and perform the attack.
 
Generally, the organization that contracts this service provides a detailed purpose of the simulated attack, to ensure that Pentesters remain within the limits of what is to be tested.
The purpose of the Gray Box is to provide a more focused and efficient assessment of the network’s security compared to a Black Box assessment.
 
 
Given that Pentesters already have the necessary information, they have more time to determine which parts of the information are more critical and perform tests according to the different levels of risk.
 
 
 <green-text>BLACK BOX</green-text>
 The Black Box test does not have much information about the organization, sometimes it only has access to its name, so it resembles an external attack.
 
 
Without a large mapping of information, the Black Box test acts similarly to a cyber-attack, acknowledging weaknesses in an organization's network structure.
 
 This test is used when we want to simulate a real attack by a hacker. The purpose is to test the existing security protocols and policies.
 
The Black Box is the intrusion test that takes more time to prepare and plan, as it is at a bigger scale and meticulous. If not performed correctly, it can also impact the network.
 
 
 After analyzing the different types of Pentest, it may be concluded that there is no best intrusion test, it all depends on the purpose, context, and results we intend to obtain.
 
The important thing is to know what the best approach is for a is given situation. 
 
There is no purpose in using a deeper test in an application that we know in advance that it is vulnerable, as well as there is no purpose in carrying out a more superficial test in a critical application that will be exposed to all external risks.
</div>

11/05/2021

White box, gray box and black box, what is the difference?

what-is-the-difference-between-a-vulnerability-scan-and-pentest.png

WHAT IS THE DIFFERENCE BETWEEN A VULNERABILITY SCAN AND PENTEST?

<div class="raw-html-embed">We are constantly confronted with news of cyberattacks, which cause profound damage to organizations by making confidential information available on the web. The damage caused in an organization can be financial, such as the payment of a ransom; functional, when they directly affect the production and response capacity; or reputational, when it affects the organization's reputation and integrity.
 
 
 To prevent cyberattacks, organizations seek to identify their vulnerabilities, correct them, and become more secure. Vulnerability detection can be done through a Vulnerability Scan or Pentest.
 
 
 <green-text>WHAT DOES VULNERABILITY SCAN CONSIST OF?</green-text>
 Vulnerability Scan or Vulnerability Assessment uses tools that automate the search for known vulnerabilities in the configuration of a system.
 
There is an Internal and External Vulnerability Scan. External Vulnerability Scan can be run by the organization outside the perimeter of its network, to determine exposure to attacks from servers and applications that can be accessed directly over the Internet.
 
 
Internal Vulnerability Scan aims to identify flaws that hackers can exploit to move laterally to different systems and servers if they gain access to the local network.
 
 
Any Vulnerability Scan program should begin with mapping and inventory of an organization's systems and classification of their importance based on the access they provide and the data they have.
 
The Information System is scanned to determine whether security settings have been activated and applied properly and whether applicable patches have been installed.
 
 
 <green-text>VULNERABILITY SCAN WEAKNESSES:</green-text>
 Vulnerability Scan does not exploit the vulnerabilities, instead, it identifies them and does not simulate a real attack, creating false positives.
 
The focus is on finding vulnerabilities other than understanding the true gravity of each one.
 
 
 <green-text>WHAT DOES PENTEST CONSIST OF?</green-text>
 Pentest is the short form of Penetration Testing, which can be performed externally or internally.
 
 
External Pentest refers to any attack using procedures carried out outside the organization (Internet). The main objective is to find out if an external attacker can access the resources of the organization's Information System, how far it can go, and what damage it can cause.
 
 
Internal Pentest is carried out through the organization, based on the simulation of attacks carried out by valid users with standard access privileges within the organization or by third parties.
 
 
In both cases, Pentest is an attack simulation that aims to validate the effectiveness of security controls/mechanisms in each environment (scope).
 
 
Pentest identifies the risks that may arise from exploiting the vulnerabilities found, through the injection of computer incidents.
 
Unlike what happens in Vulnerability Scan, Pentest has a manual testing process component that allows you to go deeper and be more objective, concerning the consequences that the malicious exploitation of a particular finding can cause.
Pentest's focus, when detecting vulnerability for specific purposes, is to know if a hacker has the potential to exploit the situation and take control over the system.
 
 
 <green-text>PENTEST WEAKNESSES:</green-text>
 The use of Pentest is not recommended in the case of organizations with no ISMS implementation or initial state. In this case, the cost is highly high concerning the benefits and the report will not introduce relevant information.
 
 
It is important to remember that Vulnerability Scan and Pentest complement each other. Although they are different processes, they share the goal of identifying and assessing an organization's security vulnerabilities. The Vulnerability Scan is part of an automatic process, which is based on a database of known vulnerabilities, such as CVE / NVD, but does not normally include the exploitation of identified flaws.
 
 Pentest is a more complex process that includes manual probing and exploitation by security professionals, to simulate what a hacker would do. The addition of manual techniques to the automatic system makes it possible to reduce “false positives” and have a more accurate assessment of the risk represented by different vulnerabilities.
</div>

05/05/2021

What is the difference between a Vulnerability Scan and Pentest?

how-to-protect-your-customer-data.png

HOW TO PROTECT YOUR CUSTOMER DATA?

<div class="raw-html-embed">The Covid 19 situation accelerated the online presence of companies. In a pandemic, scenario companies had to adapt to survive and the main adaptation was to increase online presence, mainly through e-commerce, since in most businesses the physical store was not an option.
 The result is that more data (public and private) is now available in the cloud. As the number of data increases, so does the responsibility to protect it, so businesses must review their cybersecurity policies to ensure that the processes and technology they implement are effective.
 
 <green-text>THE IMPORTANCE OF DATA</green-text>
 
The success of a business depends on knowing the needs of its customers now and in the future. By being able to profile its customers, a company can offer a personalized service, improving the customer experience, which translates into more sales and loyal customers.
In addition to cross-referencing different information to create the customer profile, the difficulty increases when different types of data are located on different platforms and server locations. You should know the exact location of each type of data to protect it properly.
 
 <green-text>TYPES OF DATA:</green-text>
 1- Account: personal and transactional data, such as name and address.
 2- Location: physical location (cell phone location) and viral location (IP address).
 3- Browsing: browsing habits (what? when? where?)
 4- Profile: third-party data, such as demographics and social media.
 
 
 <green-text>HOW TO PROTECT CUSTOMER DATA FROM CYBER-ATTACKS?</green-text>
 <green-text>1- Budget for Cybersecurity</green-text>
 Anticipating is better than reacting, so there should be a specific budget for cybersecurity measures.
 The budget should contemplate prioritization of threats, estimate their cost to the organization and identify the protections against the threats.
 This budget should remain intact and robust, since preventive measures are much more cost-effective than the costs that a cybersecurity attack could cause.
 
 <green-text>2- Encrypt confidential data</green-text>
 The movement of data from one location to another, such as from server to mobile is exposed to various security threats. 
 By encrypting the data, we give it extra protection during its circulation, which can only be unlocked on the terminal with the decryption key. 
 Encrypting means carefully walking the line and between privacy and ease of use.
 
 <green-text>3- Assessing physical risks</green-text>
 Usually, when we think about threats and security data, we only consider the risks after the data is collected. However, self-scanners and self-point of sale (POS) systems increase the risk of a surface attack. Although POS malware attacks are decreasing, they have still considered a risk that organizations must protect themselves against. 
 In addition to directly scanning POS systems and using anti-malware on all terminals they should also employ network segmentation to limit any damage from a surface attack breach. If there is an attack on the POS system, it will be contained in a very small part of the network that does not intersect with sensitive data. Through cloud firewalls organizations gain more protection and control over their segmentation. Other protections for kiosks and POS systems include installing all patches immediately and changing default passwords.
 
 <green-text>4- Raise awareness among the organization's employees</green-text>
 Most security incidents are the result of employee negligence.
 An organization's IT team should be responsible to raise awareness and training employees on how to protect themselves from cyber threats. Starting by explaining how an employee can check the veracity of an email (one of the main ways malware spreads).
 By including cybersecurity best practices in your organization, you can improve employee training and reduce the risk of cyberattacks.
 
 <green-text>5- Strengthen malware protection</green-text>
 Make sure every device (desktop, mobile...) has a newer version of malware protection. 
 Limit the use of devices external to your organization in your space, so you can maintain control.
 
 By making their data available, customers are putting their trust in a particular organization. It is up to organizations to protect their data and improve their experience based on the information provided. Remember that cybersecurity is a must for an organization from the moment it has an online presence.
</div>

27/04/2021

How to protect your customer data?

trickbot.png

TRICKBOT

<div class="raw-html-embed">After the end of Emotet's reign, which saw its infrastructure taken down by Europol in late January 2021, Trickbot has arrived, which has come to give a lot of headaches, especially to the legal and insurance industries.
Like Emotet, Trickbot is not a "final" malware, it acts as a channel for cybercriminals to deliver the final malicious payload, which can be any other virus.
 
 Since February 2021, Trickbot has been used as a replacement for Emotet. The main form of dissemination was through spam campaigns, which contained a compressed (.zip) file with malicious JavaScript. Upon opening the file, Trickbot attempts to download another malicious payload from a remote server.
 
 Trickbot is popular due to its versatility, flexibility, customization, and its successful track record in previous attacks. In 2020, it was the fourth most prevalent malware globally, affecting 8% of organizations.
 
 In 2020, Trickbot played a key role in one of the most costly and high-profile cyberattacks: The Universal Health Services (UHS) case, a leading healthcare provider in the US. UHS was hit by the Ryuk ransomware and the institution claimed that the attack cost it $67 million in lost revenue and costs. Trickbot was used by the attackers to detect and harvest data from UHS systems and deliver the ransomware payload.
 
 
<green-text>WHAT CAN TRICKBOT DO?</green-text>
<ul>
<li>Credential theft;</li>
<li>Spy on targets to gain access to the system and network information;</li>
<li>Install backdoors into systems, which allow access to the system remotely as part of a botnet.</li>
<li>Be downloaded by other malware.</li>
<li>Modify itself to avoid detection.
 </li>
</ul>
 
<green-text>HOW DO I PROTECT MYSELF AGAINST TRICKBOT?</green-text>
 
 The main defence tactic is to make users aware of how they should verify the veracity of a linked email. If a user can correctly identify a malicious or suspicious email and the attachment to follow, the malware will not have a chance to be opened.
 IT departments in organizations must make employees aware of how to identify potentially malicious emails.
 The use of antivirus software can also help in detecting potential attacks on a system. If the attack is successful, the software can also help remove it.
 
 Enabling multi-factor authentication (MFA) can help prevent TrickBot malware from obtaining all users credentials. Even if an attack is successful, attackers will not have all the pieces needed to be fully authenticated by a system.
 
In short, even when one major threat is eliminated, others emerge that continue to pose a high risk on networks worldwide.
 
 
 
 
</div>

Trickbot: the malware that dethroned Emotet

incident-response.jpg

INCIDENT RESPONSE: WHAT IS THE DIFFERENCE BETWEEN TEAMS?

Listen to this article on "CyberCast"

<div class="raw-html-embed">The increase in security incidents has shown that one SOC team is not enough and that organizations need a proactive response to threats, hence the Incident Response Teams.
 This article will reveal to you the main differences between the main security teams: Security Operations Center (SOC) and the Incident Response Team.
 
 
WHAT IS INCIDENT RESPONSE?
 Incident response is a methodology for organizing the process of responding to security events. Organizations usually create a team or department to carry out their incident response practices. 
 An incident response team consists of security analysts as well as human resources and management professionals. A cross-functional incident response team ensures that the organization has the right mix of talent needed to effectively respond to security threats. The team usually has a leader (usually the CISO) and a technical team.
 
 
HOW DOES THE SOC TEAM?
 SOC (Security Operations Center) refers to the facility where a team performs security tasks and the team responsible for the organization’s overall cybersecurity.
 The SOC is responsible for the prevention, incident response, and risk management.
 The main functions of the SOC team are:
 1. Real-time analysis: real-time monitoring and Screening
 2. Trends and Intel: Cyber Intel Collection and Analysis
 3. Incident Analysis and Response: Incident Analysis and Remote Incident Response
 4. Analysis and Evaluation: Network Mapping and Vulnerability Scanning.
 
 
 
HOW DOES THE INCIDENT RESPONSE TEAM?
 The focus of the incident response team is incident management, based on reporting, analysis, and response.
The effectiveness of their work is the rapid response to an incident, which can minimize the damage through containment and recovery solutions.
 
 
THE MAIN FUNCTIONS OF THE INCIDENT RESPONSE TEAM ARE:
 1. Real-time analysis: real-time monitoring and Screening; and SPOC- Single Point Of Contact (Incident Response Center).
 2. Trens and Intel: Cyber Intel Collection and Analysis; Cyber Intel Distribution; Cyber Intel Creation; Cyber Intel Fusion; Major Incidents and Threat Trends (permanent update against new threats); Threat Assessment.
 3. Incident Analysis and Response: Incident Analysis; Tradecraft Analysis; Incident Response Coordination; Implementing Countermeasures; Local Incident Response; and Remote Incident Response.
 4. Artifacts Analysis: Forensic manipulation of artefacts; malware analysis; Forensic analysis of artefacts
 5. Auditing and Internal Threats: Collect and store audit data; Audit Content Creation and Management; Support for Internal Threats; and Investigation for Internal Threats.
 6. Analysis and Evaluation: Network Mapping; Vulnerability Scanning; Vulnerability Assessment; Penetration Testing; and OWASP.
 7. Divulgation: Application evaluation; Security Consulting; and Training and Awareness.
 
 
 WHAT ARE THE MAIN DIFFERENCES BETWEEN THE SOC TEAM AND THE INCIDENT RESPONSE TEAM?
 Both teams have similarities in the tasks they perform and complement each other.
The incident response team takes a more hands-on perspective, acting immediately to stop the threat and prevent damage. The SOC team takes a broader approach, intervening only in incident resolution when there is no incident response team.
 
 
 SOC TEAM
 Threat detection: monitors and detects threats.
 Alert triage: analyses and prioritizes alerts.
 Structure: usually operates alone, without sharing information with other SOCs.
 Incident management: when there is no incident response team it is the SOC team that takes responsibility. In the case of organizations that have both teams, the SOC team assists the incident response team with threat intelligence.
 
 INCIDENT RESPONSE TEAM
 Incident Management: fast and effective response to security incidents. Develops and refines the incident response plan.
 Structure: the team is usually structured with other incident response teams or SOCs. It may be organized regionally or nationally.
 Threat detection: the incident response team usually receives threat intelligence solutions through the SOC team, leveraging that information to detect threats. 
 
 
Both teams are complementary and necessary to get the most out of a cybersecurity department. A SOC team will always be needed to upgrade the cybersecurity department, complete with the incident response team.
</div>

20/04/2021

Incident Response: What is the difference between teams?

risk-management (2).png

WHAT IS RISK MANAGEMENT AND WHY IS IT IMPORTANT?

<div class="raw-html-embed"><green-text>WHAT IS RISK MANAGEMENT?</green-text>
 
 
Risk management is the identification, analysis and response to risk factors that might affect an organization. Effective risk management means trying to control, as much as possible, future outcomes by acting proactively rather than reactively to avoid certain unnecessary risks.
 Risk management allows you to plan the course of action and risk prevention. Such planning makes it possible to reduce the likelihood of a risk occurring and to minimize its potential impact.
 
 
 <green-text>WHAT DO RISK MANAGEMENT FRAMEWORKS CONSIST OF?</green-text>
 
 Risk management frameworks allow you to identify existing risks, calculate the uncertainty and predict the impact they will have on your organization. 
 
Risk management should be viewed as a disciplined, continuous process of identifying, preventing, and resolving risks. This includes planning, organizing, controlling costs and budgeting.
 
It is up to your organization to decide whether to accept or reject risks. This decision is directly related to the levels of risk tolerance that the organization has set for itself and willing to absorb.
 An organization that contemplates good risk management will generally not have many surprises, because the focus is on proactive risk management. 
 
 
 
<green-text>3 RISK RESPONSE</green-text> 
 
Risk response generally takes one of the following three forms: 
 1.Prevention: the organization strives to eliminate a specific risk by suppressing its cause.
 
 2.Mitigation: decreasing the projected financial value associated with risk by decreasing the possibility of the risk occurring.
 
 3.Acceptance: the organization is forced to accept risk. This option is possible if a business entity develops contingencies to mitigate the impact of the risk, should it occur.
 
 
To know what kind of risk response to be adopted, your organization needs to have a detailed plan, which foresees all possible risk scenarios, what are their impacts on the organization and what is the solution. This anticipatory plan allows it to be executed as soon as there is a need, avoiding barriers or roadblocks that may arise in a crisis.
 
 
 
<green-text>THE IMPORTANCE OF RISK MANAGEMENT</green-text>
 
 
Risk management is an important process because it allows your organization to anticipate and be prepared for potential risks. By identifying, classifying, and finding solutions to the impact of potential risks, the organization is mitigating the impact they could cause. 
 Risk management provides certainty in making sound decisions. Risk assessment and management is the best way for an organization to prepare for eventualities that may arise in the path of progress and growth. When a company assesses its plan for dealing with potential risks, they develop structures to deal with them, increasing their chances of succeeding.
 Also, management will have the necessary information that they can use to make informed decisions and ensure the profitability of the organization.
 
 
 
<green-text>RISK ANALYSIS PROCESS: STEPS IN THE RISK ANALYSIS PROCESS</green-text> 
 
1.Identify the risks 
The identification of risks should not be up to a single person, because to contemplate several scenarios requires sharing of different thoughts and perspectives. Your organization should gather its employees so that everyone can contribute to the potential risk analysis. 
After the risks have been identified and described, it is necessary to rank them in order of priority, based on the impact they have your the company. Since it is not possible to mitigate all the risks at the same time, prioritizing allows to prioritize the risk mitigation according to the greatest consequences for the organization to be dealt with urgency. 
 
 
2.Evaluate the risks 
Before identifying the problem and finding a solution, it is necessary to take a retrospective look at what caused a certain situation to happen. The first step should always be to locate the causes of risks and how they can be avoided. By locating the cause, we can understand how it impacts various areas of the organization. 
 
 
3.Responding 
After identifying the risks and locating their causes, it is necessary to contemplate a few solutions to respond to the risk scenarios found.
Besides responding immediately, these solutions should also contribute to the prevention of the risk's recurrence. 
 
4.Implementing prevention 
After identifying ideas to prevent certain risks, a contingency plan should be developed. Each prevention measure is assigned a list of tasks so that it can be properly implemented. 
The contingency plan allows the necessary measures to be taken to combat the risk at the time. 
 
In sum, might as well anticipate rather than react. By contemplating a risk management plan in your organization, you will anticipate and prevent potential risks, mitigate their potential impact and the damage they can cause.
Risk management helps you to make sound decisions, which positively impact the success of your organization. Hence it is the key element for the smooth running of your organization!
</div>

06/04/2021

What is Risk Management and why is it important?

backup.png

THE IMPORTANCE OF BACKUP and the best way to do it

<div class="raw-html-embed">Listen to this article at the Podcast "CyberCast" <a href="https://soundcloud.com/international-hardsecure/la-importancia-de-las-copias-de-seguridad-y-la-mejor-manera-de-hacerlas">(Spanish Version)</a>.
We all know how important backups are for organizations. Cybersecurity threats are becoming more frequent and the damage caused by attacks can be severe and cause irreparable damage, so the importance of backups is increasing. Therefore, backing up the organization's most important data and information may be the only way to save it in case of attacks or security incidents.
There are several reasons why backup copies are so important: 
<ul>
<li>Data and information protection: Backups protect the organization from different threats (cyber-attacks, human error, power failures, accident). It is the existence of backups that can make the difference between quickly restoring the organization's operation after an incident or having to pause activity.</li>
</ul>
<ul>
<li>Increasing operationality and competitiveness: An organization that can guarantee a fast and efficient recovery after an attack or security incident has more credibility in the market. This guarantee is the confirmation that there is no drop in productivity and, consequently, in revenue.</li>
</ul>
<ul>
<li>The business becomes more efficient: Performing regular backups forces the organization to restructure and reorganize, which makes it more organized and efficient.</li>
</ul>
<ul>
<li>Ensure compliance with the Data Protection law: In an age when data protection laws are increasingly tightened and whose infractions are punishable by huge fines, having backups ensures that all information is properly controlled and compliant with the law. </li>
</ul>
If the importance of making backups is a certain, it is equally relevant to select the type of files that will be included in the backups. This is specific to each industry and each organization, but usually the backup should include everything that cannot be easily replaced. 
It’s because of the importance of backups that it’s crucial to understand the best way to execute them: in a general perspective, the 3 - 2 - 1 rule can secure this procedure. This rule recommends three backups of data, stored in two places (and on different equipment) and one external copy (for example, in a Cloud service). 
But there are some aspects for a better backup execution that should also be considered: 
<ul>
<li>Review the backups’ reports on a daily basis: Backup reports should be reviewed daily, either manually, or through a monitoring and alerting system. Daily analysis is very important because it will allow to detect any problems that arise, preventing them from escalating into a scenario that causes serious damage. 
</li>
<li>Verify backups: Most backup systems verify the copies after the backup is complete, but regular testing should be executed to ensure file recovery, should it be necessary. 
</li>
<li>Have an incident recovery plan: Running backups does not constitute an incident recovery plan. The organization should identify and assess the risks to its operation, document what’s being done, and communicate what should be done if there’s a need to execute a recovery. This plan should allow you to assess all risks, accept those risks, or activate appropriate controls to mitigate them. 
</li>
<li>Storing backups: Backups are usually done on disks or remote sites (in the cloud), but it is important to understand how long it will take to recover the data when it’s time to recover it. The recommendation is to duplicate a certain amount of recent backup data locally to allow a quick recovery, and to have it hosted in the cloud. This allows this data to be available in seconds or minutes, rather than days. 
</li>
<li>Encrypt backups: As backups go outside the organization's systems and network, they should be encrypted to ensure that no one outside the organization has access to this data. 
</li>
</ul>
</div>