Cyber Defense eMagazine August Edition for 2021

More documents

Recommendations

Info

sources. This is especially powerful information for North Korea, as only 26% of their population has access to electricity. Kimsuky, according to United States officials, is likely tasked by North Korea with a global intelligencegathering mission. This attack is not the first attack Kimsuky has launched at South Korean infrastructures, as they succeeded in attacking Korea Hydro & Nuclear Power Co. Ltd back in 2014. The group has also been attributed several other attacks on South Korea using a backdoor called AppleSeed for Windows and Android systems. In response to the claims about the attack, KAERI issued a statement explaining that an unidentified outsider accessed parts of its systems, exploiting a weakness in their virtual private network (VPN). Regarding the attack, they blocked the IP address and updated their security after the attack was discovered on May 31st. The damage from this hack is not yet known. Incidents like this highlight to the world that critical infrastructure components can be vulnerable to cyberattacks. In response, we need to ensure that the organization’s security objectives are clear and met. The focus of compliance should not be just meeting it but having real security objectives to prevent future attacks. It is the standard procedure for companies adhering to a certain compliance level to check their networks daily for vulnerabilities. Such practices are in place because we assume that there could be a malicious actor looking to exploit any vulnerability and open our systems. For vital infrastructures such as water and energy enterprises in the United States and abroad, we need to examine our identity privilege and adherence to the Principle of Least Privilege since it is the industry’s best practice to stop the damage from hacks. When we look at the Principle of Least Privilege, we can see the advantages of ensuring that users, systems, and processes only have access to resources they need to perform their function inside an organization. Combining PoLP with zero trust - especially around network segmenting - can help deliver the desired level of network security. Limiting the reach of any one network user by governing their access makes it more difficult for attacks such as the Colonial Pipeline and KAERI to occur. Limiting the ability of one user account to affect the whole network limits the effect a malicious actor can have on your network. By auditing the systems in place to determine the minimum privilege necessary for any user, system, and process, organizations can implement the Principle of Least Privilege to each entity. Start by examining the organization’s protocols from the perspective of an attacker to determine points of interest most likely to be exploited. What privileges have we granted remote users? What access levels have they been granted? How much damage can a rogue user do if they have access to that account? Cyber Defense eMagazine – August 2021 Edition 38 Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.
After answering these questions and enhancing the networks with segmentation, implementing zero trust, and then enforcing the Principle of Least Privilege, organizations can lower the risk of significant attacks. It is crucial to monitor these privileges to insure a secure network for the enterprise. About the Author Garret Grajek, CISSP, CEH is CEO of YouAttest. YouAttest is a cloud based IGA tool that automates both periodic and dynamically triggered access reviews for compliance and identity security. Garret can be reached online at ggrajek@youattest.com and at https://youattest.com/ Cyber Defense eMagazine – August 2021 Edition 39 Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.
Page 1 and 2: Understanding The Importance of Des
Page 3 and 4: From Security-Enhanced 5G Networks
Page 5 and 6: @CYBERDEFENSEMAG InfoSec Knowledge
Page 7 and 8: Cyber Defense eMagazine - August 20
Page 33 and 34: Understanding The Importance of Des
Page 35 and 36: 4. Is there some sort of final secu
Page 37: Evaluating Security Practices in Re
Page 41 and 42: • Microsoft released patches for
Page 43 and 44: Four Ways Smart Cities Can Stay Saf
Page 45 and 46: From the technology perspective, th
Page 47 and 48: The Psychology of a Cybercriminal M
Page 49 and 50: Hacktivism One often-overlooked cyb
Page 51 and 52: A 2019 study revealed that 91% of e
Page 53 and 54: • Regularly check and update your
Page 55 and 56: ● ● Regulatory fines and penalt
Page 57 and 58: But how can leaders prepare for a r
Page 59 and 60: Black Market as Sustainable Ecosyst
Page 61 and 62: shopping centers, trade malls and t
Page 63 and 64: PKI Rises to the Challenge Using X.
Page 65 and 66: 7. Application Code Signing Code si
Page 67 and 68: Greater IT Freedom with Tighter IT
Page 69 and 70: Ninety percent of respondents say e
Page 71 and 72: A PETs-Enabled Path to Secure & Pri
Page 73 and 74: is important that all internal stak
Page 75 and 76: Automated scanning is not enough Ma
Page 77 and 78: continuous game of catching up each
Page 79 and 80: Top Tips Every SMB Must Know to Saf
Page 81 and 82: where hackers will either change a
Page 83 and 84: From Security-Enhanced 5G Networks
Page 85 and 86: of intelligence, the latter being d
Page 87 and 88: About the Author David Soldani rece
Page 89 and 90:
The unpredictability component in c
Page 91 and 92:
anticipating the blind spots of the
Page 93 and 94:
Cybercrime is constantly on the ris
Page 95 and 96:
How Much Will You Have to Pay to Be
Page 97 and 98:
and California Consumer Privacy Act
Page 99 and 100:
It’s Time to Issue Company Passwo
Page 101 and 102:
Non-Enterprise Grade Communication
Page 103 and 104:
How to Communicate with your employ
Page 105 and 106:
Security Issues of Working Remotely
Page 107 and 108:
Another way a leak or theft can hap
Page 109 and 110:
However, new research finds almost
Page 111 and 112:
To Reduce Risk, Feds Need To Reeval
Page 113 and 114:
environment, designed to address wo
Page 115 and 116:
A penetration test has two typical
Page 117 and 118:
Black Box In the event of a real cy
Page 119 and 120:
which represent the highly polarize
Page 121 and 122:
5 Tips to Prevent a Security Breach
Page 123 and 124:
Secrets detection can be added in t
Page 125 and 126:
when it reaches its destination. Th
Page 127 and 128:
Maturity-Based Approach vs. Risk-Ba
Page 129 and 130:
To be successful in using a risk-ba
Page 131 and 132:
About eSentire eSentire Inc., is th
Page 133 and 134:
adjust score weights to ensure fina
Page 135 and 136:
Hostname-based pattern model Traffi
Page 137 and 138:
Cyber Defense eMagazine - August 20
Page 139 and 140:
Page 141 and 142:
Page 143 and 144:
You asked, and it’s finally here
Page 145 and 146:
9 Years in The Making… Thank You
Page 147 and 148:
show all

Cyber Defense eMagazine August Edition for 2021

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?