proofpoint

In the first podcast we talked about how an organisation may defend themselves based on real world threat data, now we look at the threat actors behind the attacks, and think about how we can use that information proactively.

In this podcast we talk about:

-The different threat types and actors behind them

-How the email threat landscape has evolved, and continues to evolve based on real world events

-The various elements that make up an attack

-New variants of threat to be aware of, such as Telephone Oriented Attack Delivery (TOAD) and malicious files within container files

Effective defence comes when you can anticipate your attackers moves. Combining threat landscape insights with data on which of your users are targeted with which threats, organisations can build more effective security awareness training programs, and users can better defend themselves from the threats they are most likely to see.

In this podcast we talk about:

-How a bad actor might decide to attack your organisation

-How easy your users may be phished based on information they post on social media

-Users are not the weak link, they are just the easiest and cheapest for an attacker to target

-Every user has a unique risk profile, and because of that they have different security and training requirements

-It’s not possible to have a “one size fits all” program that trains users effectively

-The threat landscape changes day to day, you need to adapt with it so your training stays current and relevant

Eddie Whittingham started a company called The Defense Works in 2016. His idea was to provide companies with information on how to avoid getting hacked. Whittingham created a series of animated video clips explaining cyber security best practices and offered his content on a subscription model to companies.

By 2020, Whittingham had bootstrapped his business to 8 full-time employees when he attracted an offer of 7 times revenue from Proofpoint, one of the largest players in the cyber security industry. Whittingham got Proofpoint up to 10 times revenue and agreed to the deal.

Why this difficult challenge has become a burning imperative

Join the conversation where we will address

• Why insider risk is fast becoming the primary attack path
• Pragmatic controls to grow an insider risk capability
• Tools and techniques to raise security awareness and reduce the attack surface

Bryan got phished (almost) - story time!

https://isc.sans.edu/forums/diary/Do+you+block+new+domain+names/17564/

Through OpenDNS

https://learn-umbrella.cisco.com/product-videos/newly-seen-domains-in-cisco-umbrella

Available January 2017, Umbrella filters newly seen or created domains. By using new domains to host malware and other threats, attackers can outsmart security systems that rely on reputation scores or possibly outdated block lists. Umbrella now stops these domains before they even load.

Also “unknown” category? pros/cons

Good filter time for domains?

Amanda: windows logging issues

well…. FUCKING EVERYTHING CREATES TASKS IN SCHEDULER

https://www.microsoft.com/en-us/windowsforbusiness/windows-atp

Breach news:

https://www.dutchnews.nl/news/2019/05/hackers-steal-key-info-about-home-hunters-from-housing-agency/

FTA: The hackers now have their name, address, contact information and copies of their passport or ID card, which includes their personal identification number, or BSN.

This is sufficient to allow the hackers to open bank accounts or take out loans by using other people’s identity.

https://www.bleepingcomputer.com/news/security/over-757k-fraudulently-obtained-ipv4-addresses-revoked-by-arin/

Mostly colos, data centers, ‘aaS’ providers

Many in the Mid-West

Book Club

Cult of the dead cow - June

Tribe of Hackers - July

The Mastermind - August

The Cuckoo’s Egg - September

https://www.infoseccampout.com

EventBrite Link:https://www.eventbrite.com/e/infosec-campout-tickets-61915087694

This week, Imperva to acquire DevOps security leader prevoty, Carbon Black announces second quarter results, Sophos group upgraded to add at Numis Securities, Tenable jumps 31% by end of trading day at IPO, and Amalgamated Bank has $1.44 million holdings in CA, Inc.

Full Show Notes: https://wiki.securityweekly.com/BSWEpisode94

Visit http://securityweekly.com/category/ssw for all the latest episodes!

This week, Imperva to acquire DevOps security leader prevoty, Carbon Black announces second quarter results, Sophos group upgraded to add at Numis Securities, Tenable jumps 31% by end of trading day at IPO, and Amalgamated Bank has $1.44 million holdings in CA, Inc.

Full Show Notes: https://wiki.securityweekly.com/BSWEpisode94

Visit http://securityweekly.com/category/ssw for all the latest episodes!