In AWS, AWS Network Firewall policies control firewall rules, defining the monitoring and protection behavior for a firewall by using rule groups and policy default settings. Here’s a more detailed explanation: Firewall Policy: This defines the monitoring and protection behavior for a firewall, specifying how traffic is handled. Rule Groups: These are collections of rules that define the Read More …
Tag: learn
ENIAD – Environment, Network, Intelligence, Analysis, and Decision
The ENIAD concept is a framework designed to enhance threat detection and response capabilities within cybersecurity. It stands for Environment, Network, Intelligence, Analysis, and Decision. Each component plays a crucial role in creating a comprehensive approach to identifying and mitigating threats effectively. Here’s a breakdown of each element: 1. Environment The Environment refers to the Read More …
MAC – Mandatory Access Control
A Rigid Security Model Mandatory Access Control (MAC) is a security model where access to resources is determined by a central authority based on security labels assigned to both subjects (users, processes) and objects (files, resources). Unlike discretionary access control (DAC), where the owner of a resource can control who accesses it, and role-based access Read More …
Tales from the Cloud Trenches
Source In a recent threat hunt, Datadog Security Labs uncovered sophisticated attacker activity stemming from a leaked, long-term AWS access key (AKIA*). Within a mere 150-minute window, five distinct IP addresses were observed attempting to leverage this compromised key, executing various malicious techniques, tactics, and procedures (TTPs). This incident brought to light several previously unreported Read More …
CAA – Certification Authority Authorization
A CAA record is a type of DNS (Domain Name System) record that helps improve the security of a domain by specifying which certificate authorities (CAs) are allowed to issue SSL/TLS certificates for that domain. To understand this better, let’s break it down: What is DNS? DNS is like the phonebook of the internet. It Read More …
ENIAD – Endpoint, Network, Identity, Application, Data
Overview of ENIAD The ENIAD framework provides a comprehensive approach to cybersecurity by focusing on five critical areas that organizations must protect to ensure a robust security posture. Each component addresses specific aspects of security, enabling organizations to detect, respond to, and mitigate threats effectively. 1. Endpoint Endpoints refer to devices that connect to the Read More …
SID – Security Identifier
A Security Identifier (SID) is a unique, variable-length alphanumeric string assigned by an operating system (OS), like Windows, to every security principal. A security principal can be a user, group, computer, or process that can be authenticated by the OS. SIDs are fundamental to how these systems manage access to resources. Here’s a more detailed Read More …
The Open-Source Arsenal of Ivanti CSA Attackers
Recent forensic investigations by Synacktiv’s CSIRT have shed light on the common open-source tools leveraged by threat actors in incidents stemming from compromised Ivanti Cloud Services Appliance (CSA) devices. While initial access often exploited zero-day vulnerabilities in Ivanti CSA (CVE-2024-8963, CVE-2024-8190, CVE-2024-9380, CVE-2024-9379), subsequent attack stages frequently utilized publicly available, and sometimes “noisy,” tools for Read More …
Conference Video – Fundamentals – Distressingly Overlooked – David Elfering
In an era increasingly dominated by artificial intelligence (AI), the fundamentals of cybersecurity remain critically important for IT professionals. As organizations integrate AI technologies into their operations, the attack surface expands, creating new vulnerabilities that can be exploited by cyber criminals. Understanding core cybersecurity principles—such as risk management, threat detection, and incident response—enables IT teams Read More …
Notes :: Parallel Processing & Parallel Databases
At its core, parallel processing is about breaking down a large, complex task into smaller, manageable sub-tasks that can be executed simultaneously across multiple processing units or nodes. Think of it like a team project where different members tackle different parts of the assignment at the same time, leading to much quicker completion than if Read More …