CISA Calls For Increased Vigilance One Year After Ukraine’s Russian Invasion
Gaining more detections at all security layers — endpoint, network, email, IAM, cloud, etc.— and moving to the cloud are the key lessons from the past year.
-
-
A Year of Conflict: Cybersecurity Industry Assesses Impact of Russia-Ukraine War
Ukraine has significantly boosted its continuous security monitoring capabilities so they can quickly detect and respond before attacks can have major impact.
-
What CISOs Don’t Know About Their SOCs
CISOs and security operations teams attempting to protect enterprise networks, data and assets face growing complexity. Automation and MITRE ATT&CK can help.
-
Securing Multiple Cloud Environments The Top Challenge for SOCs in 2023
Cloud changes everything — including how we do threat detection and response. Securing the cloud requires entirely new data sources to be ingested by the SIEM.
-
Economic Headwinds Could Deepen Cybersecurity Skills Shortage
35% of organizations have a shortage of security engineers. Vendors like CardinalOps can bridge the detection engineering gap with automation and MITRE ATT&CK.
-
Threat Actors Shift From Malicious Macros to LNK Files
Initial access via malicious LNK files is a clever technique that’s been used for years, including in the Stuxnet attacks first uncovered in 2010.
-
More Automation and Complex Attacks — Enterprise Security Predictions for 2023
Leadership will be asking CISOs to report on their defensive posture using metrics based on industry-standard frameworks such as MITRE ATT&CK.
-
Cybersecurity Predictions for 2023
Automation will move into areas of Security Operations that are still dependent on manual processes, such as exposure management and detection engineering.
-
Detecting Microsoft Outlook Vulnerability CVE-2023-23397 in Splunk, IBM QRadar & Microsoft Sentinel
Summary Discovered by the Ukrainian CERT and attributed to APT28 (aka Fancy Bear or Strontium, the Russian GRU threat actor), CVE-2023-23397 is being actively exploited in targeted attacks against government, transportation, energy, and military sectors
-
Security Top IT Investment Priority in 2023
Prioritize security investments that support the business, such as cloud initiatives. Invest in people and human creativity to defend against adversaries.
-
‘Black Proxies’ Use 187,000-Plus IP Addresses to Launch Credential Stuffing Attacks
SOCs should monitor for unusual or unauthorized behavior using adversary playbooks from MITRE ATT&CK rather than relying on static IOCs.
-
DEV-0569 Ransomware Group Remarkably Innovative, Microsoft Cautions
Malicious ads are tough to defend against, so ensure SoC has detections for suspicious or unauthorized behavior, such as privilege escalation and LoTL tools.