Our expert team knows how to anticipate, collaborate, and innovate.
About feature 2
Work with leaders in your field to develop insight, experience and truly add value.
About feature 1
Our expert team knows how to anticipate, collaborate, and innovate.
About feature 2
Work with leaders in your field to develop insight, experience and truly add value.
About feature 1
Welcome back to another The Cyber Blog Times article.
Today, we discuss a journey towards cloud migration. A trendy topic nowadays, especially since securing the cloud remains a cornerstone.
What is cloud migration? Why is that so important? How can you migrate in a secure way? We’ve got your back!
On the 9th of April, 2021, the Commission de Surveillance du Secteur Financier (hereinafter, “CSSF”) published a new Circular dedicated to teleworking (Circular CSSF 21/769), which comes into force on the 30th of September, 2021. This Circular applies to all supervised companies and is a clear example of how the pandemic has tumbled the world and is slowly letting the way towards the “new normal”. Where teleworking was seen as an exception, it is now slowly becoming the new rule or at least an option for employees at a larger scale.
Welcome back to our fifth article from The Cyber Blog Times Edition. Today, we discuss security automation.
Without further ado, let’s see what security automation consists of. It consists of using technologies to perform tasks, with reduced human effort, to integrate processes, applications, and security infrastructure.
Today, it is common for software, companies, etc. to provide a web API to expose data to their customers or partners11. https://blog.postman.com/api-growth-rate/. The objective is to facilitate the integration between Information Systems and create new business opportunities. For example, for banks, API was a way to provide more services to their customers through mobile applications. Do you remember the last time you needed to contact your bank directly or go physically to your bank agency?
In the hope of preventing a breach, companies deploy various detectors: from border security (firewall, proxies, …) to endpoint protection (EDR, antivirus, …). And, potentially, centralize all these events in a SIEM to correlate and implement Use Cases.
So many solutions and vendors, but yet some questions remain: how well (or not) is your detection against the most common attack vectors for your business sector? Are you able to detect attackers’ activity once they breached your infrastructure? Do you have overlapping sensors?
This article presents a framework, Mitre Att&ck (Adversarial Tactics Techniques & Common Knowledge), which becomes more and more popular and attempts to address the above questions. We will first, remind the existing methods and detail how Mitre Att&ck contributes to improving the understanding of an attack. We will then describe the various objectives achievable with this, as well as the requirements to get the most of it. Lastly, we will consider the interface developed by Mitre to fulfil the objectives efficiently.
Agility, flexibility, COVID, … Organizations are adopting the cloud! This is the observation made by Excellium Services during its security interventions (incident response, security assessment, security configuration, …). From cost allocation to the “Pay as you use” payment solution allowing more financial flexibility, to the management of the delegated service, including the centralization of logs favouring permanent access by the customer to the latest information, Microsoft is drawing attention with its new Azure Sentinel security offer.
What have we learned from the latest 30 years of password storage? We went from plaintext passwords in databases to hashed passwords, salted and even peppered passwords. Distributed computing required algorithms to adapt to new types of workload. So, what are the best practices, and what makes a truly resistant password hash against offline cracking?
Let’s review the basics of password hashing and the usage of the different algorithms used by the industry. Read more
The Customer Security Controls Framework (CSCF) describes a set of mandatory and advisory security controls. To be compliant, all users need to be in line with all the mandatory security controls and suffer an annual assessment.
