Reasons to consider a managed SOC
In this blog, we outline the benefits of opting for a managed SOC instead of setting up and running your own in-house SOC.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
April 2022
Critical Vulnerability in Multiple WSO2 Products Exploited - CVE-2022-29464
Over the past week, threat actors have started scanning for and opportunistically exploiting CVE-2022-29464--a remote code execution vulnerability in multiple WSO2 products used to integrate application programming interfaces (API), applications, and web services. CVE-2022-29464 vulnerability has a CVSS score of 9.8 and severity of Critical which allowed unauthenticated and remote attackers to execute arbitrary code in the following products.
Cybersecurity Best Practices for the Oil and Gas Industry
While every sector of the economy experiences cyber attacks, the oil and gas industry is a particularly enticing target because there are inherent weaknesses in its rapidly expanding digital landscape. It's also an industry that can't afford to go offline at any time, which means cybercriminals can force quick action from those they attack.
How the Arctic Wolf Platform Can Stop Business Email Compromise Attacks
In this whiteboard session, Matt Trushinski, Director of Product Marketing, shows how the Arctic Wolf® Platform can stop business email compromise attacks by using a real-life example from a customer. Additional Resources: About Arctic Wolf.
Automated Threat Hunting: A Closer Look
Proactively finding and eliminating advanced threats through threat hunting is a growing necessity for many organizations, yet few have enough resources or skilled employees to do it effectively. For those who do have an active threat hunting program, the process is often manual and time consuming. With cloud security automation, however, you can implement rules that automatically adjust your security policies based on the latest threat data.
Arctic Wolf Security Operations Cloud
In this whiteboard session, Brandon Tschida, Director, Presales Engineering, walks you through the Arctic Wolf® Security Operations Cloud. Threats are increasing at an exponential rate and the traditional approach of leveraging tools to combat the problem no longer works. With growing threat alerts and a lack of trained people to hire, organizations need a new approach to stay secure. With Arctic Wolf's Security Operations Cloud, security operations are delivered as a concierge service. Reduce the noise at your organization and only receive 1-2 real alerts in any given week.
How the Arctic Wolf Platform Stops Active Ransomware
In this whiteboard session, Matt Trushinski, Director of Product Marketing, shows how the Arctic Wolf® Platform can stop ransomware by using a real-life example from a customer. The incident started after a bad actor with stolen credentials logged into multiple systems at 5:23 a.m. Learn the details of how Arctic Wolf's Triage Team began investigating within minutes to alert the customer and stop the active ransomware in its tracks.
Modernize security operations
Evolving cyber threats drive a growing need to achieve real-time situational awareness. Sumo Logic enables a cohesive security strategy by proactively identifying critical insights. Teams need a security monitoring solution that quickly detects potential threats, a modern cloud SIEM solution with contextualized threat insights and a cloud SOAR that automates incident management. Learn how Sumo Logic empowers security teams to modernize security operations.
How the Arctic Wolf Platform Helps Reduce Cyber Risk
In this whiteboard session, Matt Trushinski, Director of Product Marketing, shows how the Arctic Wolf® Platform helps reduce cyber risk by ingesting raw telemetry from a customer's environment and turning it into high-quality, actionable security alerts. Learn how the platform can parse, enrich, and analyze data to improve a customer's security posture over time and harden their environment—and, ultimately, end cyber risk at their organization.
The Cybersecurity Dangers of Cryptocurrency
Cryptocurrency, the next generation of money. Adored by luminaries from Elon Musk to Snoop Dogg. Now the official currency of El Salvador, and a funding source for Ukrainian resistance to the Russian invasion. But is crypto really all that it seems? Cryptocurrency has tremendous potential to address a host of the world’s financial issues: from limited access to financial resources, to ineffective and costly payment and transfer services.
What Is Identity Lifecycle Management?
If you help to manage cloud environments, you’re probably familiar with the concept of identity lifecycle management. Identity lifecycle management helps you keep track of who is allowed to do what within your cloud. But merely understanding identity lifecycle management isn’t enough to administer modern cloud identities effectively. You also need a way to automate identity lifecycle management at massive scale.
What Is Cryptojacking and How Can You Defend Against It?
It should come as no surprise that as cryptocurrencies become more popular and edge towards the mainstream, the mining of these digital currencies—which uses computing power to solve complex math problem— has given rise to a new form of cyber attack: cryptojacking. Cryptojacking may sound like a way to steal someone's cryptocurrency assets, but it's a less obvious form of theft.
Seamlessly Secure Your Cloud Workloads
You’ve secured your cloud identities. You’ve hardened your cloud security posture. You’ve configured strong cloud access controls. But there’s still one more thing you need in order to secure your cloud environment: a cloud workload protection platform, or CWPP. Cloud workload protection platforms secure the workloads that run on your cloud — which are distinct from the infrastructure, user identities and configurations that form the foundation of your cloud environment.
The Karakurt Web: Threat Intel and Blockchain Analysis Reveals Extension of Conti Business Model
Tetra Defense, an Arctic Wolf® company, partnered with Chainalysis to analyze the link between the Karakurt cyber extortion group to both Conti and Diavol ransomware through Tetra’s digital forensics and Chainalysis’ blockchain analytics. As recent leaks have revealed, Conti and Trickbot are complicated operations with sophisticated structures. But, our findings indicate that web is even wider than originally thought, to include additional exfiltration-only operations.
Wormable Vulnerability in Windows Remote Procedure Call (RPC) - CVE-2022-26809
April Patch Tuesday brings 145 vulnerability fixes from Microsoft — the highest number in 19 months—including CVE-2022-26809, a critical remote code execution (RCE) vulnerability in Windows Remote Procedure Call (RPC) Runtime library that impacts all supported Windows products. Notably, Microsoft also released security updates for Windows 7, an end-of-life product since January 2020, which highlights the severity of CVE-2022-26809.
How to Foster a Productive SOC Culture
According to the 2021 Devo SOC Performance ReportTM — which is based on the results of a survey of more than 1,000 security practitioners — having an understaffed SOC or constant turnover of security talent can cripple an organization’s security posture. Let’s look at some of the root causes that can lead to these two interconnected problems.
NginxDay: Vulnerabilities in NGINX's LDAP Reference Implementation
On Monday, April 11, 2022, NGINX published a security blog post detailing three vulnerabilities in the NGINX LDAP reference implementation. NGINX is web server software that also performs reverse proxy, load balancing, email proxy, and HTTP cache services. No CVE has been assigned to these vulnerabilities at this time. The reference implementation uses Lightweight Directory Access Protocol (LDAP) to authenticate users of NGINX proxied applications.
How to Foster a Productive SOC Culture
According to the 2021 Devo SOC Performance ReportTM — which is based on the results of a survey of more than 1,000 security practitioners — having an understaffed SOC or constant turnover of security talent can cripple an organization’s security posture. Let’s look at some of the root causes that can lead to these two interconnected problems.
Automatically Add IP Addresses to a Penalty Box in Cloudflare with Torq
Good security may come from strong defenses, but strong security comes from a good offense. This is especially true for network security, where minutes can make the difference between a breach and a near miss. For example, if an unknown IP address triggers an alert for suspicious or abusive behavior, the faster you can isolate and block that address, the less likely it is that the person or entity at the other end can do damage.
Elastic's James Spiteri: Why SecOps teams need to focus on small incremental wins and not try to boil the ocean
In our second episode, we speak with Elastic’s Product Marketing Director James Spiteri, an experienced security practitioner turned product marketer with a passion for making security accessible and easy for anyone and everyone.
Multiple Critical Vulnerabilities Disclosed in VMware Products
On Wednesday, April 6, 2022, VMware disclosed several critical-severity vulnerabilities impacting multiple VMware products. If successfully exploited, the vulnerabilities could lead to Remote Code Execution (RCE) or Authentication Bypass. In addition to the critical severity vulnerabilities, VMware disclosed several high and medium severity vulnerabilities, which could lead to Cross Site Request Forgery (CSRF), Local Privilege Escalation (LPE), or Information Disclosure.
Top Cyber Attacks of March 2022
In an unsettling new phase of the cybersecurity era, Russia’s ground war in Ukraine and behind-the-scenes war on the internet have dovetailed into an upswing of cybercrime that may or may not be politically motivated. Time will tell how this online maneuvering ultimately plays out, but for the moment tension abounds as the cybersecurity community anticipates the next big attack.
Training Will Be Key to Retaining SOC Analysts
Working in a Security Operations Center (SOC) is like working in an emergency room on a weekend shift at 2 AM. The steady stream of new alerts screaming for attention and combined with the lack of enough trained personnel make it a miracle that it all seems to work through on a string and a prayer. The question is though, when will the luck run out?
Casino Cybersecurity: A Winning Bet
According to the American Gaming Association, there are 981 casinos in the United States, raking in more than $57 billion annually in gross gaming revenue. With that much money at play, it’s no wonder hackers view casinos as potential jackpots. And while the public tends to consider casinos as exceptionally secure, the reality is this: When it comes to cybersecurity, the house doesn’t always win.
Understanding the Spring4Shell Vulnerability
Learn what the Spring4Shell vulnerability is, why Arctic Wolf has developed the Open Source Spring4Shell Deep Scan, and how to use the Spring4Shell Deep Scan tool to mitigate the impact of the vulnerability.
Modern Security Operations Center Framework
With agile development, the software development life cycle has evolved, with a focus on customer satisfaction to enhance product features based on user feedback. This helps shorten the time to market, since teams can release a minimally viable product, then continuously improve its features. The agile technique encourages team cooperation through sprints, daily standups, retrospectives, testing, quality assurance and deployment.
GitLab Password Security Vulnerability - CVE-2022-1162
On Thursday, March 31, 2022, GitLab released an advisory for a critical password security vulnerability in GitLab Community and Enterprise products tracked as CVE-2022-1162. GitLab is DevOps software that combines the ability to develop, secure, and operate software in a single application. The exploitation of CVE-2022-1162 can allow a threat actor to guess a hard-coded password for any GitLab account with relative ease.
Sponsored Post
5 Challenges to Security Operations Strategies
Do you love SecOps in theory, but just can't seem to make it work in practice? Or, maybe you've already implemented a security operations strategy to some degree within your organization, but struggle to make IT operations and security jive as seamlessly as you would like? Either way, there's a good chance that your troubles stem from one or more of the common barriers to SecOps strategies. This article explains why businesses often fail at implementing SecOps successfully and how they can work around the roadblocks.