If you have been reading our hunting series, you may have noticed that many threat hunting techniques center on network-centric data sources. Thus far, we have yet to speak about the big kahuna in our hunting tool chest. We are rectifying that right here, right now: we are going to talk about Microsoft Sysmon! In this article, we’re looking at using Sysmon to hunt for threats in endpoints.We’ll highlight some of the most valuable places to start hunting in your Windows logs.

In 2019, the UK Government (NSCS) conducted The UK Telecoms Supply Chain Review, to assess and address potential risks associated with the supply chain of telecommunications infrastructure in the country. The review highlighted the risks associated with reliance on certain vendors, particularly those with high-risk profiles. It also recommended increased oversight and regulation to mitigate security risks and protect critical national infrastructure.

The pandemic highlighted the fragility of the global supply chain ecosystem. Now every company is striving to ensure they will never be crippled by unforeseen supply chain issues. Mentions of “supply chain” in US SEC-filed annual reports more than doubled from 2019 to 2021 to nearly 5,000 as chief supply chain officers were reluctantly escorted into boardroom discussions to explain the business risk to their company.

The Center for Internet Security (CIS) defines CIS Critical Security Controls as: “A prioritized set of Safeguards to mitigate the most prevalent cyberattacks against systems and networks.” Essentially, CIS Controls are a framework of actions that organizations can take to improve their overall security posture. These controls are organized into categories and updated frequently to address emerging threats and technologies. In this article, we’ll look deeper into all 18 controls.

Imagine a scenario where a competitor gains access to your organization's most sensitive data, causing severe financial loss and irreparable damage to your reputation. This nightmare can become a reality through data exfiltration. Data exfiltration is a real threat to organizations, as it involves the unauthorized transfer of sensitive information, the effects of which can lead to operational disruption, financial losses and damage to reputation.

At Splunk, you may hear us pontificating on our ponies about how awesome and easy it is to use Splunk to hunt for threats. Why, all you need to do is use X and Y with Splunk to find a Z score (no zombies were injured) and BOOM! That baddie in your network is detected. Going back to at least a decade, we’ve tried to make it easy — as you’ll see in the resources below — and yet threat hunting is about as easy as telling someone how easy it is to draw an owl.

Even with the best strategies in place, cyber professionals understand that it’s only a matter of when, not if, a cyberattack will happen. Hence, a risk management and incident response plan is necessary for an organization’s cybersecurity posture. While such plans won’t wipe out the financial and reputational aftermath of a cyberattack — a cyber insurance policy can help your organization recover from such attacks.

In an ideal world, organizations should have round-the-clock protection for their corner of cyberspace, and prompt response to cyber-attacks. For this to happen, you’llneed top talent, equipped with sophisticated tools and knowledge of up-to-date security practices. But this is hardly the case for most organizations, meaning most are left vulnerable and seeking security solutions from third parties offering MDR services.

From 2010 to 2020, the amount of data being generated, stored and shared grew by nearly 5000%. During the COVID-19 pandemic, data breaches also spiked in the US. Makes sense, then, that protecting this valuable asset has become a top priority for businesses. Enter data scanning — a powerful process that helps organizations identify and safeguard sensitive data. In this blog post, we will delve into the concept of data scanning, its importance and the key benefits it brings to the table.

APIs play a significant role in seamlessly integrating applications and services. However, APIs with security vulnerabilities could open doors to cyber attackers and compromise sensitive and confidential data and systems. Therefore, it is imperative to incorporate API security testing into the API development process as early as possible.