In this blog post, we outline the research our Threat Intelligence team has undertaken into this new attack vector. A new LOLBins tactic for executing payloads through PowerShell was released by Alh4zr3d, a security researcher, on Twitter in September 2022. In the tweet, the security researcher recommended that organisations stay away from IEX and Invoke-WebRequest when using PowerShell commands and, as a substitute, host a text record with their payload on a domain.

Our new CFO cybersecurity survey, which surveyed 180 CFOs, CEOs and other financial executives worldwide, has highlighted the fact that Chief Financial Officers are very confident in their companies’ abilities to ward off cyber security incidents, despite being underinformed on the cyber risk their businesses face. Almost 87% of the surveyed executives expressed this confidence, yet 61% of them had suffered at least three significant cyber incidents in the previous 18 months.

Penetration testing plays a key role in identifying and addressing vulnerabilities by simulating the behaviour of a potential attacker. A range of penetration testing methodologies have been developed to enable security professionals to achieve this safely and effectively. In this blog post, we discuss the leading pen testing methodologies, what they involve and the aspects they cover.

While BYOD provides flexibility to employees and organisations, it also presents a number of risks. In this blog post, we discuss the issues created by the use of BYOD and outline the elements of an effective checklist.

In this blog post, we discuss the different types of challenges that third party relationships present and outline specific ways to defend against them. Third party risk is created when companies in an organisation’s supply chain have access to its data, systems or privileged information. This can lead to issues such as data breaches, IP theft or other security incidents. Organisations can be held accountable for security breaches even if they originate from a third party.

In Q2 2022, Kroll observed a 90% increase in attacks against the health care sector in comparison with Q1 2022, making it the most affected sector during this period. While this may signal the official end of the pandemic-era “truce” that many cybercriminals promised at the onset of COVID-19, threat actors are continuing to leverage other hallmarks of the pandemic, such as remote work access, to gain a foothold into victim networks.

In this blog post, we outline what continuous penetration testing is, how it works and how it can help improve your cyber security.

The National Institute of Standards and Technology (NIST) recently updated its guidance to offer support for key practices and approaches involved in successful cyber security supply chain risk management (C-SCRM). In this blog post, we provide an overview of the update and what it means for organisations.

Kroll Responder MDR has been recognised as the Best Managed Security Service at the SC Awards 2022. The results were announced at the awards’ first live celebration in three years, at a ceremony held at the London Marriott, Grosvenor Square. We were also finalists in the Best Incident Response Solution category. The SC Awards celebrate the cyber security products and services that continue to stand out from the crowd and exceed customer expectations.

In this blog post, we outline some of the most common types and the steps organisations should take to defend themselves.