Request Demo

Connective Platform™

Connective Shield

Connective Identity

Connective Vigilance

Solutions

Partners

Support

Company

Blog

Career

About Us

+1-303-423-4500

Contact Us

Analytics

Big Data

Billing

Business

Business Intelligence

Cloud Computing

Consulting

Cybersecurity

Data Warehouse

News

Services

Technology

Testing as a Service

We focus on reliability, quality, and value.

Organizations of different sizes have different ways of dealing with cyber security challenges. Depending on external factors, the environment they operate in, or internal factors such as budgetary constraints, they might choose to manage their security with an in-house team, or outsource it to a dedicated firm. Either way presents its own challenges, and each has something to recommend it. This post aims to explore some of the advantages and drawbacks of either route.

When considering the question of whether it is better for a company to outsource security solutions or to maintain their in-house security team, there are no easy answers. There are countless questions to be answered on the road towards resolution, and the outcome is more reliable the more it is considered. However, there are some handholds along the way, perspectives that reliably illuminate the issue at hand. For example: what is the need that either a SOC or an MSSP seeks to fulfill? 

It’s the company’s need to secure changing environments.

What is involved in the process? What big-picture questions should be considered?

Systems engineers, network architects, database administrators, the security team—everybody who is familiar with the existing environment will begin learning about new technologies as and when the company’s needs make it necessary. They will have to gather experience starting at that point. 

Does the company want that? —or do they replace their workforce based on relevant experience? —or do they outsource operations to an MSSP?

Then there are more practical questions as we move from the big picture to the nitty gritty. Just a few examples: Do we migrate this on-prem data center to a cloud environment? When in the cloud, do we want a serverless architecture or not? What about legacy web applications? 

As we move towards the smaller details, the more the answer depends on a host of factors. So instead, let’s consider the big picture.

Creating an internal Security Operations Center (SOC)

A SOC is a centralized entity within an organization that deals with cyber security strategies, their implementation, and manages incidents. At an organization conscious of their security posture, the SOC is involved with most projects from the planning phase on. This usually requires a variety of resources and talent, because an incomplete security coverage can open up organizations to potentially devastating consequences.

People, processes, and technology are the high-level building blocks of a SOC. Understanding the needs and requirements of each is essential when setting up the department. 

The first building block are people; the professionals hired to deal with security, such as SOC analysts and incident responders. IT professionals are in high demand, and those specializing in cyber security, even more so. Hiring and holding on to motivated and knowledgeable individuals is a major challenge, but once overcome, the resulting team can be highly versatile and always available to deal with the specialized demands of the organization.

Processes are what guide employees when they are investigating or managing an incident, set up to clarify what needs to be done and how to assess what has been accomplished. 

The third building block, technology is made up of all the tools used to identify issues or detect bad actors. Technology helps you develop network awareness and assess threat levels.

Cost is perhaps the single biggest factor that guides decisions in the early stages of SOC development. The company has to set aside a budget, and have a clear idea of what that budget will allow them to achieve. A good rule of thumb would be 5% of the global budget going towards IT—at minimum. Once the budget is set, a clear timeline is established, but that timeline need not be detailed at this point. Think in terms of quarterly expectations, organized phases, milestones to be reached; this will help individuals involved in setting up the SOC make better detailed plans and break down larger tasks to smaller, more manageable projects. It will also help to establish priorities and lay out the most important items to execute. The aim of a roadmap like this is to develop accountability, but, even more importantly, to help mature SOC teams as they specialize into prevention, threat assessment, or monitoring. 

With a SOC, companies can choose and customize software to suit their needs. A Security Information and Event Management (SIEM) program will put the data gathered from multiple cyber security tools into perspective and will be the foundation of the SOC. 

One major benefit of an in-house security team is that all your data and logs are held locally, and are processed by the organization’s dedicated staff, which minimizes outside access. Everyone responsible for the security of the network will be under the direct supervision of the organization. 

If the SOC receives adequate budget, is staffed by competent professionals, if its setup is properly planned, and the plans are well implemented, it can provide robust protection from cyber attacks. Once all these factors come together, a SOC can solve problems quickly and efficiently, but that takes well-trained and experienced professionals such as SOC analysts and Incident Responders, as well as some time before the processes settle. Over time however, fewer and fewer changes will be necessary, and efficiency will improve.

Choosing a Managed Security Services Provider

For the reasons detailed above, especially the cost, time, and resources involved in setting up a SOC, most companies benefit from outsourcing some of their cybersecurity to third parties specializing in the field. While working with an MSSP removes some of the issues that setting up a SOC presents, it is nonetheless a tough choice for any organization. What’s more, an MSSP should never completely replace internal security operations. Before choosing an MSSP, you should have a clear understanding of your company’s needs. Those needs will guide your choice, but they will also help potential vendors offer you the solutions you need. 

Third party consultants regularly advise companies on a huge variety of matters, auditors review processes and make recommendations for adjustments. An MSSP has to provide this service as well, but continually, because the technology and the security landscape changes so fast that regular review is insufficient.

There can be any number of reasons why an organization would employ the services of an MSSP. The most common of these, other than the budgetary and resource constraints hinted at before, are (1) the organization’s needs overwhelm the support the SOC can provide, (2) the SOC cannot provide of the level of compliance necessary, or (3) having an internal team has become too much of a security risk.

The level of service from an MSSP can vary greatly with the organization’s needs, but can also change over time. Balázs Nagy, President at NewPush, advocates for a crawl-walk-run approach. As an organization is in the process of choosing an MSSP, they might start with monitoring-only services, or dedicated and limited projects, before expanding the scope of managed services.

How do you select the right MSSP

There are several advantages to employing the services of an MSSP. First, it is becoming increasingly difficult and costly to find high quality SOC analysts, as demand for talent increases. This is especially true for experienced and motivated individuals. Second is the cost, because moving towards an MSSP from an in-house team can be a gradual process with discrete periods of limited-budget projects, which not only helps to assess the capabilities of the potential partner but also to manage expenses. Further, it may be possible for your extant in-house team to move to the MSSP ensuring their continued employment, and that institutional knowledge is not lost.

The point is that there are hosts of questions to consider, a lot of decisions to be made, and the answers have actionable consequences, each with their own budgetary and manpower requirements. A company who keeps their security in-house will have to make decisions, commit to their choices, and bear the cost of their implementation. 

Whereas an internal team might be reluctant to change a system that is working right now—as they say, if it ain’t broke, why fix it?—an MSSP is expected to understand these questions, know what is involved in making these decisions, and have a reasonably reliable picture of where the technology is going to be a few years from now. 

Usually the answer is that new technology is more secure, more efficient for operations; usually the updates represent a significant improvement over existing technology. What’s more, an MSSP is expected to know and understand whether an update is in fact an improvement.

Once the company sets the goals, makes decisions on the what, the question of how is for the MSSP to sort out.

Challenges abound whether a company decides to build their own internal SOC, employ the services of an MSSP, or work with a mixture of the two. Before making a decision, a multitude of factors are to be considered, but even the process of exploring the needs and capabilities of your organization is a step in the right direction. 

The Connective Platform™ integrates a host of cybersecurity tools into one system faster than any of our competitors, but that alone wouldn't give our partners the edge over cybercriminals. Simply gathering all the data from a number of connected elements would still require an army of experts to make sense of it; it's analogous to how gathering stock prices from markets all around the world doesn't tell you where to invest your money next. Our platform goes on to analyse that massive amount of data to give our partners the information they need: where the weak points of their cyber defence are, and how to address them.

Organizations of different sizes have different ways of dealing with cyber security challenges. Depending on external factors, the environment they operate in, or internal factors such as budgetary constraints, they might choose to manage their security with an in-house team, or outsource it to a dedicated firm.

Building a SOC and choosing an MSSP

A shocking discovery by cybersecurity researchers has put thousands of LG smart TV owners at risk of having their devices remotely hijacked. The vulnerability, impacting an estimated 91,000 TVs, allows attackers to gain complete control over affected devices, potentially stealing data, installing malware, or even using the compromised TV as a launching pad for further attacks on the user's network.

The security flaws, identified as CVE-2023-6317 and CVE-2023-6318, were discovered by Bitdefender and reported to LG. While LG addressed the vulnerabilities with a patch released in March 2024, many users remain unaware of the risk and have not yet updated their devices.

Experts warn that these vulnerabilities pose a significant threat, allowing attackers to take over a victim's TV without their knowledge. The consequences could be severe, ranging from privacy invasion and data theft to financial loss and broader network compromise.

Experts urge all LG smart TV owners to take immediate action to protect themselves:

Update your TV's software: This is the single most important step. Go to your TV's settings and check for available software updates. Install them immediately to patch the vulnerabilities.

Be cautious of suspicious apps: Only download apps from the official LG Content Store and avoid installing anything from unknown sources.

Beware of phishing scams: Be vigilant against emails or messages claiming to be from LG and prompting you to click on links or download files. These could be attempts to install malware on your devices.

LG smart TV owners are encouraged to take these precautions seriously to ensure their devices remain secure and their personal information protected. 

A security vulnerability impacting a significant number of LG smart TVs was recently disclosed. This flaw could allow attackers to remotely seize control of susceptible devices. Researchers at Bitdefender discovered two critical vulnerabilities (CVE-2023-6317 and CVE-2023-6318) that, when combined, could grant unauthorized users complete control over a targeted LG smart TV.

91,000 Smart LG TV Devices Vulnerable to Remote Takeover

Even though the cybersecurity pros I work with haven't fallen for the latest LinkedIn scam, seeing it hit my inbox made me realize just how dangerous and believable these attacks are. The sophistication of this one surprised even me, and that's concerning. Luckily, no damage was done this time, but as LinkedIn usage grows, we need to be prepared. Here's how to protect yourself before these scams evolve even further...

These attacks start with a super convincing fake email that looks like it's from Microsoft. It might warn you about suspicious activity and make you panic. You click, get taken to a website that looks exactly like the Microsoft login page, and enter your credentials. But here's the trick – even with your password, they need that one-time security code sent to your phone or email. The fake email pressures you to hand over that code, and once you do, the attackers are in control of your entire account.

These scams aren't going away, they'll only get trickier. Taking a few precautions now is much better than dealing with a hacked account later.

Scrutinize the Sender: I never trust an email address at first glance. One wrong letter, an extra domain (.co instead of .com), is a red flag, no matter how official it looks.

Resist Clicking: If an email makes me nervous or claims there's an urgent problem, I never click links. I go to the company website directly and log in that way.

Codes are Sacred: Codes sent to my phone or email are my last line of defense. At work, we're told to never share these with anyone, and that's my rule for everything now.

If you're unsure about phishing in general, there are great resources online Security Awareness Training | KnowBe4 And if your company offers any security training, take advantage! Before you open an unknown email – Stop, think, and don't be uninformed.

Even though the cybersecurity pros I work with haven't fallen for the latest LinkedIn scam, seeing it hit my inbox made me realize just how dangerous and believable these attacks are. The sophistication of this one surprised even me, and that's concerning.

This LinkedIn Scam Got Me (Almost)...and It Should Scare You Too

A hacking competition called Pwn2Own 2024 in Vancouver awarded over $1.1 million to participants who discovered vulnerabilities in various software and devices. This security competition incentivizes hackers to discover and report vulnerabilities in widely used software and devices. By finding these vulnerabilities, companies can patch them before malicious actors exploit them for criminal purposes.

The biggest winners were those who found exploits compromising Tesla cars. On the first day, hackers earned a combined $732,500 for finding 19 zero-day vulnerabilities. These vulnerabilities affected Tesla cars, along with popular operating systems and programs like Windows, Ubuntu, and Adobe Reader.

The top prize of $200,000 went to a team from Synacktiv for hacking a Tesla's electronic control unit (ECU), which could potentially allow them to manipulate the car. The second day's top earner was Manfred Paul, who won $100,000 for a critical Firefox exploit. Paul's exploit allowed for remote code execution and escaping the program's sandbox protections. Overall, Paul won more than $200,000 during the competition by also hacking other browsers as well.

A hacking competition called Pwn2Own 2024 in Vancouver awarded over $1.1 million to participants who discovered vulnerabilities in various software and devices. This security competition incentivizes hackers to discover and report vulnerabilities in widely used software and devices. 

Tesla, OS, Software Exploits Earn Hackers $1.1 Million at Pwn2Own 2024

Cybercriminals are looking for ways to integrate large language models (LLMs) into their attacks, and they have three main options: trying to bypass the safeguards on existing LLMs, building their own LLMs, or using uncensored open-source models.

One recent example is Dark Gemini, an underground service that appears to modify prompts sent to a legitimate LLM in order to bypass restrictions. While Dark Gemini's abilities weren't very impressive, it demonstrates how cybercriminals can leverage existing LLMs to enhance phishing attacks, for instance, by generating more convincing text.

Security researchers are concerned that nation-state actors are already using LLMs to improve their operations. Additionally, some researchers believe the safeguards on LLMs can be easily bypassed. However, it seems that using LLMs for more complex tasks, like creating malware, will still be difficult due to the current limitations.

In conclusion, cybercriminals are actively looking for ways to exploit LLMs, and while there are challenges, even basic use of LLMs can improve the effectiveness of existing attacks.

Cybercriminals Weigh Options for Using LLMs: Buy, Build, or Break?

In a proactive measure to enhance user security, Google has announced an update to its Chrome browser, effectively patching a series of vulnerabilities, including the zero-day flaw CVE-2024-3159, unveiled at the Pwn2Own hacking contest in March 2024. This critical issue, an out-of-bounds memory access in the V8 JavaScript engine, was exploited by Edouard Bochin and Tao Yan from Palo Alto Networks, earning them a $42,500 reward.

CVE-2024-3159 is the third zero-day discovered at Pwn2Own 2024 to be addressed by Google, following earlier fixes for vulnerabilities in WebCodecs and WebAssembly. In addition to CVE-2024-3159, the latest update also corrects two other vulnerabilities reported by external researchers, with Google disbursing $10,000 in total bounties.

The updated Chrome versions—123.0.6312.105/.106/.107 for Windows and macOS, and version 123.0.6312.105 for Linux—are currently being deployed. 

The diligent response from Google emphasizes the tech giant's commitment to user security and the pivotal role of ethical hacking competitions like Pwn2Own in identifying and mitigating potential threats. These contests not only help in uncovering hidden vulnerabilities but also foster a culture of proactive security measures among tech companies. Users are strongly advised to update their browsers to the latest version to ensure they have the most up-to-date defenses against this specific vulnerability and others that may pose a risk. Google's commitment to security, combined with the collaborative efforts of the cybersecurity community, continues to play a vital role in maintaining the integrity and safety of the digital landscape.

Source: SecurityWeek 04/03/2024

In a proactive measure to enhance user security, Google has announced an update to its Chrome browser, effectively patching a series of vulnerabilities, including the zero-day flaw CVE-2024-3159, unveiled at the Pwn2Own hacking contest in March 2024. 

Google Updates Chrome to Patch Zero-Day Flaw Exposed at Pwn2Own

It’s been three months since the Securities and Exchange Commission’s cyber disclosure rules took effect and rather than creating a deluge of incident revelations, only a trickle has emerged. Companies have submitted 12 initial Form 8-K, Item 1.05 filings, the form the SEC began requiring businesses to file for material cybersecurity incidents on Dec. 18. Each of these filings mention an “incident,” and all but two said the activity or access was “unauthorized.” While the language businesses use in Item 1.05 filings are ultimately crafted to notify regulators and investors of potential risks, these words also signal how a company detects, mitigates, contains and recovers from cyberattacks. Across the filings Cybersecurity Dive analyzed, none of the businesses described the incident as a breach or data breach in the filing with the SEC — and that was likely by design.

“Words like ‘breach’ and ‘data breach’ have very specific legal meanings and consequences, and they also have a particular meaning within what I’ll call the public consciousness,” said Travis Brennan, partner and chair of the privacy and data security practice at Stradling. “It’s just become a very loaded term, generally, and I think it’s one that companies in these disclosures will studiously avoid using in most cases,” Brennan said. “Once there has been a breach, as opposed to merely an incident, that suggests that the risk of harm has just gone up a few notches.” 

It’s been three months since the Securities and Exchange Commission’s cyber disclosure rules took effect and rather than creating a deluge of incident revelations, only a trickle has emerged. 

How companies describe cyber incidents in SEC filings

APIs were the target of 29% of web attacks in 2023, with cybercriminals exploiting the swiftly growing API economy for new avenues of attack, according to a report from Akamai. The commerce sector experienced the highest number of attacks, accounting for about 44%. Business services followed at nearly 32%. Attacks ranged from Local File Inclusion (LFI) and SQL Injection (SQLi) to Cross-Site Scripting (XSS).

Akamai’s findings underscore the escalating concerns in the industry surrounding API security threats. In 2021, Gartner predicted API abuse and data breaches would double by 2024. In 2023, the Open Web Application Security Project (OWASP) released a dedicated list of API-specific risks, highlighting the growing concern. “APIs are increasingly critical to organizations, but their security is often not designed into the capability, or the security team is not able to keep up with the rapid deployment of new technology,” Steve Winterfeld, advisory CISO of Akamai, said in the State of the Internet (SOTI) report.

APIs are pivotal in developing new capabilities within companies. However, their security often receives inadequate attention, either overlooked in early planning stages or failing to match the pace of rapid technological deployment. Akamai pointed out two distinct issues in this regard — posture and runtime problems.

API implementation flaws in an enterprise can lead to posture problems. Most common among them include shadow endpoints, unauthenticated resource access, sensitive data in a URL, a permissive cross-origin resource sharing (CORS) policy, and excessive client errors.

Runtime problems, on the other hand, are active threats demanding immediate action. These include unauthenticated resource access attempts, API activity with unusual JSON payloads, path parameter fuzzing attempts, illogical API timestamps, geolocation, or sequence, and data scraping. 

Adopting a comprehensive API security program provides organizations with unparalleled visibility across their digital ecosystem. This includes discovering all APIs within the organization, auditing their risk levels, detecting abnormal behaviors indicative of abuse, and enabling expert-led investigations to hunt for hidden threats.

APIs were the target of 29% of web attacks in 2023, with cybercriminals exploiting the swiftly growing API economy for new avenues of attack, according to a report from Akamai. 

A third of web attacks targeted APIs in 2023, threatening the expanding API economy

DDoS attacks against the financial services sector historically accounted for about 10-15% of all attacks, however that trend began to rise in 2021, the FS-ISAC and Akamai found. “Financial services companies are prime targets because successfully disrupting operations, for even just a moment, can lead to severe reputational risks and distrust in the global financial system,” Teresa Walsh, chief intelligence officer and managing director, EMEA, at FS-ISAC, said via email.

Akamai in September said it prevented a DDoS attack on a major U.S. financial institution. The attack peaked at 633.7 gigabits per second and 55 million packets per second. The increased activity was driven in large part by hacktivist groups using DDoS as a tool to disrupt institutions at a time of rising geopolitical tensions.

U.S. authorities in July warned that threat groups were potentially targeting multiple sectors using DDoS capabilities, including one group which claimed to have targeted the Treasury Department’s Electronic Federal Tax Payment System. By October, security researchers warned a novel zero day vulnerability, known as HTTP/2 Rapid Reset, was being used to launch some of the most powerful DDoS attacks ever recorded.  

DDoS attacks against the financial services sector historically accounted for about 10-15% of all attacks, however that trend began to rise in 2021, the FS-ISAC and Akamai found. 

Financial services sees sharp increase in DDoS attacks as geopolitical tensions rise

The NIST Cybersecurity Framework (CSF) 2.0, an evolution of its predecessor, is a comprehensive guide designed to assist organizations across various sectors in managing and mitigating cybersecurity risks effectively. This framework, while not prescribing specific actions, offers a taxonomy of high-level cybersecurity outcomes, enabling organizations, regardless of their size, sector, or maturity, to better understand, assess, prioritize, and communicate their cybersecurity efforts.

The CSF 2.0 emphasizes the importance of communication and integration in cybersecurity risk management. It advocates for a shared understanding and approach to managing cybersecurity risk, not just within an organization but also in its interactions with third parties. This shared understanding is crucial for making informed decisions about cybersecurity expenditures and actions, ultimately enhancing an organization’s cybersecurity posture.  The NIST Cybersecurity Framework 2.0 serves as a foundational resource for organizations seeking to navigate the complex landscape of cybersecurity risks. It encourages a proactive, nuanced approach to cybersecurity, emphasizing flexibility, adaptability, and continuous improvement. 

The NIST Cybersecurity Framework (CSF) 2.0, an evolution of its predecessor, is a comprehensive guide designed to assist organizations across various sectors in managing and mitigating cybersecurity risks effectively.

An Overview of the NIST Cybersecurity Framework 2.0

Google’s new Security Command Center Enterprise (SCC Enterprise) could streamline cloud risk management through AI automation, saving security teams time, experts say. Enhanced with Mandiant threat intelligence and generative AI, SCC Enterprise aims to offer comprehensive insights across the cloud security lifecycle. Google Cloud has identified gaps in the protection provided by current cloud-native application protection platforms (CNAPPs) and introduced SCC Enterprise as a solution to better guard against emerging threats.

“There are two things that Security Command Center Enterprise addresses compared with previous solutions: tighter integration between cloud and enterprise security and coverage across multi-cloud rather than just operating in silos,” Narayana Pappu, CEO at Zendata, a San Francisco-based provider of data security and privacy compliance solutions said in an interview. “Automation and integration of Gen AI brings efficiencies that will save teams time as well.”

According to Suni Potti, VP/GM of Google Cloud Security, the new platform integrates Mandiant Threat Intelligence with modern SecOps capabilities, enabling swift responses to cloud security incidents through “SIEM-powered visibility and SOAR-driven accountability.”

“Security teams can get a single view of their posture controls, active threats, cloud identities, data, and more, while integrating remediation and issue accountability into the end-to-end workflows of a converged cloud risk management platform,” Potti wrote in a blog post.

Google’s new Security Command Center Enterprise (SCC Enterprise) could streamline cloud risk management through AI automation, saving security teams time, experts say. Enhanced with Mandiant threat intelligence and generative AI, SCC Enterprise aims to offer comprehensive insights across the cloud security lifecycle.

Blog Category: Consulting

Categories