A blog dedicated to sharing security best practice advice for organisations and individuals.
==================== TL; DR With the recent publication of post quantum cryptography (PQC) algorithms from NIST, organisations of all size should begin the transition to PQC. Please refer to this PQC readiness publication from CISA as a starting point. ==================== To assist with the transition to PQC, I have provided advice below for government agencies and […]
==================== TL; DR While Microsoft in recent months and in 2023 has resolved security bypasses associated with Microsoft Windows Smart App Control, a more recent bypass “may be fixed” in a future Windows Update (more details below). Reputation based security controls should not be relied upon in isolation. Update: September 2024: As of 10th September […]
==================== TL; DR If you use both 2.4 Ghz and 5 Ghz within your organisation or your home, consider having different credentials to access them. ==================== Academic researchers from Belgium’s KU Leuven University have discovered a design flaw within the Wi-Fi standard which allows the spoofing of the SSID (Service Set Identifier) name (the name […]
TL; DR In recent months threat actors have been leveraging alternative means of compromising Windows based systems in order to evade detection. Make certain to download and install software from legitimate sources and where possible make use of the Windows driver blocklist (further recommendations listed below). ==================== By employing techniques such as DLL sideloading (defined […]
TL; DR Following the recent supply chain attack upon 3CX that was detected in late March, follow the links below to determine the appropriate response actions, how to tell if your environment was affected and mitigation/prevention advice. ======================== Getting Started If you use 3CX software within your organisation, if you have not already done so, […]
TL; DR With threat actors deploying ransomware in new ways, security awareness training, protecting and testing your backups is more crucial than ever. Blocking the running of scripts on systems and the use of an XDR and/or SIEM should also be considered. ======================== Introduction First of all, to all of my readers, I hope you […]
TL; DR With multi-factor authentication becoming more common, threat actors are varying their previous techniques to successfully bypass it. Follow standard phishing prevention steps (be suspicious of messages you weren’t expecting, look slightly different and those that suggest immediate or prompt action). Microsoft also suggests additional monitoring policies and safeguards.…
Update: This security issue was resolved by the Microsoft security update published in August 2022. Thank you. ======================== TL; DR In early June with the vulnerability named “Follina” affecting Windows now designated CVE-2022-30190 being exploited (but since patched), this related vulnerability (dubbed “DogWalk”) first documented in early 2020 has re-gained attention. At the time of…
TL; DR If you use a QNAP NAS server on your network (corporate or home), please update its firmware to the most recent available version and check that its isn’t accepting connections from the public internet. Threat actors are actively scanning the internet for vulnerable QNAP NAS devices and locking their contents using ransomware. What […]
TL; DR Trend Micro security researchers have discovered a known and highly capable advanced persistent threat (APT) group targeting Asus routers to recruit those routers into a botnet. Since the group has previously targeted other vendors too, please make certain your router is security hardened (see below) and has the latest available firmware. What is […]