Cybersecurity & Defense
Security concepts and current events, from foundational definitions like CSIRT vs. CERT to breakdowns of real breaches like Colonial Pipeline.
-
What is a password manager and why do you need one…
I was speaking to a contact who is studying the cybersecurity industry and does not use a password manager. Interestingly enough, it’s actually a debate I’ve seen crop up a few times in cybersecurity circles. A password manager is an application to help your store and manage all the various usernames, passwords, URLs, what have you…that all come as a byproduct of the digital terrain that we are increasing surround by. I used to think “But MY password is unique! It’s not “password” or any of the typically mocked but often used, much maligned, stereotypical passwords. Oh, no. Mine was different and unique. And there are people who do this…
-
FAA Plans Warnings on 5G…What 5G Means for the FAA, FCC and Air-safety…
FAA Plans Warnings to Pilots, Airlines Over New 5G Rollout… Air-safety regulators tussle with telecom regulators over safety concerns ahead of expansion of new wireless technology planned in December. “At the heart of the dispute is the U.S. rollout of 5G. Short for fifth-generation wireless, 5G technology offers internet speeds 100 times faster than today’s 4G service, potentially paving the way for new applications, revenue and jobs.” “To offer 5G, telecom companies need more space on the airwaves. Wireless spectrum is like land, in that the number of available frequencies is finite. The FAA-FCC clash is just the latest in a series of dis- putes between U.S. govern- ment agencies…
-
What Is a CSIRT vs. CERT vs. CIRT???
CSIRT—Computer Security Incident Response Team is a concrete organizational entity (i.e., one or more staff) that is assigned the responsibility for coordinating and supporting the response to a computer security event or incident. CERT—Computer Emergency Response (Readiness) Team CERT should not be generically used as an acronym because it’s a registered trademark in the United States Patent and Trademark Office, as well as other jurisdictions around the world. Alternative names fur such groups include computer emergency readiness team and computer security incident response team (CSIRT). The name “Computer Emergency Response Team” was fist used in 1988 at Carnegie Mellon University (CMU). CERT is registered as a trademark by Carnegie Mellon…
-
How Was Colonial Pipeline Hacked/Breached? Because of One Single Employee’s Compromised Password
That’s all it takes, and usually what it comes down to. Passwords. As the founding contemporary lyrical wordsmith members of Wu-Tang would say, “Protect ya neck!“. Because without it, you’ll lose your head. Same with passwords! Protect ya passwords!!! All a malicious actor would need is a password to an account, and just like that (*finger snap!*), you’ve invited them in, like welcoming Count Dracula through your front door for Sunday dinner. So, Colonial, right…here’s the latest. After an analysis of the cyberattack on Colonial Pipeline, investigators suspect that hackers obtained the password from the dark web (think a marketplace for illicit activity) where such info is available for the…
-
What is a “False Positive”?
A true positive is an outcome where the model correctly predicts the positive case. Ex: Downloaded file is malware, and the A.V. detected it as malware. A true negative is an outcome where the model correctly predicts the negative case. Ex: Downloaded file is NOT malware, and the A.V. did NOT detect it as malware. A false positive is an outcome where the model incorrectly predicts the positive case. Ex: Downloaded file is NOT malware, but the A.V. detected it as malware. A false negative is an outcome where the model incorrectly predicts the negative case. Ex: Downloaded file is a malware, AV did NOT detect it as malware. True…
-
What is Attack Surface?
Attack surface. First thing I start thinking is the surface area, or the exposed area that is susceptible to a cyber onslaught by threat actors, or bad people with malicious intent. According to Wikipedia: “The attack surface of a software environment is the sum of the different points (for “attack vectors”) where an unauthorized user (the “attacker”) can try to enter data to or extract data from an environment. Keeping the attack surface as small as possible is a basic security measure.” via Wikipedia “KEEPING THE ATTACK SURFACE AS SMALL AS POSSIBLE IS A BASIC SECURITY MEASURE.” **clap, clap** Does that last line stick out to anyone else?? It should.…
-
What is Remote Code Execution?
What is Remote code execution (RCE)? A simple web search brings up a Wikipedia page on Arbitrary code execution (ACE). According to Wikipedia: In computer security, arbitrary code execution (ACE) is an attacker’s ability to execute arbitrary commands or code on a target machine or in a target process. An arbitrary code execution vulnerability is a security flaw in software or hardware allowing arbitrary code execution. A program that is designed to exploit such a vulnerability is called an arbitrary code execution exploit. The ability to trigger arbitrary code execution over a network (especially via a wide-area network such as the Internet) is often referred to as remote code execution…
-
Security + Course Notes
Threats, Attacks & Vulnerabilities Malware Malicious software; Broad term; there are many kinds of malware. Viruses Cyrpto-malware Ransomware Worms Trojan Horse Rootkits Keyloggers Adware/Spyware Botnets How do you get malware? These all work together. A worm takes advantage of a vulnerability. Or, installs malware that includes a remote-access backdoor. Bot may be installed later. Your computer must run a program. Email link–Don’t Click Links! Web page pop-ups Drive-by download Worm Your computer is vulnerable Operating System–keep updated! OS & applications. Viruses & Worms Viruses–malware that can reproduce itself; it doesn’t need you to click anything; it needs you to execute a program; Just simply running a program can spread a…
-
Cryptography & Cyber Security Course Notes
Crytopgraphy For Security course on You Tube. The triad of cybersecurity is: Confidentiality Integrity Availability Confidentiality refers to “the property that sensitive info is not disclosed to unauthorized individuals, entities, or processes”. —N.I.S.T. Intregrity is defined as the “guarding against improper info modification or destruction, and includes ensuring information non-repudiation & authenticity”. -NIST Availability is “ensuring timely and reliable access to and use of information”. -NIST Impact of Security Breaches: Effectiveness of primary operations are reduced. Financial loss Damage to assets Harm to individuals Threat: potential violation of security Attack: assault on system security derived from intelligent threat. Aspects of Security Security Attack—any action that attempts to compromise the security…
-
Security issue in Apple Airdrop allow attackers to steal personal information
Simple tip for NON-TECH users…This security issue can also be mitigated by sticking to the principle of least privilege, even when it comes to seemingly innocent apps, that are just trying to make our lives easier. If you’re not actively using Apple’s AirDrop feature, then DO NOT have it running in the background, unnecessarily. “So far, Apple has neither acknowledged the problem nor indicated that they are working on a solution,” the researchers concluded. “This means that the users of more than 1.5 billion Apple devices are still vulnerable to the outlined privacy attacks. Users can only protect themselves by disabling AirDrop discovery in the system settings and by refraining…
