STE WILLIAMS

This October an all-new Black Hat Trainings event comes to Virginia, and it’s is a great opportunity to develop your skills in some of the most technical, hands-on security courses available anywhere.

At this special Trainings-only event there’s a great course on Reverse Engineering Firmware with Ghidra, for example, which promises to teach you the concepts, tools, and techniques required to reverse engineer firmware and assess embedded devices.

To ensure the tools taught are available to all in this two-day Training, you’ll be taught to use Ghidra, a powerful open-source reverse engineering tool developed by the National Security Agency. This free, capable tool eliminates the high cost of entry from expensive commercial tools currently used for these tasks, Plus you’ll practice using it against both an embedded Linux device and a bare-metal ARM device.

Information Operations – Influence, Exploit, and Counter is another valuable course designed to give you a practical primer on information operations: activities that involve the use of information to influence people, companies, and nations.

This course is developed and taught by career Army officers with a combined 50+ years of experience. While all material discussed will be unclassified, the Training is sure to teach you some novel approaches through  hands-on exercises that will apply and reinforce the skills learn. Not to be missed is a best IO campaign contest conducted live during the class.

In Dark Side Ops – Malware Dev you’ll spend two days diving deep into source code to gain a strong understanding of malware execution vectors, payload generation, automation, staging, command and control, and exfiltration. It’s  a great way to get lots of practical, hands-on experience with malware in a hurry along with the opportunity to observe black hat techniques currently used by hackers to bypass NIDS and HIPS systems, layer 7 Web proxies, “next-gen” antivirus, and DLP solutions.

These cutting-edge Black Hat Trainings and many more (listed below) will be taking place October 17th and 18th at the Hilton Alexandria Mark Center in Alexandria, Virginia.

●      Active Directory Attacks for Red and Blue Teams – Advanced Edition

●      Advanced Infrastructure Hacking – 2019 Edition

●      Astute Hunting in the Cloud – Bring the Thunder!

●      Data Breaches – Detection, Investigation, and Response

●      Military Strategy and Tactics for Cyber Security

●      Python Hacker Bootcamp – Zero to Hero

●      Web Hacking – Black Belt Edition 2019

From infrastructure hacking to incident response, there’s a course for hackers and security pros of all experience levels, so register today!

Article source: https://www.darkreading.com/black-hat/master-nsa-grade-security-tools-at-new-black-hat-trainings-virginia/d/d-id/1334799?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The Federal Election Commission (FEC) has approved a request by nonprofit Defending Digital Campaigns (DDC) to offer federal candidates and national political party committees free and discounted cybersecurity services as a way to beef up US election security.

In an opinion letter issued on May 21 to DDC, the FEC said it reached its conclusion “under the unusual and exigent circumstances presented by your request and in light of the demonstrated, currently enhanced threat of foreign cyberattacks against party and candidate committees, the Commission approves DDC’s proposed activity.”

DDC — a nonpartisan nonprofit founded by Matt Rhoades, former campaign manager for Mitt Romney, and Robby Mook, former Hillary Clinton Campaign manager — last year published the free “Cybersecurity Campaign Playbook” for campaigns to better secure their data and online accounts. The organization had officially requested FEC approval last fall to ensure its plans to offer free and discounted services to political committees and campaigns complied with federal campaign finance rules.

Meanwhile, several major cybersecurity vendors and service providers, such as Google, Microsoft, CloudFlare, Akamai, and McAfee, began offering free website and user-account protection services, among others, to election municipalities and candidates since the runup to the 2018 elections, and in the wake of the Russian hacking of the Democratic National Committee, Democratic Congressional Campaign Committee, and former Hillary Clinton campaign manager John Podesta’s email account during the 2016 presidential election.

State and local election jurisdictions and campaigns are notoriously cash- and resource-strapped when it comes to technology, and especially security, so the freebie offerings were embraced by security experts as well as the election jurisdictions that opted for the services.

The FEC opinion issued this week specifically addresses the DDC’s request, but it should also provide guidance for existing cybersecurity offerings for the elections that fit the criteria specified by the agency. One stipulation, for example, is that the services cannot “defray expenses that committees would have incurred regardless of cybersecurity efforts, such as expenses for computers; only the securing of such computers against digital intrusion is within the scope of this opinion,” the FEC wrote in its opinion.

But if another vendor doesn’t follow the same criteria, its services may not be considered FEC-approved. “Therefore, if another person’s proposed activity were to differ in any materially distinguishable manner from the activity described in the opinion, they may wish to consider requesting their own advisory opinion from the Commission in order to receive formal legal guidance,” an FEC spokesman told Dark Reading.

DDC as an Intermediary
The DDC specifically plans to offer free or reduced-cost cybersecurity-related software and hardware and services, as well as information-sharing systems; a cybersecurity hotline; cybersecurity bootcamps, training, and certification courses; on-site training; and incident response and monitoring services via partnerships with suppliers. DDC will act as an intermediary to negotiate software licenses and service contracts from security vendors and providers, and to ensure proper installation and use of tools.

All registered national political party committees and federal candidate committees are eligible — including the DNC — for cybersecurity help via DDC, as is a House candidate committee with a minimum of $50,000 in receipts for the current election cycle; a Senate candidate committee with a minimum of  $100,000 in receipts for the current election cycle; and a presidential candidate’s committee if he or she is polling above 5% in national polls.

Related Content:

• Free Cybersecurity Services Offer a First Step to Securing US Elections
• Clinton Campaign Tested Staffers With Fake Phishing Emails 
• Republican Committee Email Hacked During Midterms 
• What You Need to Know About Zero Trust Security

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/application-security/fec-gives-green-light-for-free-cybersecurity-help-in-federal-elections/d/d-id/1334797?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Wall Street has been abuzz this week over drastic measures by credit ratings agency Moody’s to downgrade its rating of Equifax, with expensive data breach fallout named as a major factor for the poor marks. While the action was not unexpected, the landmark nature of the downgrade should provide some needed emphasis to both boards of directors and CISOs of the modern business imperative for cyber resilience, security and risk experts say.

“Today’s news puts a punctuation mark on the business reality of cybersecurity risks,” says Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, who believes this is going to push more boards to take in increasingly active role in understanding and managing cybersecurity risks. “They definitely need to do more than ask the CISO some high-level questions. Equifax is in the hot seat now, but most of the Fortune 500 CEOs and CISOs would do no better in the same situation.”

CNBC broke the news last night of the note from Moody’s on the downgrade that cited the $690 million in breach expenses — including costs for settling mounting class action lawsuits — and increased need for infrastructure investments to be made by the company through 2020 to address systemic cybersecurity weaknesses found in post-breach scrutiny.

Joe Mielenhausen, a Moody’s spokesperson, told CNBC that “this is the first time the fallout from a breach has moved the needle enough to contribute to the change” in ratings outlook.

Equifax’s record-breaking data breach, first disclosed in September 2017, was eventually found to have exposed the information of 147.9 million people. Technically the exposure was triggered through the exploitation of an unpatched Apache Struts vulnerability, but security industry experts and government officials say that more serious organizational problems and lack of executive oversight were the true culprit of what Congress called an “entirely preventable” breach. 

The fallout from the breach included the ouster of Equifax’s CISO and eventually its CEO, and the company is still feeling the effects of class action suits from consumers and shareholder derivative lawsuits. 

“This is Moody’s delivering on their intent last November to take cyber risk into account when grading companies,” says Steve Durbin, managing director of the Information Security Forum. “This will certainly send a clear message to boards in a language that they understand that cyber risk is integral to business risk and that the implications of a breach or loss of data can have very real impact.” 

Durbin says he’s been advocating for some time to both the insurance industry and credit rating agencies to take cyber risk into account as they set policy pricing and assess company value. He believes this action by Moody’s will set the tone for assessment of business health in the future.

“Moving forward, this should become the norm since cyber risk is so integral to business risk that an assessment of business health without taking cyber risk and a company’s resilience into account will become meaningless,” he says.

Indeed, CNBC reported that Moody’s hinted as such in its Equifax note, stating that it will increasingly scrutinize cybersecurity “for all data oriented companies” in the future.

Security insiders say that this Moody’s action should not only be a wake-up call to CEOs and boards, but it’s also a crucial inflection point for CISOs.

According to Laurence Pitt, security strategy director at Juniper Networks, it’s another “chance in conversation” for security leaders — one that they shouldn’t blow by lacking the right data or insights about organization-wide cyberrisk. 

“This incident changes how business will look at cybersecurity, so cybersecurity needs to change how it talks to business,” he says.

Related Content: 

• The Equifax Breach One Year Later: 6 Action Items for Security Pros
• How Storytelling Can Help Keep Your Company Safe
• Equifax Breach Underscores Need for Accountability, Simpler Architectures
• Former Equifax Manager Sentenced for Insider Trading

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/moodys-downgrade-of-equifax-a-wake-up-call-to-boards/d/d-id/1334800?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

INTEROP 2019 – LAS VEGAS–  At a time when organizations are launching digital transformation projects, bringing more devices onto their networks, and embracing cloud technology, it’s imperative leaders work together to create a plan for protecting vast stores of information.

It’s no secret that cybersecurity and business teams often have a rocky relationship. As Optiv practice director Mark Adams explained here at Interop, security is viewed as a drag on the business. “It doesn’t demonstrate a value proposition,” he said.

But business teams are not going to slow the pace of innovation, so security must help stay competitive by protecting the tech they want to use. “Unfortunately, there isn’t a real handbook around this,” Adams noted, but it’s important for security teams to understand what’s important for the business.

The problem is, most don’t. The majority of cybersecurity teams can list priorities for their agendas, but they can’t name even one of the top three business priorities. Responsibility for all this ultimately falls to the CISO, as board members expect the security lead to be “a very savvy business person,” he explained.

Digital transformation, however the business goes about it, carries tremendous implications for security staff. While great for the organization, these projects usually result in even more data being created, said Maxine Holt, research director for security at Ovum, in a discussion about digital transformation and privacy. Security functions must recognize and address the challenges.

Part of the problem in managing the influx of information is most companies either don’t know where their data resides, what they want to protect, where backups are located, or answers to many other questions related to the management of the data they store. Security teams can stem the flow of information in a data leak, but that won’t fix the core issue.

“The way companies need to think about data has to change tremendously,” noted Etan Lightstone, vice president of product design at ShiftLeft. Here are a roundup of the ideas, trends, and challenges around data management voiced by experts who spoke at Interop this week.

Know What Your Valuables Are
CISOs and security leads can’t put a program around data governance if they don’t know what to protect, Optiv’s Adams said. It’s the first part of a data management strategy: Identify the most precious information the business needs to operate, know where it is, and prioritize its security. Sensitive data should be kept to a minimum and be given the strongest protection.

This isn’t a one-time job, said Stacey Halota, vice president of information security and privacy at Graham Holdings Co., in a keynote. As a business changes, so, too, does its most valuable data. Her team conducts an inventory each year and requires each organization under Graham Holdings to report the data elements they have, where they go, where their backups are located, and other information so the full business knows what it’s collecting over time.

When data is no longer required to help a department or company operate, it should be deleted. The process for deciding what should stay and go is a complicated one, Halota explained. She said she has built relationships with division heads across the business so she can learn what they need and negotiate when it’s time to eliminate data that’s no longer of value.

Watch Data Wherever It Goes
Businesses need to worry about data wherever it resides, said Shawn Anderson, executive security adviser in Microsoft’s Cybersecurity Solutions Group. Many businesses focus on endpoint security but should be thinking more broadly about where data is located – not only on employee computers, but in the cloud, on mobile devices, and on a growing pool of IoT devices.

“You need to think differently about working in the cloud than you do on-prem,” said Anderson in a session focused on endpoint security. The cloud is rapidly driving the amount of data companies collect, process, store, and use. Security teams can better protect data by focusing on identity: enabling multifactor authentication, blocking legacy authentication, increasing visibility into why identities are blocked, and monitoring and acting on alerts.

Businesses should protect their applications and verify those that employees can access. “All of the different governance practices pretty much boil down to knowing who your users are and whether they have the appropriate access,” said Michael Melore, an IBM cybersecurity adviser. “People have privileges that they no longer require. That’s an unnecessary risk.” There should be processes in place to acknowledge whether privileges are no longer needed.

No matter how much software is on the endpoint, attackers will win if you lack a data protection strategy, Anderson said. Sensitive data should be secured from the time it enters the organization: It should be detected when it arrives, classified and labeled according to policy, and protected as it travels across the business before it’s eventually retired and deleted.

A Closer Eye on Compliance
Compliance is not strictly a security issue, Ovum’s Holt explained, but it is a lever on security and attracts board-level interest. She pointed to scenarios in which organizations were fined for noncompliant security and privacy practices. For example, one Portuguese healthcare provider was fined €400,000 (US$447,328) because staff illicitly accessed patient records. A German social media company was fined €20,000 (US$22,366) for storing passwords in plaintext. Google was fined €50 million (US$55,917,500) for failing to meet transparency and information requirements, and not obtaining a legal basis for processing.

Government regulations, industry standards, and compliance requirements such as GDPR and NIST can cause an organization’s information risk and security capabilities to change “often and quickly,” said John Pironti, president of IP Architects. He recommended companies document the types, amounts, and priority of information they find acceptable and unacceptable. This “information-risk appetite” should be developed alongside business leaders and stakeholders.

Still, different regulations have different definitions of what constitutes sensitive data. As Graham Holdings’ Halota pointed out in her talk, the California Consumer Protection Act (CCPA) puts a broader range of data under “personally identifiable information” than the GDPR. Graham Holdings had to repurpose its data governance solution to redefine risk assessment and expand its document repository so it was properly collecting and categorizing data.

Related Content:

• Proving the Value of Security Awareness with Metrics that ‘Deserve More’
• The 3 Cybersecurity Rules of Trust
• What You Need to Know About Zero Trust Security
• Satan Ransomware Adds More Evil Tricks

Article source: https://www.darkreading.com/cloud/to-manage-security-risk-manage-data-first/d/d-id/1334802?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A vulnerability researcher published four previously unreported flaws in Microsoft Windows over three days this week, flaws that could allow a local user to escalate their rights on a compromised system to that of an administrator.

Exploits for the four flaws — plus a fifth vulnerability that Microsoft fixed last week — were posted by the researcher to a GitHub repository using the name SandboxEscaper. The researcher, who has published working zero-day attacks for legitimate vulnerabilities in the past, posted the first exploit on Tuesday, May 21, with two more exploits published on each of the next two days.

The danger from the issues is likely to be low, but the code could be incorporated into popular malware frameworks, says Craig Young, a computer security researcher with Tripwire’s Vulnerability and Exposure Research Team (VERT).

“Overall, these vulnerabilities do not markedly change the typical security advice to use a layered approach to security, including endpoint monitoring,” he says. “Unlike the Task Scheduler exploit disclosed earlier in the week, these bugs do not require the attacker to know a username and password — meaning that some of them could more realistically be incorporated into malware.”

Publishing, or “dropping,” unknown vulnerabilities and exploit code used to be a popular way for vulnerability researchers to punish software vendors for a lack of focus on software security or for a lack of response to researchers’ vulnerability reports. However, as companies have increasingly taken security more seriously, and the impact of exploited vulnerabilities has grown more dire, researchers are far more likely to cooperate with software makers to fix issues, in a process known as coordinated disclosure.

Microsoft and the researcher may have collaborated on one of the issues, which resulted in the software giant fixing it earlier this month during its regular Patch Tuesday release. In a bulletin, Microsoft stated it had fixed the issue, identified as CVE-2019-0863, and credited both Palo Alto Networks and PolarBear, one name associated with SandboxEscaper. The GitHub repository that hosted the exploits published by the researcher was called PolarBearRepo.

Following the posting of the four other exploits, however, Microsoft was more circumspect.

“Microsoft has a customer commitment to investigate reported security issues and we will provide updates for impacted devices as soon as possible,” the company said in a statement. “We urge finders to practice coordinated vulnerability disclosure to reduce the potential risk to customers.”

SandboxEscaper published five exploits on GitHub. On Tuesday, the researcher published a code snippet called BearLPE, which exploits the Task Schedule to escalate local privileges. Local privilege escalations are techniques in which the attacker gains more capabilities on the targeted system by circumventing the operating system protections around user roles.

On Wednesday, the researcher published two more exploits, including one called AngryPolarBearBug2, which targeted the issue Microsoft patched the week before. The researchers followed on Thursday with another two exploits.

While the issues are mostly straightforward to exploit, two vulnerabilities are a type of vulnerability known as a race condition, and they require specific action to be conducted within a very tight time frame, making them more difficult to use successfully, says Satnam Narang, a senior research engineer at security firm Tenable.

“Some of these zero days are really hard to exploit, and some are a matter of having certain policies in place to address them, of having certain products and security tools,” he says.

Because the exploits cannot be used remotely, they are not as dangerous as some attacks, says Tripwire’s Young.

“Similar to past SandboxEscaper releases, these exploits are also local privilege escalations, meaning that attackers would use these only after gaining a foothold on a targeted system,” he says.

SandboxEscaper has gained a reputation for releasing LPE exploits with no warning. The researcher has posted repeatedly of her dislike for the software and security industries.

“F— this s—– industry. I don’t plan to make a career in it anyway,” she wrote in a post on Wednesday. “I hate all the people involved in this industry. Everyone just thinks they know better. Everyone just loves pointing fingers.”

Related Content:

• Q1 2019 Smashes Record For Most Reported Vulnerabilities in a Quarter
• Windows Zero-Day Flaw Disclosed Via Twitter
• Twitter User Discloses Second Microsoft Zero-Day
• PowerPool Malware Uses Windows Zero-Day Posted on Twitter
• 3 Disturbing New Trends in Vulnerability Disclosure

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/researcher-publishes-four-zero-day-exploits-in-three-days/d/d-id/1334806?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple