Cyber Security News & Current Events

The Dangers of Outsourced Development (and the 'AntiHack' Function)

Posted by Eddie on 5/06/19 7:15 AM

 

Seen above is real source code we got access to in a recent web application penetration test by exploiting security vulnerabilities caused by poor secure coding practice. While inspecting source code we found an interesting function called ‘antiHack’ which appears to do nothing but return the inputted data verbatim.

Read More

Topics: Governance, Pentesting

There is no Magic Bullet for your Cyber Security Risks

Posted by Eddie on 31/05/19 11:30 AM

It seems that every other week, someone is touting a new solution to cyber security. They tell you that all we need to do is install our boldly coloured box which leverages algorithms and machine learning. The best part is that YOU don’t have to do any hard work at all! Once it’s installed, you will be secure!

Read More

Topics: Fundamentals, Risk Assessment, risk profile

Why Cyber Insurance Cannot Replace a Mature Security Posture

Posted by Nat on 11/04/19 4:30 PM

Although cybersecurity insurance can appear attractive, it is important that businesses understand it cannot feasibly serve as a replacement for threat mitigation. The majority of cyber threats are avoided by reaching a baseline standard of security maturity. The investment required to achieve this baseline is generally less than a few years of premiums and the deductible for just one incident.

Read More

Topics: Governance, Fundamentals, Risk Assessment, risk profile

Intro to Injection Vulnerabilities and the OWASP Top 10

Posted by Kristian on 9/04/19 7:15 AM
Overview

Injection vulnerabilities are the most common result of mixing user input with system control. An injection vulnerability can have catastrophic results for a system, potentially leading to a full database dump, and laying the groundwork for a remote shell. In layman's terms, this means an attacker controls the entire system and has access to all data.

Read More

Topics: Fundamentals, Pentesting, Authentication, Compromise

How inappropriate use of Office 365 is increasing NDB exposure

Posted by Tim on 4/04/19 4:30 PM
 
Read More

Topics: Phishing, Compromise

The PSPF and ISM Undergo Major Revisions

Posted by Nigel on 2/04/19 7:30 AM

The information security framework for the Australian Government is driven by two main documents: the Protective Security Policy Framework (PSPF) owned by the Attorney-General’s Department, and the Information Security Manual (ISM) owned by the Australian Signals Directorate (ASD). Note that the PSPF is actually a set of documents, rather than a single volume like the ISM.

Read More

Topics: Compliance, IRAP / ISM

Formula 1, Cyber Vendors and Selling Fences

Posted by Sash on 15/03/19 5:32 PM

This weekend's Formula 1 Grand Prix has an unlikely parallel to the cyber security industry. You see, Formula 1 is a precisely engineered environment, where suspension load is modelled across the 300 or so corners of the calendar and components designed to only experience 40% of their rated strength.

Read More

Security Fundamentals - Part 3: Controlling Admin Privileges

Posted by Tim on 14/12/18 12:22 PM

In Part 2, the importance of a well-maintained and well-structured hardware and software inventory and the benefits of vulnerability management was explained. The next step in the process of getting on top of security basics is gaining control of the environment. This step should be easier and more efficient if the earlier steps of creating a comprehensive inventory were completed.

Read More

Topics: Insider, Fundamentals, Authentication

A Security Conscious Cohort - Part 1: Defining a New Norm

Posted by Nat on 13/12/18 12:41 PM

As high-profile breaches produce increasing public attention, effective information security is more important than ever. Cyber incidents have a potential impact comparable to natural disasters. It is increasingly insufficient for organisations to achieve the bare minimum required for regulatory compliance – real protection is necessary.

Read More

Topics: Fundamentals

Management Buy-In - Part 1: Why You Need It

Posted by Nigel on 10/12/18 11:02 AM

Every information security framework and “best practice” guide to cyber security states that you need “management buy-in”, but why is it important and what does it look like?

Read More

Topics: Governance, Fundamentals

Christmas Turkeys and Cyber Security Aren't That Dissimilar

Posted by Nigel on 3/12/18 12:56 PM
What Brush Turkeys Have Taught Me About Information Security

It is that time of year again when a male brush turkey has made my backyard his home, tearing apart vegetation to make his nesting mound. While this is a source of frustration, on the positive side, it has given me new ways to think about information security.

Read More

Topics: Insider, Governance, Red Teaming, Risk Assessment

Hiding in plain sight: Preventing data exfiltration via DNS tunnelling

Posted by Eddie on 29/11/18 3:02 PM

As information security has become more important across organisations, so has the role of an information security leader within organisations. As an information security leader in an organisation, several questions recur and are faced daily:

Read More

Topics: Insider, Pentesting, Red Teaming, Phishing

Security Fundamentals - Part 2: Managing Hardware and Software Assets

Posted by Tim on 26/11/18 3:54 PM

 

In part 1, the importance of knowing your system was discussed, in this article, the importance of properly managing and auditing these assets will be discussed. Proper management of ICT assets from an information security perspective involves knowing what properties of the assets are expected, being able to respond to new vulnerabilities quickly and knowing when unauthorised assets are present on your network.

Read More

Topics: Fundamentals

Are you aware of your risk profile?

Posted by Security Centric on 22/11/18 8:11 PM

There is no one size fits all when it comes to cyber security – you cannot uncover your potential risks purely through comparison to another business. That’s where risk profiles come in.

Read More

Topics: Risk Assessment

Bits of Entropy - The Importance of Complex Passwords

Posted by Kristian on 22/11/18 11:42 AM

Passwords are obviously required to keep your online accounts and data safe, but how strong is your password? The idea of a strong password can be hard to quantify and most places require your passwords to meet some requirements. It's common to see "Your password must contain characters from three of the following categories" to be able to set your password. These requirements are in place to raise the entropy of a password and make it much harder for an attacker to guess your password.

 

Read More

Topics: Fundamentals, Authentication

Are you giving cyber security the attention it deserves?

Posted by Security Centric on 17/10/18 7:30 AM

Cyber security is a comprehensive multi-faceted approach to identifying, understanding, and then mitigating risks to information systems.

Read More

Topics: Risk Assessment

In Europe for GDPR – Impressions Comparing it to Lessons from Australia’s Privacy Act NDB

Posted by Sash on 25/05/18 2:58 PM

I have been in Europe for a couple of weeks now working on some longer-term strategic initiatives for Security Centric. My work brought me into a larger number of organisations than I normally would in my usual consulting life, and a consistent hot topic was GDPR. This is hardly surprising considering the gradual tidal wave of privacy policy update emails we have all be subjected to, as organisations align their compliance programs ahead of the deadline which comes into effect in a few hours across the EU.

Read More

Documentation Provides Security Value

Posted by Nigel on 15/02/18 5:45 PM

A big part of my job is conducting security audits or assessments of clients. In one assessment, I asked a client for some documentation, in this case a system design document, as is usual practice. I was told “We don’t do documentation just for audits”. Further discussion revealed that the client’s culture was one where documentation was considered unnecessary for many activities, including activities directly related to security. Needless to say, I found many issues with their information security posture.

Read More

Topics: Governance

Why multi-factor authentication is worthwhile

Posted by Nat on 19/09/17 11:15 AM

Multi-factor, or two-factor, authentication (MFA, 2FA) has seen increasing adoption and public awareness. What is it? What benefits does it provide? Is it really worth all that hassle? And how can I justify the time spent implementing and maintaining a MFA solution?

Read More

Topics: Authentication, Phishing

WannaCry: Nothing New Here Apart from a Catchy Name

Posted by Sash on 17/05/17 1:17 PM

Even the catchy name is not particularly innovative (Heartbleed has to take that prize over others such as BEAST and POODLE).

Read More

Finally, an actionable blog

The purpose of this blog is to make available the real-world lessons, experience, observations and mistakes that are part of the daily life of a group of cyber security professionals.

Read about:

  • What mistakes organisations are making (anonymously of course!)
  • What effective actions are available to quickly and economically achieve effective protection (without buying new kit)
  • Trends we're seeing, via our incident response and forensic investigation capabilities
  • And sometimes, just frustrations about what is wrong with cyber :|

Subscribe:

Recent Posts