Amazon Web Services: Overview of Security Processes

|

article image
Amazon Web Services (AWS) delivers a scalable cloud computing platform with high availability and dependability, providing the tools that enable customers to run a wide range of applications. Helping to protect the confidentiality, integrity, and availability of our customers’ systems and data is of the utmost importance to AWS, as is maintaining customer trust and confidence. This document is intended to answer questions such as, “How does AWS help me protect my data?” Specifically, AWS physical and operational security processes are described for the network and server infrastructure under AWS’s management, as well as service-specific security implementations. .

Spotlight

InteProIQ

InteProIQ was founded in 2003 with the belief that no matter what technological solutions you may have in place, human error can completely sidestep them. Only with training and full security awareness can employees be better at recognizing new and ever evolving threats. InteProIQ offers Cyber Security Awareness Training that is relevant to employees in all positions and departments. With nine topics covering the foundation and fundamentals of all-things security, our training is designed to help employees recognize a social engineering attack, establish good security practices and identify other external or internal threats that put the security of entire supply chains at risk.

OTHER ARTICLES

Protecting against Cybersecurity Threats when Working from Home

Article | March 11, 2020

With the spread of the novel coronavirus (COVID-19), many organizations are requiring or permitting employees to work remotely. This post is intended to remind employers and employees that in the haste to implement widespread work-from-home strategies, data security concerns cannot be forgotten.Employers and employees alike should remain vigilant of increased cybersecurity threats, some of which specifically target remote access strategies. Unfortunately, as noted in a prior blog post, cybercriminals will not be curtailing their efforts to access valuable data during the outbreak, and in fact, will likely take advantage of some of the confusion and communication issues that might arise under the circumstances to perpetrate their schemes. Employees working from home may be accessing or transmitting company trade secrets as well as personal information of individuals. Inappropriate exposure of either type of data can lead to significant adverse consequences for a company.

Read More

Is the CEH v11 Course Worthwhile to Pursue After Windows 11 Update?

Article | March 11, 2020

If you are finding it confusing to decide whether to pursue the CEH v11 course now after the Windows 11 update, then you have certainly landed on the right page. We are here to make things clear to you so that you can make your decision without any hassle. When it comes to Certified Ethical Hacking, it is considered to be one of the most popular testing certifications at present in the industry. It is highly popular because it assists many with complete know-how of the skills that are required for the purpose of white hat hacking. The certified professionals are able to anticipate any kind of cybercrime from before and respond to it proficiently to avert any kind of business damage. In the time of the pandemic, many business organizations have to move to digital platforms to reach their customers without lockdown troubles. This is the reason why investment in the domain of cybersecurity has also gained a wave. Businesses have realized what the value of having their infrastructure cyber resilient is. This shows why the opportunities for skilled experts in the cybersecurity domain are never going to end in the coming future, and pursuing the course of CEH v11 is a great move to follow. To make things more convincing, we are here to help you with the importance the course of Certified Ethical Hacking brings into play and how you must choose the right career path in the respective field. Let’s get started. Ethical Hacking: What It Is To The World? When it comes to ethical hacking, it is acknowledged as the procedure of networks, applications, or smart devices to assess any kind of vulnerabilities if available. This type of assessment assists in reacting quickly and taking the right measures to enhance the cybersecurity of the entire infrastructure. A certified ethical hacker is basically an expert who understands the different vulnerabilities in the system and gets them fixed without any delay. This is done by following the ethical approach so that there is no such problem repeated again in the future. What do You get To Learn From CEH v11 in 2021? With the CEH v11 course, you get to learn 24 exceptional challenges in 4 different levels that include 18 attacking vectors. You get to know about various emerging attackers that include targeted ransomware, File-less malware, API threats, and more. In this course, you also get a complete understanding of different from enumerating techniques that include Telnet, NFS, SMB, IPV6, FTP, and BGP. This course also covers Malware reverse engineering, so you get a complete understanding of Dynamic and static malware assessment. Cloud computing is another prime concept that you get covered in this course, where you learn about Docker, Container Technology, Serverless computing, Kubernetes, Cloud Hacking procedures. CEH v11 also covers a proper understanding of Hacking web applications that includes web shell concepts, Web API. Webhooks, Web API security, and hacking. You also get to learn more about WPA3 Encryption and cracking. It also covers operation technology, side-channel attacks, HMI-based attacks, and more. Why is CEH An Ideal Career Option? Ethical hacking is possessing five phases of different procedures with every single process, including different actions that block any kind of vulnerabilities. With CEH v11 certification, you get a complete understanding of all these phases. These phases are basically divided in the form of network assessment, testing, and various other risk analysis procedures. As the world of technology is growing significantly, so is the risk of cyber-crime. This is the reason why businesses are looking for ethical hacking specialists who can assist them remain protected from all the potential risks. As the dependency on data science is growing across all industries, it is important that we protect the information and digital assets in the best possible way. There is no doubt that hacking is a heinous act, and almost all businesses are aware of the risks associated with it. To get protected from these risks, organizations around the world are in search of professional, ethical hackers who ensure that there is no vulnerability outside their doors. This is why the opportunities in the domain of ethical hacking have increased in the last few years, and there is no reason why you can’t say that pursuing CEH v11 is an ideal career option. Posts Up For Grabs After CEH v11 Course Anyone who is interested in developing their career in ethical hacking, including the following: Security Officer Security Analyst/Administrator Systems Security Engineer Security Manager /Specialist Auditor Security Professional Risk Analyst Vulnerability Analyst Network Administrator System Administrators Network Engineer Job Roles You Might Need To Take Responsibility As Certified Ethical Hackers Security Analyst Manual Ethical hacker Vulnerability Assessment Analyst Cyber Defense Analyst Cybersecurity auditor IT security administrator System security administrator Senior Security Consultant Security audit Network Security Engineer Cybersecurity Analyst Network Engineer SOC Security Analyst Information Security Analyst Warning Analyst InfoSec Security Administrator Benefits of Taking Up CEH v11 Certification To make it even convincing for you, below mentioned are a few of the benefits you avail with CEH v11 certification. Take a look: You are certainly able to open a lot of career opportunities with the respective course. It lets you advance in your career significantly. You get to understand what hackers might do to harm your business, and accordingly, you can take precautions. You get your knowledge related to risks and vulnerabilities improved with the assistance of the respective course. You benefit from a lucrative package in terms of salary as a Certified Ethical Hacker. Lastly, you also get to learn different types of real hacking tools as well. Wrap Up This shows why you must not hesitate and pursue the CEH v11 course even after the latest Windows 11 update. It gives you an edge over the other candidates and lets you have a successful career ahead. Good Luck!

Read More

New Ransomware hitting Industrial Control Systems like a nuclear bomb

Article | March 11, 2020

Researchers at security firms including Sentinel One and Drago’s have been mystified by a piece of code named Ekans or Snake, over the last month. Drago’s publically released its full report on Ekans Ransomware that has recently inflicted Industrial Control Systems and these are some of the most high-value systems that bridge the gap between digital and physical systems. In the history of hacking, only a few times a piece of malicious code has been marked attempting to intrude Industrial Control Systems. Ekans is supposed to be the first Ransomware with real primitive capability against the Industrial Control Systems, software, and hardware used in everything from oil refineries to power grids. Researchers say this ransomware holds the capability to attack ICS by Honeywell and GE as well.

Read More

NATO Adds Cyber Commitments, Potential Ransomware Response

Article | March 11, 2020

As President Biden prepared to meet with Russian President Putin this past week in a high-profile summit in Geneva, Switzerland, cyber-attacks originating from criminals within Russia were near the top of a list of contentious issues on the agenda. However, there were important events that received minimal media attention that strengthened the U.S. President’s position. President Biden walked into those meetings with something new and bold: the strong backing of NATO countries on a series of new cyber commitments. In a NATO Summit held in Brussels on June 14, 2021, the heads of state and government participating in the meeting of the North Atlantic Council reaffirmed their unity and commitments on a long list of mutual defense topics. And there was also a major new commitment discussed in the press release — cyber-attacks against critical infrastructure within any NATO member country were now on the table. That is, online (Internet-based) attacks could result in the same response as physical attacks (with guns and bombs.) Yes, this is a very significant global development which highlights another way that the physical world and online world are merging fast, with ramifications in both directions. HOW DID WE GET TO THIS MOMENT? The ransomware attacks that recently struck critical infrastructure companies such as Colonial Pipeline and JBS resulted in more than just long lines for gas and meat price hikes. It raised alarm bells in countries all over the globe regarding the susceptibility of the majority of countries to ransomware and other forms of malware. These ransomware incidents led to NATO’s new Comprehensive Cyber Defense Policy. The big news: Cyber-attacks against critical infrastructure might (on a case-by-case basis) now trigger the famous Article 5 clause. “The Parties agree that an armed attack against one or more of them in Europe or North America shall be considered an attack against them all and consequently they agree that, if such an armed attack occurs, each of them, in exercise of the right of individual or collective self-defense recognized by Article 51 of the Charter of the United Nations, will assist the Party or Parties so attacked by taking forthwith, individually and in concert with the other Parties, such action as it deems necessary, including the use of armed force, to restore and maintain the security of the North Atlantic area. …” Here are two sections I’d like to highlight from last week’s communiqué (take special notice of section in bold): “In addition to its military activities, Russia has also intensified its hybrid actions against NATO Allies and partners, including through proxies. This includes attempted interference in Allied elections and democratic processes; political and economic pressure and intimidation; widespread disinformation campaigns; malicious cyber activities; and turning a blind eye to cyber criminals operating from its territory, including those who target and disrupt critical infrastructure in NATO countries. It also includes illegal and destructive activities by Russian Intelligence Services on Allied territory, some of which have claimed lives of citizens and caused widespread material damage. We stand in full solidarity with the Czech Republic and other Allies that have been affected in this way. “Cyber threats to the security of the Alliance are complex, destructive, coercive and becoming ever more frequent. This has been recently illustrated by ransomware incidents and other malicious cyber activity targeting our critical infrastructure and democratic institutions, which might have systemic effects and cause significant harm. To face this evolving challenge, we have today endorsed NATO’s Comprehensive Cyber Defence Policy, which will support NATO’s three core tasks and overall deterrence and defence posture, and further enhance our resilience. Reaffirming NATO’s defensive mandate, the Alliance is determined to employ the full range of capabilities at all times to actively deter, defend against and counter the full spectrum of cyber threats, including those conducted as part of hybrid campaigns, in accordance with international law. We reaffirm that a decision as to when a cyber-attack would lead to the invocation of Article 5 would be taken by the North Atlantic Council on a case-by-case basis. Allies recognize that the impact of significant malicious cumulative cyber activities might, in certain circumstances, be considered as amounting to an armed attack. We remain committed to act in accordance with international law, including the UN Charter, international humanitarian law and international human rights law as applicable. We will promote a free, open, peaceful and secure cyberspace, and further pursue efforts to enhance stability and reduce the risk of conflict by supporting international law and voluntary norms of responsible state behavior in cyberspace.” MEDIA COVERAGE OF NATO ANNOUNCEMENTS Global media coverage leading up to this NATO Summit was rather limited, especially when compared to the U.S.-Russia Summit and many of President Biden’s other European meetings – such as the G7 Summit and the his meeting with Queen Elizabeth II. Nevertheless, Meritalk offered this article: “Cybersecurity, Ransomware Climb Policy Ladder at NATO, G-7 Meetings,” which said, “cybersecurity in general, and ransomware in specific, climbed high onto the ladder of major policy issues at both the weekend meeting of G-7 nations this weekend, and the NATO Summit that concluded on June 14. “The increasing importance of cybersecurity on the national stage tracks with U.S. policy in recent months, including federal government responses to major software supply chain cyber assaults and ransomware attacks against U.S. critical infrastructure sector companies that are believed to have originated from organizations based in Russia. President Biden has promised to confront Russian President Vladimir Putin with cybersecurity and ransomware issues when the two leaders meet on June 16. …” Also, Info security Magazine ran an excellent piece entitled: “NATO Warns it Will Consider a Military Response to Cyber-Attacks,” which said, “NATO has warned it is prepared to treat cyber-attacks in the same way as an armed attack against any of its allies and issue a military response against the perpetrators. “In a communique issued by governments attending the meeting of the North Atlantic Council in Brussels yesterday, the military alliance revealed it had endorsed a Comprehensive Cyber Defence Policy, in which a decision will be taken to invoke Article 5 “on a case-by-case basis” following a cyber-attack. Under Article 5 of the NATO treaty, first signed in 1949, when any NATO ally is the victim of an armed attack, it will be considered an attack on all alliance members, who will theoretically take any actions necessary to defend that ally….” When I posted this NATO cyber topic on LinkedIn, the responses were all over the map. You can join that discussion here. Here are a few comments worth noting: Michael Kaiser, president and CEO at Defending Digital Campaigns: “Attribution better be 110 percent.” Paul Gillingwater, management consultant, Chaucer Group: “A cyber counter-attack *is* a military response. It's now one battlefield, from sea, land, air, space to cyberspace. Next: your AI will be trying to persuade my AI that it was actually a pacifist.” Kaushik (Manian) Venkatasubramaniyan, project manager, Global Business Research (GBR): “These kind of cyber-attacks targeting hospitals etc. are acts of war anyway.” FINAL THOUGHTS ON IMPORTANCE OF NATO ANNOUNCEMENT For many years, cyber pros have been talking about a “Cyber 9/11” or “Cyber Pearl Harbor.” Many experts still believe that those major cyber incidents are inevitable. Still, “smaller” cyber-attacks are now happening all the time all over the world — with very serious consequences. Bad actors are asking for larger ransoms and causing more harm. Ransomware is evolving, and future cyber-attacks may not be ended by paying a ransom to the cyber criminals. With many cyber-attacks against governments, hospitals and now critical infrastructure like gas pipeline companies and food processing plants taking place, new government actions were a must. These ransomware attacks via different types of malware are becoming more frequent and serious, and are a growing global challenge for public- and private-sector leaders. Many questions must be answered quickly, such as: Where are the “red lines” that cannot be crossed? Once the lines are identified, what happens if they are crossed? When does a cyber-attack become an act of war? Make no mistake, NATO’s new policy on cyber-attacks against critical infrastructures is a big deal. Expect more ransomware attacks to occur and those global commitments for action to be tested in the years ahead. Article Orginal Source: https://www.govtech.com/blogs/lohrmann-on-cybersecurity/nato-adds-cyber-commitments-potential-ransomware-response

Read More

Spotlight

InteProIQ

InteProIQ was founded in 2003 with the belief that no matter what technological solutions you may have in place, human error can completely sidestep them. Only with training and full security awareness can employees be better at recognizing new and ever evolving threats. InteProIQ offers Cyber Security Awareness Training that is relevant to employees in all positions and departments. With nine topics covering the foundation and fundamentals of all-things security, our training is designed to help employees recognize a social engineering attack, establish good security practices and identify other external or internal threats that put the security of entire supply chains at risk.

Events