Web-based attacks still reign supreme according to the EU Cybersecurity Agency

| March 2, 2018

article image
Web-based attacks and malware do not just hold the cybercrime crown, but they’re on the rise — that’s according to the latest Threat Landscape Report by the EU Agency for Network and Information Security (ENISA). In its sixth annual report, ENISA also reported that in 2017 attackers are increasing the complexity and sophistication of their attacks in an effort to constantly stay one-step-ahead in the cat and mouse game between them and defenders, and law enforcement. Perhaps unsurprisingly, SQL injection and phishing remain attackers’ go-to method for breaching an organization’s defences. Overall, as in previous years, the most prevalent web application attacks are SQL Injection (SQLi) attacks, Local File Inclusion (LFI), Cross-site Scripting (XSS), Remote File inclusion (RFI) and PHP object injection.

Spotlight

Security Alliance Limited

Intelligence Driven Cyber Security Security Alliance is a cyber intelligence company with a global delivery capability. We are a UK based cyber security company, founded in 2007 and specialising in the provision of highest quality cyber threat intelligence and security testing programmes We bring together conventional intelligence methods and deep technical knowledge, helping our clients to understand their cyber threat landscape and make better security decisions.

OTHER ARTICLES

New Ransomware hitting Industrial Control Systems like a nuclear bomb

Article | February 10, 2020

Researchers at security firms including Sentinel One and Drago’s have been mystified by a piece of code named Ekans or Snake, over the last month. Drago’s publically released its full report on Ekans Ransomware that has recently inflicted Industrial Control Systems and these are some of the most high-value systems that bridge the gap between digital and physical systems. In the history of hacking, only a few times a piece of malicious code has been marked attempting to intrude Industrial Control Systems. Ekans is supposed to be the first Ransomware with real primitive capability against the Industrial Control Systems, software, and hardware used in everything from oil refineries to power grids. Researchers say this ransomware holds the capability to attack ICS by Honeywell and GE as well.

Read More

Is the CEH v11 Course Worthwhile to Pursue After Windows 11 Update?

Article | September 13, 2021

If you are finding it confusing to decide whether to pursue the CEH v11 course now after the Windows 11 update, then you have certainly landed on the right page. We are here to make things clear to you so that you can make your decision without any hassle. When it comes to Certified Ethical Hacking, it is considered to be one of the most popular testing certifications at present in the industry. It is highly popular because it assists many with complete know-how of the skills that are required for the purpose of white hat hacking. The certified professionals are able to anticipate any kind of cybercrime from before and respond to it proficiently to avert any kind of business damage. In the time of the pandemic, many business organizations have to move to digital platforms to reach their customers without lockdown troubles. This is the reason why investment in the domain of cybersecurity has also gained a wave. Businesses have realized what the value of having their infrastructure cyber resilient is. This shows why the opportunities for skilled experts in the cybersecurity domain are never going to end in the coming future, and pursuing the course of CEH v11 is a great move to follow. To make things more convincing, we are here to help you with the importance the course of Certified Ethical Hacking brings into play and how you must choose the right career path in the respective field. Let’s get started. Ethical Hacking: What It Is To The World? When it comes to ethical hacking, it is acknowledged as the procedure of networks, applications, or smart devices to assess any kind of vulnerabilities if available. This type of assessment assists in reacting quickly and taking the right measures to enhance the cybersecurity of the entire infrastructure. A certified ethical hacker is basically an expert who understands the different vulnerabilities in the system and gets them fixed without any delay. This is done by following the ethical approach so that there is no such problem repeated again in the future. What do You get To Learn From CEH v11 in 2021? With the CEH v11 course, you get to learn 24 exceptional challenges in 4 different levels that include 18 attacking vectors. You get to know about various emerging attackers that include targeted ransomware, File-less malware, API threats, and more. In this course, you also get a complete understanding of different from enumerating techniques that include Telnet, NFS, SMB, IPV6, FTP, and BGP. This course also covers Malware reverse engineering, so you get a complete understanding of Dynamic and static malware assessment. Cloud computing is another prime concept that you get covered in this course, where you learn about Docker, Container Technology, Serverless computing, Kubernetes, Cloud Hacking procedures. CEH v11 also covers a proper understanding of Hacking web applications that includes web shell concepts, Web API. Webhooks, Web API security, and hacking. You also get to learn more about WPA3 Encryption and cracking. It also covers operation technology, side-channel attacks, HMI-based attacks, and more. Why is CEH An Ideal Career Option? Ethical hacking is possessing five phases of different procedures with every single process, including different actions that block any kind of vulnerabilities. With CEH v11 certification, you get a complete understanding of all these phases. These phases are basically divided in the form of network assessment, testing, and various other risk analysis procedures. As the world of technology is growing significantly, so is the risk of cyber-crime. This is the reason why businesses are looking for ethical hacking specialists who can assist them remain protected from all the potential risks. As the dependency on data science is growing across all industries, it is important that we protect the information and digital assets in the best possible way. There is no doubt that hacking is a heinous act, and almost all businesses are aware of the risks associated with it. To get protected from these risks, organizations around the world are in search of professional, ethical hackers who ensure that there is no vulnerability outside their doors. This is why the opportunities in the domain of ethical hacking have increased in the last few years, and there is no reason why you can’t say that pursuing CEH v11 is an ideal career option. Posts Up For Grabs After CEH v11 Course Anyone who is interested in developing their career in ethical hacking, including the following: Security Officer Security Analyst/Administrator Systems Security Engineer Security Manager /Specialist Auditor Security Professional Risk Analyst Vulnerability Analyst Network Administrator System Administrators Network Engineer Job Roles You Might Need To Take Responsibility As Certified Ethical Hackers Security Analyst Manual Ethical hacker Vulnerability Assessment Analyst Cyber Defense Analyst Cybersecurity auditor IT security administrator System security administrator Senior Security Consultant Security audit Network Security Engineer Cybersecurity Analyst Network Engineer SOC Security Analyst Information Security Analyst Warning Analyst InfoSec Security Administrator Benefits of Taking Up CEH v11 Certification To make it even convincing for you, below mentioned are a few of the benefits you avail with CEH v11 certification. Take a look: You are certainly able to open a lot of career opportunities with the respective course. It lets you advance in your career significantly. You get to understand what hackers might do to harm your business, and accordingly, you can take precautions. You get your knowledge related to risks and vulnerabilities improved with the assistance of the respective course. You benefit from a lucrative package in terms of salary as a Certified Ethical Hacker. Lastly, you also get to learn different types of real hacking tools as well. Wrap Up This shows why you must not hesitate and pursue the CEH v11 course even after the latest Windows 11 update. It gives you an edge over the other candidates and lets you have a successful career ahead. Good Luck!

Read More

How the IIoT can subdue cyber security challenges met by software adoption

Article | February 25, 2020

Matt Newton, senior portfolio marketing manager at AVEVA, discusses how IIoT can best cyber security challenges met through software adoption. According to Gartner’s 2019 Industrial IoT Platforms Magic Quadrant report, by 2023 30% of industrial enterprises will have full, on-premises deployments of IIoT platforms. IIoT platforms and software adoption is rapidly increasing – up 15% in 2019 – and this will undoubtedly continue to grow as we progress through the new decade. From enhancing operational performance to improved business processes, adopting new technology and software capabilities is vital for business success in today’s industrial sector. However, when it comes to adopting software and technology, integrating new systems with existing legacy systems in the industry can be a challenge.

Read More

Post-Pandemic Tech Job Market: The Good, Bad and Ugly

Article | August 30, 2021

As we emerge from the worst pandemic in a century, many public- and private-sector employees and employers are reassessing their options within technology and cybersecurity roles. Are boom times coming soon for tech companies, cybersecurity professionals and others? Marketplace.org recently posted the headline, “Are we headed for a Roaring ’20s economy?” Here’s an excerpt: “A year ago, when most of the country was under stay-at-home orders and people were losing jobs at an unprecedented rate, we asked three people who study economic history to explain whether the recession on the horizon was going to look anything like the Great Depression. “With the vaccine rollout well underway, weekly unemployment claims at their lowest level since the pandemic began and consumer confidence rising, we’ve asked them about a different historical comparison: the 1920s.” Meanwhile, NBC News reported “There are now more jobs available than before the pandemic. So why aren't people signing up?” Here’s a quote from that piece: “The number of job vacancies soared to nearly 15 million by mid-March, but discouraged, hesitant and fearful job seekers means many positions are still unfilled, according to new data from online job site ZipRecruiter. “Online job postings plunged from 10 million before the start of the pandemic last year to just below 6 million last May, as lockdowns and shutdown orders forced businesses to close their doors and reduce or lay off workers.” Meanwhile, according to KPMG in the U.K., tech’s job market is growing at the fastest pace in two years. “The move towards new remote and hybrid working arrangements, new spending priorities for businesses around IT infrastructure, automation and the huge shift to online retail are likely to provide a long-term boost to sales and investment in the tech sector,” said KPMG’s chair Bina Mehta. One more — thecyberwire.com just reported that the skills gap is getting wider regarding cybersecurity jobs: “The cybersecurity industry is projected to triple year-over-year through 2022, yet the workforce shortage still stands at millions worldwide. With a 273 percent increase in large-scale data breaches in the first quarter of 2020 alone, employing more cybersecurity professionals is a pressing challenge for both companies looking to hire in-house and cybersecurity agencies alike. “According to the International Information System Security Certification Consortium, there are now more than 4.07 million unfilled cybersecurity positions across the world. Despite high entry salaries, recession-proof job security and plentiful career opportunities, there are simply not enough trained cybersecurity professionals to fill the skills gap.” BAD TREND — AND EVEN SOME UGLY MIXED IN I recently posted a story from the Atlanta Journal-Constitution on LinkedIn entitled “Employers are hiring again but struggling to find workers.” Here’s an excerpt: “Chris New said he has turned down $250,000 in business because he just can’t hire enough laborers and drivers at his Carrollton-based company, Barnes Van Lines. “There are plenty of people without jobs, but unemployment benefits give them too much incentive not to work, he said. ‘We advertise and nobody comes in looking for a job. A lot of people are taking advantage of the system. It’s really killing us.’” Although the focus on this article was not technology or cybersecurity jobs, many of the comments were tech- and cyber-related. Marlin Brandys: So how do they explain people like me with a B.S. in networking and cybersecurity and an NCSP both from 2020 and I can’t even get an interview for a tier 1 help desk job? All these posts and stories from corporate America, universities, government agencies selling the bogus skills gap and shortage story. This platform alone has 1,000s of cyber qualified people able and willing to work in entry level positions at entry level pay and benefits. Stop the madness already. I applied for unemployment 01/08/2021. It’s now 04/19/2021 and I haven’t seen a dime of unemployment compensation. I’ll gladly take an entry-level position in cyber. Quinn Kuzmich: Marlin Brandys - Honestly one of the unspoken truths of the security industry is age discrimination. Sad but true. Dave Howe: Quinn Kuzmich - broadly true across all of IT though. They stand around demanding someone "do something" about the "skills shortage" but exclude 90% of candidates based on an arbitrary checklist, and 75% more based on illegal age, sex or race discrimination, disguised as "culture fit" Joseph Crouse: Marlin Brandys you're overqualified. Marlin Brandys: Joseph Crouse, I wish I could believe that. For some types of positions in the teaching or instructing silo maybe, for entry level information security I do not believe so. Dave Howe: Marlin Brandys - it's difficult to tell. I have seen "entry level" roles demand a CISSP and CEH. Gregory Wilson: 300+ applications and 4 interviews... No job yet... Overqualified, not enough experience, ghosted.... REALITY — I'm over 60 and nobody will hire me... All the BS aside, there are lots of people ready to work... Pay them what they're worth! Dave Howe: I think there is a bigger picture. Welfare shouldn't be so generous as to encourage people to stay on it, but equally, it shouldn't be so stingy as to cause people to struggle to stay afloat (meet rent, put food on the table, however basic, keep the power on) — there is need for balance. Equally though, an entry -evel role where a worker is willing to put in a nominal 40 hours at a routine, boring but not dangerous or unpleasant job should pay sufficient after expenses so as to be able to afford some luxuries above and beyond what welfare provides — if you are no better off, then that job is underpriced and needs either automation to improve output so as to make paying more a better proposition, or automating entirely and the job eliminated. If the job is dangerous, distasteful or involves unsociable hours, then that should be reflected in the pay, above and beyond what a "basic" job should provide. The answer should never be "we need to cut welfare so that they will take my crappy, low paid job out of desperation, because adding automation means upfront costs and I don't want to pay any more" You can join in on that LinkedIn conversation here: SOLUTIONS, PLEASE This Forbes article offers some interesting perspectives on how both employers and employees can succeed in the coming post-COVID cybersecurity world, while offering a new model for our future workforce: “Cybersecurity is a striking example of where the supply-demand gap for personnel is particularly volatile, with companies routinely lacking both the technology and available human capital needed to integrate relevant, highly skilled workers at the same speed as their unprecedented digital transformation. When the COVID-19 pandemic forcibly distributed security teams, organizations were given a new perspective as to how remote teams can de-risk innovation. Now, many are moving to industrialize the 'new normal' of cybersecurity with greater efficiencies across their internal programs and the software development life cycle by seamlessly integrating expert security talent on-demand.” While this coming boom may not be good news for state and local governments who struggle to compete with the private sector for the most talented tech and cyber staff, there are new options opening up for public-sector employees as well. This research finds that many retirees want to come back and work 10 to 20 hours a week, especially if they can work remotely. Many groups are training workers for the post-pandemic job market. I also have spoken with CISOs and other technology leaders in both the public and private sectors who are much more open to hiring out-of-state workers, even though they would never have allowed that before the pandemic. And finally, what about those who can’t find work, despite the supposed “boom times” that are coming? Last year, I wrote this blog describing why some skilled cyber pros are still not getting jobs. Here are just a handful of the reasons I listed there: People are living or looking in the wrong places. They want a local job and do not want to move. (Note: More remote hiring is happening now with COVID-19, but it is still unclear if many of these jobs will go “back to the office” after the pandemic. This leads to hesitancy in taking a job in another part of the country.) Insistence on remote work. While this is easier during the pandemic, some people want 100 percent remote without travel, which can limit options. Also, some hiring managers are not clear if remote jobs will last after the pandemic restrictions are lifted, so they want to hire locally. Company discrimination due to older worker applicants. Yes, I agree with my colleagues that this is alive and well in 2020. Other forms of discrimination exist as well, such as race and gender. Lack of professional networking — especially true during COVID-19. They don’t have personal connections and have a hard time meeting the right people who are hiring or can help them find the right job. Attitude, character, work ethic, humility, etc. I have written several blogs just on this topic, but some people never get the job because they come across in interviews as entitled or too angry or having a bad attitude. They scare off hiring managers. For more on this topic, see “7 reasons security pros fail (and what to do about it)” and “Problem #3 for Security Professionals: Not Enough Humble Pie” and “Problem 5: Are You An Insider Threat?” Putting this all together, I love my brother Steve’s perspective on individual career opportunities and selling your ideas (and yourself) to those both inside and outside your organization: “It’s all about the right product at the right place at the right time at the right price — with the right person delivering the message to the right decision-maker.” FINAL THOUGHTS During a recent vacation to northern Arizona, I found myself working in a coffee shop surrounded by several men and women that were supporting global companies with technology projects. Conversations were all over the map regarding application enhancements and complex deliverables for some industry-leading names. I was frankly a bit shocked that all of this work was being run out of a coffee shop — with a few video conference calls to people’s homes. The “new normal” of global workforces became more of a reality to me, and I see this trend accelerating even after the pandemic. Article Orginal Source: https://www.govtech.com/blogs/lohrmann-on-cybersecurity/post-pandemic-tech-job-market-the-good-bad-and-ugly

Read More

Spotlight

Security Alliance Limited

Intelligence Driven Cyber Security Security Alliance is a cyber intelligence company with a global delivery capability. We are a UK based cyber security company, founded in 2007 and specialising in the provision of highest quality cyber threat intelligence and security testing programmes We bring together conventional intelligence methods and deep technical knowledge, helping our clients to understand their cyber threat landscape and make better security decisions.

Events