Our cyber security products span from our next gen SIEM used in the most secure government and critical infrastructure environments, to automated cyber risk reporting applications for commercial and government organisations of all sizes.
Ransomware has plagued businesses for several years, but the recent outbreaks of WannaCry and NotPetya have marked the beginning of a new era of hybrid malware that combines multiple exploits into something much more dangerous. What can organisations do to remain safe when the cyber criminals are innovating so quickly?
The cyber-attacks that are currently making the headlines, dubbed NotPetya or GoldenEye depending on who is taking credit for its analysis, don’t appear to be typical with respect to their motivation of extortion. It may seem like a peculiar conclusion, given it is a ransomware virus, but researchers are now suggesting that its amateur ransomware capabilities were designed to cover the fact that it is a dangerous cyber weapon targeting the Ukraine.
Furthermore, if its motive is cyber warfare rather than extortion, then it is reasonable to conclude that the perpetrator was a nation-state. The Ukraine’s security service has publically stated its belief that Russia is behind the attack.
Some recognition should be given to the malware creators, given its virulence and efficacy when it takes hold in an organisation. However, if the Ukraine security services are correct, it seems it also backfired as it caused widespread damage in Russia as well as the Ukraine.
Nevertheless, businesses should have been prepared, with cyber security processes in place. The foreshadowing of the WannaCry attack a few weeks ago should have seen every business on the planet apply the Microsoft patch that resolved the vulnerability being exploited by EternalBlue.
Interestingly, GoldenEye was transmitted to targets from a compromised Ukrainian news site rather than via the usual ransomware vector of email. This suggests it was aimed at Ukrainian targets rather than being a widespread organised criminal attack. Furthermore, several researchers think that despite the screen demanding a ransom, it does not save the victim’s data. Thus there is no way to recover it. Before this, the basis of ransomware’s success was that the criminals always got paid and then, nearly always, handed over the decryption keys. GoldenEye comes with no such promise, so word soon spreads that it is not worth paying up.
So what can you do? There is little doubt that if you are in the sights of an attacker, there is a limited amount you can do – this is especially true if the attacker has the resources of a nation-state. Many of GoldenEye’s victims were collateral damage rather than specifically targeted. Collateral victims are not of concern to these attackers.
If you practice good cyber security hygiene, in most cases it keeps your business safe. As recommended by the Australian Signals Directorate the following proactive operational cyber security controls, if properly executed in your business, will assist in protecting you from most opportunistic or accidental malware infections:
Security experts say it time and time again: patch your operating systems, patch your applications and keep patching them as soon as the patches are available. Most malware strains need at least one unpatched vulnerability to exploit.
A vulnerability management system gives you immediate, contextual feedback on where weaknesses and vulnerabilities exist in your enterprise. You can use a vulnerability management system to prioritise the work of your systems administrators to make sure security fixes are dealt with promptly.
A modern and contemporary approach to security operations requires you gain better visibility of what’s going on in your network. To do this, collect the security events from your operating systems, network devices, security devices, vulnerability management systems and administration systems into a security information and event management (SIEM) system so that your security analysts can correlate what they see on your networks and investigate for patterns of attacks.
These four cyber security processes can proactively assist in protecting your organisation from most attacks. If you remain patched and compliant, most malware is unable to access your enterprise. Even the most sophisticated malware and malware-free attacks still require vulnerabilities or configuration weaknesses, so the real-time feedback from a vulnerability management system helps you find and fix these issues before the bad guys exploit them.
Monitoring is key to identifying attacks. Check out our infographic and make use of the content in your work:
A recent KPMG Report suggests that protecting against and dealing with cyber risks will be the major challenge for senior executives in 2024. It is clear that despite high levels of security investment, organisations continue to suffer from cyber attacks.Read more
The Australian Signals Directorate’s (ASD) recent publication of their Cyber Threat Report 2022-2023 unearthed a range of areas for concern for government departments and critical infrastructure entities at local, State and Federal level.Read more
As cyber risks increase, organisations are encountering the longer life cycle of insurance renewals and the need to demonstrate better management of security controls and their effectiveness.Read more
Highlights and insights from the recent Managed Services Summit in London & the ISACA Central Chapter Conference on Digital Trust, in Birmingham, UK. With two recent conferences in the space of three days, some interesting challenges were very evident in the topics discussed. Being very different events, the challenges were quite different, but interestingly they […]Read more
In early August 2023, the latest joint advisory on persistent vulnerabilities was issued by the intelligence and security agencies of the “Five-eyes” community. These joint advisories are becoming more common. Perhaps recognising the growing importance of shared security information and the common nature of many of the threats faced – the weight they carry makes […]Read more
The quality of your risk assessment and the security information it provides is important; if you plan to use it to actively manage your operational and cyber resilience activities. Organisations are constantly exposed to a rapidly changing threat environment, so you really need a similarly rapid evidence-based feedback system that informs you of the ongoing […]Read more
The UK market has its own regulators, security standards and challenges. And while rulings from SEC in the US or the Australian Prudential Regulation Authority (APRA) in Australia don’t apply to UK companies, for the most part, the observations are undoubtedly relevant and the resulting advice instructive. It would be wrong to think UK financial […]Read more
<<< Part 2a: Australia’s Essential Eight: Beyond Endpoint Control <<< Part 2b: Activating UK NCSC & US NIST Guidelines: Beyond Endpoint Control Part 4: Systematic Measurement of Cyber Controls >>> As much as we invest into cyber security controls, external threats are inevitable. In a recent Notifiable Data Breaches Report from the Office of the […]Read more
Keen campers, scouts and even the Swiss Army know – that a good penknife is indispensable. This simple device has mitigated many a disaster at one point in time or another. Whether it’s to cut through a bit of string, tighten a screw or simply to solve the problem of no bottle opener in the […]Read more
Supply chain risk is an area of cyber security that demands the ongoing attention of every enterprise; because it can make the difference between being resilient or not. It’s no surprise that insurers warn that the vulnerability of supply chains is potentially a systemic risk that can quickly propagate across supply chain dominated industries. Organisations […]Read more
Read by directors, executives, and security professionals globally, operating in the most complex of security environments.