Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

April 2023

Elastic Security in the open: Empowering security teams with prebuilt protections

Elastic Security now comes with 1,100+ prebuilt detection rules for Elastic Security users to set up and get their detections and security monitoring going as soon as possible. Of these 1,100+ rules, more than 760 are SIEM detection rules considering multiple log-sources — with the rest running on endpoints utilizing Elastic Security for Endpoint.

Building a cybersecurity plan for the State and Local Cybersecurity Grant Program (SLCGP)

For state and tribal governments thinking about applying for — or that have already applied for — funding from the US federal State and Local Cybersecurity Grant Program (SLCGP) or Tribal Cybersecurity Grant Program (TCGP), you likely already know that building out a comprehensive cybersecurity plan is a required element in the process. If you’ve already submitted your application for fiscal year 2022 funding, you have until the end of September 2023 to submit your cybersecurity plan.

Enhance SOC workflows with Elastic Security and Recorded Future threat intelligence

Security teams today need to analyze vast amounts of data from various sources, including endpoints, cloud, applications, and user activity, just to mention a few. At the same time, adversary activity is also on the rise and the threat landscape is becoming more and more complex every day. Further exacerbating the situation, security teams are strapped for resources and unable to analyze the enormous amounts of data and security alerts they receive in real time.

US National Security Deep Dive Pillars 2 and 3: Dismantle Threats and Shape Market Forces

Last time we looked at The US National Security Strategy Pillar 1: Defend Critical Infrastructure. Today, we are looking at Pillar 2: Disrupt and Dismantle Threat Actors and Pillar 3: Shape Market Forces to Drive Security Resilience. Preventing the attacks in Pillar 1 would not be necessary if the attackers were taken off the board.

How using Cloud SIEM dashboards and metrics for daily standups improves SOC efficiency

When we talk about emerging technologies and digitization, we often forget that while innovators work to bring the best solutions to market, cybersecurity gurus are concurrently working to identify loopholes and vulnerabilities in these new systems. Gone are the days when cyber attacks were monthly news; instead, they happen almost daily.

Beyond the build: Why runtime security is critical for container protection

Containers and microservices have changed the game: They allow organizations to ship apps faster and make better use of hardware. They encourage modular software design. And containers help teams embrace the cloud-native paradigms of scalability, mobility, and resilience. It’s safe to say that containers have shaken things up.

Threat Hunting vs Incident Response for Cyber Resilience

Protecting data and protecting business continuity are both similar and different. In a data driven world, your mission as a security analyst is to prevent threat actors from gaining unauthorized access to sensitive data and systems. Simultaneously, you also need to investigate incidents rapidly, ensuring that critical services experience as little downtime as possible.

Automate common security tasks and stay ahead of threats with Datadog Workflows and Cloud SIEM

Detecting and remediating security threats is a constantly evolving concern for modern DevSecOps and security operations center (SOC) teams. Moreover, manually investigating and responding to vulnerabilities and threats is time-consuming, laborious, and knowledge-intensive.

geeks+gurus: Get real about cyber resilience

Join our geeks+gurus of Sumo Logic for an interactive conversation on the current state of cybersecurity, Demonstrating value is vital. In this 25-minute conversation, Bob Layton and Chas Clawson will Get Real about Cyber Resilience. With uncertainty around a potential recession and IT budgets flattening, security teams are learning how to do more with less. Cyber attacks are becoming more complex and destructive, however, more pressure is being put on security leaders to be more efficient with their spending and to make the case for these critical investments.

Threat Detection and Response: 5 Log Management Best Practices

In a world where attackers can move fast, security teams need to move faster. According to SANS research from 2022, adversaries can perform intrusion actions within a five-hour window. While analysts need the Millennium Falcon of security technologies that enable threat detection and response in under twelve parsecs, increasingly complex IT environments make the 1-10-60 Framework feel unachievable.

Demystifying Elastic Security for Cloud and its capabilities

It's no surprise that organizations are moving to the cloud to innovate — to meet the growing demands of their customers and digital transformation. Organizations want to build applications that are fast and scalable. They want to make use of the latest cloud-native capabilities like containers, orchestrators, microservices, APIs, and declarative infrastructure. However, this also means security in the cloud cannot be an afterthought.

What is XDR? Is the security impact real or hyped?

With so many overlapping and self-serving definitions of XDR (Extended Detection and Response), embracing the innovations in technology first require that we parse the alphabet soup. We agree with several industry analysts covering the space that XDR is a vendor push with no real customer demand, but the problem spaces within XDR are of significant customer interest. Consensus has emerged on a few XDR elements such as: cloud-native/SaaS, improved detection, and improved response.

Rogue AI is Your New Insider Threat

When ChatGPT debuted in November 2022, it ushered in new points of view and sentiments around AI adoption. Workers from nearly every industry started to reimagine how they could accomplish daily tasks and execute their work — and the cybersecurity industry was no exception. Like shadow IT, new rogue AI tools — meaning AI tools that employees are adopting unbeknownst to the organization they work for — can pose security risks to your organization.

Banks are leveraging modern cloud security tools to mitigate human error

The efficiency, security, and scalability of cloud operations are driving financial institutions’ adoption of the technology faster than ever before. The ability to meet customers where they want to transact, personalize solutions, and leverage new data and analytics solutions (including AI) on-demand is driving this growth. In fact, according to Accenture, the banking industry's workloads in the cloud more than doubled from 2021 to 2022.

Elastic Global Threat Report Breakdown: Credential Access

In the second part of our breaking down the Elastic Global Threat Report series, we’re focusing on the credential access tactic, which was the third-most common category of behavior we observed. Roughly 10% of all techniques we saw involved one form of credential theft or another and dissecting this class of behaviors is helpful both to improve our understanding of threats and to better understand enterprise risks.

Detecting the 3CX Supply Chain Attack with Graylog and Sigma Rules

According to reporting by several cybersecurity publications the 3CX Desktop Application has been exploited in a supply chain attack. The 3CX client is a popular VOIP and messaging application used by over 600,000 companies. From the article on Bleeping computer This supply chain attack, dubbed ‘SmoothOperator’ by SentinelOne, starts when the MSI installer is downloaded from 3CX’s website or an update is pushed to an already installed desktop application.