I’ve worked in the IT field for over 30 years. 20 of those years have been spent in the network security field, employed by some of the largest names in the industry. But to my family, I’m still just the guy who “works with computers”. Many of my family are not computer savvy, which is a nice way of saying I had to teach them where the power button is. However, “Power Button Locator” is just one of my jobs. Windows won’t boot up?

When it comes to card-not-present transactions, security is constantly a moving target. Between February and April, the peak period when COVID-19 was spreading across much of the US, cyber-attacks against the financial sector were reported to have risen by 238%. The exponential growth of digital payment transactions, combined with the increasing variety of customer-facing devices and payment applications, has many financial institutions re-evaluating their approaches to cybersecurity.

Software development and delivery is an ever-changing landscape. Writing software was once an art form all its own, where you could write and deploy machine code with singleness of purpose and no concern for things like connecting to other computers. But as the world and the variety of systems that software supports became more complex, so did the ecosystem supporting software development.

In Part 1 of this blog series, we took a look at how we could use Elastic Stack machine learning to train a supervised classification model to detect malicious domains. In this second part, we will see how we can use the model we trained to enrich network data with classifications at ingest time. This will be useful for anyone who wants to detect potential DGA activity in their packetbeat data.

In the world of digital warfare, internet security has become a daunting task. Cybersecurity threats and attacks; even state-sponsored cyber-attacks are to the fore. Therefore, achieving effective cybersecurity without a few knowledgeable security practitioners and sophisticated toolset is out of the question. We should not depend so much on many security analysts in the age of automation and orchestration.

We’ve always been vocal about the imminent threat of breaches and propagated the message that irrespective of the size of your business, the industry you’re in, or your geography, you can be subject to a security breach. And unfortunately, history repeats itself often. On May 11, 2020, Nippon Telegraph & Telephone (NTT), a large telecommunications company, revealed that attackers may have stolen data from its internal systems, affecting over 600 customers.

As our personal and business lives move into the digital sphere, implementing robust cybersecurity practices has quickly become a necessity. Much like brushing your teeth twice a day or making sure you get eight hours of sleep each night, it’s important to regularly protect and clean our data. Indeed, with 70% of Americans conducting their banking primarily online, it’s easy to see that a lapse in judgment or ignorance of how to stay safe could have serious consequences for many.

Unless you’ve been living under a rock you are probably familiar with the recent Shadow Brokers data dump of the Equation Group tools. In that release a precision SMB backdoor was included called Double Pulsar. This backdoor is implemented by exploiting the recently patched Windows vulnerability: CVE-2017-0143. For detection, we are going to first focus on the backdoor portion of the implant, hunting for traces left behind on the network.

Ransomware has been around for decades going back all the way to 1989. Since then it has only magnified in scope and complexity. Now at a time when working remotely is becoming more universal and the world is trying to overcome the Covid-19 pandemic, ransomware has never been more prominent. Ransomware is a type of malware that prevents users from accessing their system or personal files and demands a “ransom payment” in order to regain access.