There's no one size fits all when it comes to setting up your organization’s first security program. Each organization has a unique set of business needs, guardrails to implement, and data it needs to protect, which is why it’s important to remember that every security program is going to look a bit different. ‍ If you’re in the process of setting up your first security program, here are some steps I recommend you take and apply to your organization's unique needs. ‍

Ignoring low-risk secrets in GitGuardian? This could be a costly mistake. Learn how to avoid the hidden dangers of prematurely closing incidents.

In the first blog in this series, we unpacked the foundational concepts of encryption at rest and introduced you to Elastic Cloud’s “bring your own key” (BYOK) feature, which allows you to do encryption at rest with encryption keys managed by the KMS service of your cloud provider. The second blog of this series dives into the technical nuances of implementing encryption at rest with AWS KMS keys.

On August 13th, 2024, the US National Institute of Standards and Technology (NIST) published the first three cryptographic standards designed to resist an attack from quantum computers: ML-KEM, ML-DSA, and SLH-DSA. This announcement marks a significant milestone for ensuring that today’s communications remain secure in a future world where large-scale quantum computers are a reality.

In Q2 2024, the Kroll Cyber Threat Intelligence (CTI) Team observed an increase in activity around a new ransomware group named FOG. FOG was initially observed in May 2024, and since then has been heavily targeting higher educational institutions in the U.S. by exploiting compromised VPN credentials. Kroll's review of a recent FOG binary (1.exe) found no exfiltration or persistence mechanisms directly integrated.

ThreatQ TDR Orchestrator serves as a bridge between human expertise and machine precision, optimizing workflows in security operations. By leveraging this dynamic solution, organizations can ensure that the tacit knowledge of security analysts is efficiently captured and combined with automated processes. This integration facilitates a more agile response to threats, as the human element of decision-making is supported by the speed and consistency of automation.

In the second quarter of 2024, UK businesses faced cyber-attacks every 44 seconds, highlighting the persistent nature of cyber threats and the critical need for robust cybersecurity protocols. This frequency of attacks shines the spotlight on the ongoing challenge UK businesses face in protecting their digital assets. It also stresses the importance of implementing comprehensive security measures to protect against increasingly sophisticated and frequent cyber threats.

IT infrastructure management is a complex task. Over the years, various methods have been used to better manage corporate environments. Whether it is network monitoring, asset control, application monitoring, or any of the other infrastructure management obligations, different solutions have been attempted to make the job easier. These undertakings became even more challenging as infrastructure moved from the deceptively tidy on-premises data centers out to the cloud.

Recently, a widespread cloud extortion operation—affecting 110,000 domains and involving significant financial demands—was uncovered. Unit 42, the cybersecurity research division of Palo Alto Networks, released a report this month detailing how threat actors exploited misconfigured.env files to gain unauthorized access, steal sensitive data, and demand ransoms after deleting cloud assets.

The shift towards a proactive cybersecurity mindset has been steadily gaining momentum. Industry experts have emphasized the importance of best practices for implementation and the role of security orchestration. By integrating modern threat intelligence solutions into vulnerability management platforms, forward-thinking enterprises can become more proactive in their fight against cyber threats.