Threat actors continue to evolve methods to access valid credentials using new techniques such as multi-factor authentication or MFA spamming that we must detect. On Sept. 15, the security world was worked into a frenzy across social media as details of Uber’s “cybersecurity incident” were revealed.
While Distributed Denial of Service (DDoS) attacks have been around for over a decade, they still continue to evolve and escalate, particularly during 2022. The tense geopolitical situation caused by the Russian invasion of Ukraine has affected the nature and intensity of these types of attacks, making states official participants in the DDoS mitigation market.
Companies depend on Tines to automate their mission-critical security workflows. We take this responsibility extremely seriously, and we’re always enhancing our platform’s capabilities to make it even more trustworthy and reliable. Today, we introduced Change Control. When enabled, it adds a test environment to your Story, allowing you to prototype and experiment with changes, before applying them to your Story.
A lot of attention gets paid to preventing pass-the-hash and pass-the-ticket attacks, but these tactics limit adversaries to what they can perform from the command line. Compromising a plaintext password gives an attacker unlimited access to an account — which can include access to web applications, VPN, email and more. One way to extract plaintext passwords is through Kerberoasting, but this brute-force technique takes a lot of time and patience.
140,000 Social Security numbers and about 80,000 bank account numbers — that’s what one attacker stole from a major financial institution back in 2019. How did it happen? The attacker used firewall credentials to obtain privilege escalation and hack into improperly secured Amazon cloud instances.
Although cyberattacks on higher education institutions date back years, there has been a spike in university cyberattacks over the last two years. Cybercriminals had taken advantage of the rapid transition to hybrid learning that higher education institutions have been forced to implement before they had time to strengthen their cybersecurity, which has left most of them exposed. This is yet another example of accelerated adoption of new technologies before security measures are in place.
What if you could easily extend the retention of your CrowdStrike Falcon® detection data for a year or longer? Would that help with compliance? Investigations? Threat hunts? In Part 1 of this series, we covered the basics of Falcon Long Term Repository (Falcon LTR). To recap, Falcon LTR is an option available to Falcon customers. It offers a simple and cost-effective way to retain your Falcon detection data long term, which has historically been a costly and complex endeavor for security teams.
