Search for a command to run...
My name is Valentina. but hey, just call me Vally, which means strength. I am the Powerhouse behind Cyvally. Vally is a rising cybersecurity professional and a content creator, I write to make cybersecurity and cloud topics understandable and interesting to you (after all, who likes boring?).
No comments yet. Be the first to comment.
Welcome to Cyber Shell! Explore cybersecurity resources, including courses and certifications, tailored to all experience levels. Stay updated with the latest trends, and explore opportunities to advance your skills and career. Thanks for visiting!
We hear about companies falling victim to cyberattacks, resulting in severe damage to their reputation. As customers, we are influenced by such incidents and may choose to discontinue using their services. However, this issue extends beyond the realm...
I recently discovered that generations before Gen Y had their own official names, too. For the longest time, I assumed the naming trend began with Gen Y, the Millennials, then continued with Gen Z, and now Gen Alpha. But like everything else in histo...
Seen the film Extraction? Cyvally chooses a cyber action thriller, so you may be thinking Why Cyvally is linking an action thriller film genre to cyber security. Anyway, that’s one of the perks of being a cybersecurity enthusiast: everything gets you...
I believe it is safe to claim that our moms were among the early adopters of encryption, with their "coded" ways of interacting with their children, ensuring their messages, particularly warnings, can only be understood by you. This can be achieved b...
My first time boarding the yellow buses in Lagos State wasn't a funny one. I took a bus from Lekki Phase 1 to Ajah. As a Yoruba girl who had stayed in Port Harcourt and was just arriving in Lagos, my first instinct wasn't to use the popular "owa" to ...
During my previous role as a Network Performance Optimization (NPO) engineer, in my first month on the job, I received a serious warning from my line manager during one of our training sessions. He emphasized the importance of getting official approv...
Hello Cyvally Readers, Let's add some excitement to our day, shall we? Today's post is tailored around vulnerability assessment, and I will introduce you to some hands-on practicals/labs. Links to these labs will be provided after the review questions in this post.
I understand that many of my readers are entry-level professionals and might find the labs a bit challenging. However, if you encounter any difficulties, don't hesitate to reach out to me in the comments section of this post or through my social media direct messages. I'll be more than happy to guide you. I strongly encourage you to complete all the content on the CyberSecBase page and review the previous posts on the Sec+ page. This will help you to better understand the vulnerability assessment scope and get the idea around the labs. Yes, this may be challenging, but trust me, it will be fun too. You won't just gain theoretical knowledge about vulnerability assessment, but also practical skills. I believe this will renew your passion for cybersecurity. I will love to know how engaging you find these practicals, so please remember to share your comments. Your feedback will help decide to add more hands-on activities in the future or not. THANK YOU
To assess anything, you should compare it to a standard to determine how well it aligns. This standard is your organization's security policy, and should comply with external regulations. Threat hunting, penetration testing, and vulnerability assessment are three important security assessments. Threat hunting identifies hidden risks, penetration testing simulates actual attacks and scanners are used in vulnerability assessments to compare system configurations to the baseline.
In this post, you will learn about threat hunting, vulnerability scanning, and syslog/SIEM/SOAR technologies.
IOCs (Indicators of Compromise): these are pieces of evidence that point to a network or system that has been infected or compromised by a threat actor. IP addresses, domain names, file hashes, URLs, registry keys, and suspicious activity patterns are a few examples.
TTP (Tactics, Techniques, and Procedures): are methods, strategies, and actions used by threat actors to achieve their objectives during a cyber attack.
Threat hunting is an assessment that looks for TTPs in a system or network using information from threat intelligence. It entails looking for cyberthreats that avoid being noticed by the organization's defenses. Using tools like Threat Intelligence and IOCs, threat hunters may determine the actions an attacker must take and the traces they leave behind. The following techniques are used in threat hunting:
Intelligence Fusion: Threat hunting uses a threat's capabilities, motives, and resources as the foundation for understanding threats in the environment. Through security information and event management (SIEM) and threat analytics platforms, the intelligence fusion approach updates analytics platforms with TTP and IoC threat data feeds.
Threat Feeds: Threat feeds are information about adversaries collected from both internal and external sources. Threat details gathered internally, such as findings from incident responses, help in recognizing threats within your environment. Tools like Structured Threat Information eXpression (STIX) are used in the transfer of information from external sources.
Advisories and Bulletins: Threat hunting requires clear objectives and sufficient resources, often driven by hypotheses about potential threats. Security advisories that identify new TTPs or vulnerabilities are a good place to start when looking for threats. external threat feeds come from respected sources such as security vendors and industry associations.
Maneuver: This involves defenders and threat actors employing deceptive and counterattacking tactics to gain an advantage. It represents a sophisticated adversary's method to network navigation. Threat hunting strengthens defenses against lateral movement by countering attacker lateral movement through network infrastructure monitoring and analysis.
Vulnerability scanning is the process of examining services on systems for known vulnerabilities in software using signatures and scripts. Scanners, such as Tenable Nessus or OpenVAS, check network hosts for vulnerabilities and compare results to templates and lists of vulnerabilities. These scanners group vulnerabilities, give impact alerts, and offer remedies. The following concept contribute to accuracy, thoroughness, and effectiveness of a vulnerability scan:
False positives: A false positive is something that a scanner incorrectly identifies as a vulnerability. It takes time and effort to investigate the problem and ignoring the scans entirely may result in more serious issues.
False negatives: These are potential vulnerabilities that go undetected by a scan. it can be reduced by regularly performing additional scans and by employing scanners from many vendors.
Log reviews: The validation procedure for vulnerability reports can be improved by reviewing relevant system and network logs. Log reviews might reveal security events, policy violations, and other unusual circumstances that call for additional investigation.
Credentialed vs. non-credentialed: There are two methods for vulnerability scan with credentials and without credentials. Non-credentialed scans provide an outsider's perspective assessment of services for possible vulnerabilities, but they lack in-depth information. Credentialed scans, on the other hand, demand login information and offer more thorough, accurate risk information. They entail extra steps and expose configuration errors, providing details on potential insider attacks.
Intrusive vs. non-intrusive:There are two types of vulnerability scans: intrusive and non-intrusive. Non-intrusive scans, which only partially comprehensively identify vulnerabilities, analyze intercepted network traffic or passive reconnaissance methods without direct engagement. Although passive scanning, like the Zeek Network Security Monitor, has no effect on the network, it might not catch every vulnerability. On the other side, intrusive scans are active and actively explore target devices, increasing the likelihood of system breakdowns. Intrusive scans try to take advantage of vulnerabilities to show that they exist, which could result in disruptions.
Application: applications that process data and act as user interfaces are frequently targeted by attackers. A vulnerability scan measures an application's resistance to attacks.
Web application: web applications provide convenience but also increase the risk of unauthorized access. Vulnerability scans assesses the security of web applications .vulnerability of web app is mostly due to improper input validation
Network: Users and computing systems are connected through the network, which facilitates data exchange. The network is used by vulnerability scanners to access connected systems. To map and enumerate systems, scans typically cover the whole network.
Common Vulnerabilities and Exposures (CVE)/Common Vulnerability Scoring System (CVSS): Known software vulnerabilities are included in the CVE, which includes each vulnerability's ID, description, and reference. Vulnerability scanners that identify software versions and related vulnerabilities are built on this foundation. Using a scale from 0 to 10, the Common Vulnerability Scoring System (CVSS) evaluates the severity of vulnerability risk. In addition to other factors, CVSS takes into account exploit complexity, user engagement, and permission requirements. The combination of CVE and CVSS offers insightful information about possible risks related to certain software systems.
security controls generate log data and alerts, posing a risk. SIEM technologies aggregate data from various sources and analyze real-time security alerts from network hardware and applications. A protocol for Linux systems called Syslog aggregates logs and delivers them to a server, improving security by segregating problem reports from other logs. Through aggregation, enrichment, and pattern matching for incident response, SIEM transforms raw syslog data into insights that can be used for incident response. The following are concepts that are essential
Review reports: An alert or a report are the two main output formats from a SIEM. These are predetermined conditions that, in accordance with the system's rules, cause a certain information output. Then, these reports can be examined to establish whether an incident actually occurred or if it was a false alarm.
Packet capture:Network sensors and NetFlow sources collect information that allows for comprehensive frame inspection and compiled statistics on bandwidth and protocol utilization. Continuous packet captures have been a popular security technology that let experts successfully monitor different network segments. you can replay traffic, assisting investigations. While advantageous, this strategy necessitates large storage and requires careful placement and length consideration for optimal use..
Data inputs:SIEM systems collect a variety of data inputs from multiple systems. Despite the fact that contemporary networks produce a large amount of log data, SIEM focuses on locating critical information to support particular decisions. Collecting everything costs money and results in pointless reports. Instead, specifying desired outputs and tracking the required inputs from firewalls, network appliances, and important servers are what make SIEM effective. Unused data sources are eliminated as SIEM develops, and more sources are incorporated. The SIEM is fine-tuned by security specialists to meet issues and risks unique to a given environment.
User behavior analysis: By contrasting them with a baseline, a User and Entity Behavior Analytics (UEBA) solution can spot undesirable behaviors. This software monitors user account activity across platforms and cloud services, including embedded hardware, machine accounts, and other services. Due to the baseline complexity and minimization of false positives, UEBA mainly relies on AI and machine learning. SIEMs apply rules to data to identify certain patterns, typically for server and network events. Modern SIEMs keep an eye out for irregularities by using user behavioral analysis breakthroughs. For instance, analysis is triggered by changes in known user patterns. Microsoft's Advanced Threat Analytics is one example.
Sentiment analysis:It is a challenging undertaking to create an AI/ML algorithm that can describe or classify intentions expressed in natural language sentences. Recognizing intent presents a significant difficulty for behavior analytics powered by machine learning. Though advancements are being made in this field, which is frequently referred to as sentiment analysis or emotion AI, the complexity derives from a machine's difficulty in understanding context and meaning in natural language. Sentiment analysis is frequently used to track brand-related events on social media, such as identifying dissatisfied customers. Sentiment analysis assists in gathering threat intelligence in security situations to anticipate and identify potential internal or external threats before they develop into attacks. This method looks for patterns in data that reflect human emotions, viewpoints, or attitudes.
Security monitoring: Data is gathered and analyzed as part of security monitoring in order to spot illegal changes or suspicious activity in connected systems and networks. Setting up alert triggers based on predetermined behaviors is required for this. SIEM devices first focused on data collection before moving on to event data management. Security orchestration, automation, and response (SOAR) systems, which completely automate security procedures, are used in the current stage. Without automated solutions like SIEM and SOAR, security monitoring would be impossible given the complexity of modern IT systems, businesses, attacks, and behavioral patterns.
Log aggregation:The technique of integrating logs from several systems allows for the peaceful coexistence of various forms. This generates a more complete picture of the system's state than could be obtained from a single data source. Key fields are parsed, altered, and extracted throughout this aggregation process, which is frequently governed by rules or lookups. The goal is to transform various data sources into a format that can be searched and used for particular purposes. This standardized approach encourages reliability and searchability. Using regular expressions for parsing and mapping data to standard fields, SIEM software with connectors interprets and accounts for data from diverse systems. Log aggregation also synchronizes time zones for a single timeline.
Log collectors: a network appliance that acquires log and/or status information from other network systems. The purpose of log collectors is to collect data from various independent sources and input it into a single source, such as a SIEM. The formats of different sources may vary, but log collectors can synchronize these many field elements into a comprehensive data stream.
The goal of security orchestration, automation, and response (SOAR) is to address the issue of the volume of warnings outpacing the capacity of analysts to respond. A SOAR can be used as a stand-alone technology or combined with a SIEM, also known as a next-generation SIEM. In order to automate and offer data enrichment for the workflows that support incident response and threat hunting, SOAR first scans the organization's repository of security and threat information, analyzes it using machine learning and deep learning techniques, and then uses that data. Integrated platforms throughout the enterprise's SOAR systems gather data and alerts, bringing them together in one area where automated reactions may subsequently address threats and weaknesses.
Security is always excessive until it’s not enough.
Robbie Sinclair
Review Questions
Links to the Labs
