Shakeel Ali

Cyber Security Agency of Singapore (CSA) is now a CVE Numbering Authority (CNA) assigning CVE IDs for vulnerabilities reported to CSA unless covered by the scope of another CNA    https://lnkd.in/gBM959Xv    #CVE #CNA #Vulnerability #VulnerabilityManagement #Cybersecurity

5

Cyber Security Agency of Singapore (CSA) is now a CVE Numbering Authority (CNA) assigning CVE IDs for vulnerabilities reported to CSA unless covered by the scope of another CNA    https://lnkd.in/gBM959Xv    #CVE #CNA #Vulnerability #VulnerabilityManagement #Cybersecurity

9

#DiyakoSecureBow ———————————— CISO as A Service (vCISO) CYBERSECURITY ADVISORY Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department Alert CodeAA21-200 Summary This Joint Cybersecurity Advisory was written by the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) to provide information on a Chinese Advanced Persistent Threat (APT) group known in open-source reporting as APT40. This advisory provides APT40’s tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help cybersecurity practitioners identify and remediate APT40 intrusions and established footholds. APT40—aka BRONZE MOHAWK, FEVERDREAM, G0065, Gadolinium, GreenCrash, Hellsing, Kryptonite Panda, Leviathan, MUDCARP, Periscope, Temp.Periscope, and Temp.Jumper—is located in Haikou, Hainan Province, People’s Republic of China (PRC), and has been active since at least 2009. APT40 has targeted governmental organizations, companies, and universities in a wide range of industries—including biomedical, robotics, and maritime research—across the United States, Canada, Europe, the Middle East, and the South China Sea area, as well as industries included in China’s Belt and Road Initiative. On July 19, 2021, the U.S. Department of Justice (DOJ) unsealed an indictment against four APT40 cyber actors for their illicit computer network exploitation (CNE) activities via front company Hainan Xiandun Technology Development Company (Hainan Xiandun). Hainan Xiandun employee Wu Shurong cooperated with and carried out orders from PRC Ministry of State Security (MSS) Hainan State Security Department (HSSD) intelligence officers Ding Xiaoyang, Zhu Yunmin, and Cheng Qingmin to conduct CNE. Wu’s CNE activities resulted in the theft of trade secrets, intellectual property, and other high-value information from companies and organizations in the United States and abroad, as well as from multiple foreign governments. These MSS-affiliated actors targeted victims in the following industries: academia, aerospace/aviation, biomedical, defense industrial base, education, government, healthcare, manufacturing, maritime, research institutes, and transportation (rail and shipping). Click here for a PDF version of this report. https://lnkd.in/dVQDgJHU https://lnkd.in/d4fd2xtZ Special Thanks❤️😇👍🏽🙏 CISA Alumni Group Cybersecurity and Infrastructure Security Agency -Secure Business Continuity- 2024.07.31 —————————————————— #CyberSecurity #MitreAttack #Chain #RiskManagement #SecureBusinessContinuity

9

💡 #CPC_Blog | Safeguarding Your Data with Comprehensive #Cybersecurity Strategies Another recent data breach involved a public institution in Hong Kong, where personal data stored on contractors' #cloud platforms was not deleted after the contract expired. The incident highlights the importance of choosing trustworthy and experienced cloud service providers. ​ This article will explore a range of ICT solutions, including high-quality cloud services, security measures for safeguarding cloud assets, and cybersecurity solutions. It aims to assist enterprises in protecting business #data and achieving high-quality business development. ​ 🔎Read the blog: https://lnkd.in/gwnZTe7g ​ #CITICTelecomCPC #GlobalLocal #ICTSolutionsPartner #InnovationNeverStops #cybersecurity #DigitalTransformation #Innovation #TrustCSI ​ #cyberthreats #AIDrive #ArtificialIntellegence #MSS #ManagedSecuritySerivce #DataLeak #CloudService

5

"OSCs must retain artifacts used as evidence for the assessment for the duration of the validity period of the certificate of assessment, and at minimum, for six years from the date of certification assessment as addressed in 32 CFR 170.17(c)(4). The OSC is responsible for compiling relevant artifacts as evidence and having knowledgeable personnel available during the assessment. The organizational artifacts are proprietary to the OSC and will not be retained by the assessment team unless expressly permitted by the OSC. To preserve the integrity of the artifacts reviewed, the OSC creates a hash of assessment evidence (to include a list of the artifact names, the return values of the hashing algorithm, and the hashing algorithm used) and retains the artifact information for six years. The information obtained from the artifacts is an information collection and is provided to the C3PAO for uploading into the CMMC instantiation of eMASS." The above text is from the DoD's June 21, 2024 submission to the Federal Register. It describes the expected information collection level-of-effort for a CMMC Level 2 assessment. Some more information: The DoD expects evidence collection and archival, assessment planning and results, C3PAO records about their assessment staff, and submission of data into CMMC eMASS to take 525 hours on average, per assessed company. This is just the effort related to paperwork. It doesn't cover the time spent interviewing or demonstrating the system. It doesn't cover the time preparing. Bottom line? The DoD seems 𝒅𝒆𝒕𝒆𝒓𝒎𝒊𝒏𝒆𝒅 to get their defense contractors cyber-secure, no matter the cost. They are treating this as seriously as the defenses for our key military and government installations, and looking at a timeline of just a few years to get our manufacturing and military support base resilient to cyber-attack. If you're ready to start working seriously on NIST SP 800-171 and #CMMC compliance, or want to get scheduled for your certification assessment, give my team at Kieri Solutions - Authorized C3PAO a call. We specialize in helping companies become compliant without outsourcing their control of IT to a third party. Read more about the DoD's submission below: https://lnkd.in/eTFi9dVK

51

47 Comments

🚀 Exciting News We are bringing these Technical Hands On Training to support cybersecurity professionals to upskill and tackle challenges. 1️⃣ Operationalise OSINT with Manh Pham & Minh N. 2️⃣ Exploit Development 101 with Qiling Framework with KaiJern Lau (xwings) 3️⃣ Threat Hunting and Detection Engineering with Razwan M 4️⃣ The Car Hacker’s Methodology and Checklist for Application Security Hackers with Jay Turla 🎯 Transmission of knowledge is the key trait of our DNA. 👉 Register here: https://sibersiaga.mil.my/ #sibersiaga24 #OSINT #exploit #threathunting #carhacking

9

🎯 Would you like to get SOCRadar's special Threat Actor card deck in the new year? Test your knowledge with SOCRadar's Threat Actor Quiz Series! 🌐 Today and tomorrow, we’ll post challenging questions about infamous threat actors. Answer correctly and win exclusive Threat Actor Cards—your go-to source for in-depth insights into the world's most dangerous cybercriminals. 💡 How it works: Those who give the most correct answers to the 8 questions we will publish on Thursday and Friday will win free Threat Actor cards. The card deck will be sent to the winners by post in January. 📖 Ready to learn, engage, and challenge yourself? Answer this question—your expertise might just be rewarded! Try our Free Tool "Threat Actor Intelligece": https://lnkd.in/difjenp5 #CyberThreatIntelligence #ThreatActors #SOCRadar

15

👉 What are the latest cybersecurity alerts, incidents, and news? 🚨 #CyberAlerts 5 New Critical Vulnerabilities Added to CISA’s Known Exploited Vulnerability List Source: Cybersecurity and Infrastructure Security Agency New TeamTNT Cryptojacking Campaign Targets CentOS Servers with Rootkit Source: Vito Alfano and Nam Le Phuong via Group-IB Ivanti Cloud Appliance Vulnerability Exploited in Ongoing Cyberattacks Source: Ivanti Iran’s UNC1860 Exploits Passive Backdoors in Middle Eastern Networks Source: Google Threat Actors Misuse Splinter Red Team Tool for Post-Exploitation Source: Dominik Reichel via Unit42 by Palo Alto Networks Unit 42 💥 #CyberIncidents Australia’s Compass Group Confirms Second Ransomware Attack Source: David Hollingworth via Cyber Daily Altman Specialty Plants Reports Suffers Breach Exposing Sensitive Consumer Data Source: Altman Plants BingX Confirms Minor Asset Loss Amid Suspicious Hot Wallet Activity Source: BingX via X Schools in Lancashire, UK Face Major Disruption Due to Ransomware Attack Source: Gemma Sherlock via BBC Sensitive Star Health Customer Data Leaked Through Telegram Chatbots Source: The New Indian Express 📢 #CyberNews Federal Trade Commission Uncovers Surveillance of Children by Social Media Firms Source: Federal Trade Commission Germany Shuts Down 47 Crypto Exchanges Allegedly Supporting Underground Economy Source: Federal Criminal Police Office, Germany DDoS Attacks Overtake Ransomware and Are Now the Dominant Cyber Threat in Europe Source: European Union Agency for Cybersecurity (ENISA) Global Operation Dismantles Major Phishing Network Affecting 480,000 Victims Source: Europol HSBC Pilots Quantum-Safe Technology for Tokenized Gold Transactions Source: HSBC Holdings This Cyber Briefing is powered by https://911cyber.app  Get help from cybersecurity first responders today! Find the full stories at cybermaterial.com Or click here 👇 to read the summaries. https://lnkd.in/e-uiPGVW #cyberbriefing #informationsecurity #CISA #Ransomware #CentOS #Ivanti #Splinter #Telegram #Germany #Crypto

2

Pinochle.AI : Pinochle: Threat Hunting 🔍 Proactive Threat Detection: Detect and counter threats before they escalate with advanced threat hunting technology. 🔍 Key Insight: Outsmart hidden threats with proactive detection techniques. 🎯 Impact: Boost your security posture by actively seeking out and addressing potential risks. 🚀 Learn More: Uncover how Pinochle can keep you ahead in the battle against threats. https://pinochle.ai/ https://www.kyureeus.com/ #cybersecuritytips #ITSecurity #OTSecurity #informationsecurity #CyberSec #networking #networksecurity #infosecurity #cyberattacks #security #cybersecurityawareness #cyberdefense #threats #cybersecurity

18

💡 News Update 💡 Cyber Security Agency of Singapore (CSA) has published an extensive set of guidelines and a companion guide aimed at securing AI systems, a move signaling the nation’s proactive stance on managing cybersecurity risks associated with AI. The new resources, titled “Guidelines on Securing AI Systems” and the “Companion Guide on Securing AI Systems,” were developed in consultation with AI and cybersecurity experts across sectors. The CSA emphasizes the need for both system owners and developers to adopt a lifecycle approach to AI security to address potential vulnerabilities effectively. #csa #ai #cybersecurity #news https://lnkd.in/gX26VQ_J

4

Vulnerabilities Patched in Kiuwan Code Security Products After Long Disclosure Process: It took code security firm Kiuwan nearly two years to patch several serious vulnerabilities found in its SAST products. The post Vulnerabilities Patched in Kiuwan Code Security Products After Long Disclosure Process appeared first on SecurityWeek.

1