The all in one place for non-profit security aid.
This interview from July 14th, 2023 originally aired as a shortened version on the CyberWire Daily Podcast. In this extended interview, Dave Bittner sits down with Chris Cochran from Huntress to talk about the challenges small and medium sized businesses face with cyber security. Read More
The CyberWire
Cybersecurity in the AI Era: Insights from Unit 42’s Kyle Wilhoit, Director of Threat Research
Join us on the latest episode of Threat Vector to dive into the evolving world of AI in cybersecurity with Kyle Wilhoit, director of threat research at Unit 42. The podcast also touches on the threat research published by Unit 42 regarding the unique characteristics of Medusa ransomware with Unit 42 researchers Doel Santos, principal threat researcher, and Anthony Galiette, senior malware reverse engineer.
This thought-provoking discussion, hosted by David Moulton, director of thought leadership at Unit 42, focuses on the current state and future trends of AI in cyberthreats. Discover how AI is reshaping the landscape of cyberattacks, the role of generative AI in threat actor tactics, and the challenges of attribution in AI-driven cyberattacks.
Wilhoit shares his perspectives on the notable use cases where adversarial AI techniques have been employed and how cybersecurity professionals can adapt to these emerging challenges. Learn about the balance between targeted and non-targeted AI-driven attacks and the strategies being developed to counteract them effectively.
The conversation then shifts to new research on Medusa ransomware, with experts Santos and Galiette, offering a snapshot of the threat intel they published on the Unit 42 Threat Research Center. Their research exposes how Medusa employs sophisticated methods for propagation and evasion, a unique multi-extortion strategy, transparently pressurizing victims with online ransom demands, and a detailed breakdown of Medusa ransomware’s operations and the proactive protective measures suggested by Palo Alto Networks. Read More
The CyberWire
Okta Browser Plugin Vulnerable To Reflected Cross-Site Scripting Attacks
Okta Browser Plugin is available on multiple browsers like Edge, Chrome, Safari, and Firefox. Combining all these browsers, the plugin has over 5 million users.
However, this plugin was discovered to have a Cross-site Scripting vulnerability that could allow threat actors to execute arbitrary Javascript code.
Okta acted swiftly upon the report and published a security advisory to address this vulnerability.
Join our free webinar to learn about combating slow DDoS attacks, a major threat today.
Versions 6.5.0 through 6.31.0 of the Okta Browser Plugin for Chrome, Edge, Firefox, and Safari were identified as affecting the issue.
According to the Okta advisory, this vulnerability was assigned CVE-2024-0981, and its severity was given as 7.1 (High).
This flaw arises when users input the new credentials, and the plugin prompts users to save the credentials with Okta Personal.
However, this vulnerability does not affect Workforce Identity Cloud users if Okta Personal is not added to the browser plugin that is used to enable multi-account views.
Additionally, Okta Admin users can run the following query to search for users who are still using an outdated version of this plugin.
debugContext.debugData.oktaUserAgentExtended ne “okta-browser-plugin/6.32.0” and debugContext.debugData.oktaUserAgentExtended co “okta-browser-plugin/”
More than 100 million users use Okta to save their credentials and connect to applications both inside and outside of their organizations. In addition, the Okta Browser Plugin offers multiple features, such as
Automatically sign in to your business and personal apps with just one click
Add your own apps into Okta
Quickly generate strong, random passwords on the fly for all your apps
Easily access your Okta dashboard apps and tabs
Seamlessly and securely switch between multiple Okta accounts
Affected ProductsFixed in VersionsOkta Browser Plugin versions 6.5.0 through 6.31.0(Chrome/Edge/Firefox/Safari)Okta Browser Plugin version 6.32.0 for Chrome/Edge/Safari
It is recommended that users of this plugin upgrade to the latest versions to prevent threat actors from exploiting this vulnerability.
Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo
The post Okta Browser Plugin Vulnerable To Reflected Cross-Site Scripting Attacks appeared first on Cyber Security News.
How To Reduce The Alert Triage Time In Security Operations: SOC Analyst Guide
Security threats are rising day by day, from sneaky phishing emails to ransomware attacks. They are dangerous for both large and small organizations. As these attacks get more and more advanced and sophisticated, the cost of keeping an eye on and mitigating the threats is getting higher and higher.
The number of security threats is increasing, making it difficult for SOC teams to manage alerts proactively.
Today, most companies are shifting their stuff to the cloud, which means having more alerts to handle. Therefore, businesses are realizing the need to move towards a better solution.
The business must be ready for the problem before it starts showing its head up. This is where SOC alert triage comes in handy. Keep reading to know what is alert triage? and how you can reduce the alert triage time to manage all the security alerts efficiently!
Alert Triage is a process of recognizing the important alerts from a huge pool of security alerts and allocating the resources accurately. Whenever a security alert pops up in SOC, it quickly checks the alert and finds out whether it’s a serious threat or not and whether it needs to be dealt with instantly or not. Alert triage is an efficient and organized system that can manage all the alerts quickly and actively.
It can identify the alerts that are urgent to be dealt timely.
This way, it sorts out the high-priority alerts and informs the incident response teams so that they can deal with it at the right time.
The alert triage process comprises several stages, including:
Collecting alerts
Categorizing alerts
Prioritizing alerts
Analyzing alerts
Incident response
Ongoing improvement
The challenges of security operations alert triage are:
Lack of Perfect Information: Sometimes, you may not get the perfect information from various sources (network, endpoint, identity). This makes it difficult to see a clear picture of the security situation
Difficulty in Determining Severity and Impact: It’s not easy to find out the serious alerts and what impact they can have on the system if the security team does not act. Therefore, it’s crucial to have a team of skilled people so that they can gather the right information and understand the information correctly to deal accurately with the alerts
Alert Fatigue: Having too many alerts can overwhelm the analysts and there is a great risk that he/she will start ignoring the important alerts. This can happen because of the overloading of information. It can be very difficult and challenging, especially when dealing with a huge volume of false positives
Need for Time and Skill: SOC alert triage is a process that needs to present the information accurately and quickly so that the analyst can understand the alert and perform the necessary action after understanding the provided information. Because of this, it’s crucial to have the experts onboard and enough time to manage everything efficiently
Integration Challenges: The team of cyber security experts use different tools to perform various tasks, sometimes these tools do not work well, because of poor integration. It makes the whole picture blur and difficult to understand what’s happening during the triage
To reduce the alert triage time, use these strategies:
This is essential for good collaboration among the members of the SOC team. The collaboration of the analysts in figuring out the real threats reduces the overall effort and time.
Working in a team while sharing ideas, points of view, and skills improves the alert-checking process and increases accuracy. This creates a perfect learning environment in which one learns new things from each other and other learning channels.
Clear communication and working collaboratively make sharing information easy, allow the team to respond better, and resolve problems quickly and accurately.
The analysts are in charge of handling security alerts. Lower-tier alerts can be handled by junior analysts, but higher-tier alerts require to be handled by an experienced analyst.
The higher tiers should be sent to the senior analyst so that necessary action can be taken as needed. This process of passing tough alerts to experienced analysts is called alert escalation.
This approach helps to reduce the time of alert triage. An experienced analyst can analyze the high-tier alert more precisely, going deeper into the depth of the problem. If things get more serious, the latest tools and resources can be used to resolve them by involving outside help. This process makes the team’s work better and more efficient.
In a security operation Center (SOC), several security alerts come from various tools, making it difficult for the analyst to investigate the true alert. Not all the alerts are difficult, some are easy and can be easily resolved by the junior analysts.
But most of them are difficult to understand they require a highly experienced analyst to understand the problem and resolve it. Analysts can not check all the alerts. This means there is a great chance that they miss an important alert. This way, a sneaky attack can sneak without getting noticed. This risk can be mitigated by using alert tirage automation.
The use of AI and machine learning algorithms enhances the efficiency of the process. The automation of the tools helps to check the huge amount of alerts and prioritize them on the severity for further human review.
The automation of tasks, allows the cyber security teams to focus on the investigation of the real threats that can harm the system.
At this present time, tracking and tackling threats with a high speed is necessary. So that they can keep their systems and data safe from the attackers.
The organizations can easily do that by making the SOC alert triage process smoother and faster. By using AI and collaboration and the strategies that we have discussed above, the security teams can reduce the time spent on alert triage. This way, the organizations can stay one step ahead of cyber threats.
The post How To Reduce The Alert Triage Time In Security Operations: SOC Analyst Guide appeared first on Cyber Security News.