SlideShare a Scribd company logo

2021/0/15 - Solarwinds supply chain attack: why we should take it sereously

•
•
Sirris
Sirris

In this webinar we explain why the SolarWinds attack is different from all known scenarios and how to protect your company or manufacturing site from it. Act fast, be aware!

Software
1 of 25
Download to read offline
SolarWinds supply chain attack: why we should take it seriously Analysis, discussion and mitigation By Patrick Coomans (Agoria, Sirris) and Tatiana Galibus (Sirris)
How to categorize this type of attack 2© sirris | www.sirris.be | info@sirris.be | 15/01/2021 Known knowns Known Unknowns Unknown Unknowns
The story of SunBurst: global intrusion campaign ▪ When? we can trace up to October 2019-June 2020, detected in December. ▪ How? SolarWinds, Orion IT management software, normal update ▪ Who is affected? 18 000 companies affected, government, consulting, technology, telecom and extractive entities in North America, Europe, Asia and the Middle East. ▪ …and Belgium too ▪ What can it do? Surveillance and execute random code
3 key takeaways ➢Is it possible to keep track of new attack types? ➢How to provide supply chain security? ➢Why it is crucial to keep the logs and info for a long time?
How does it work? ▪ Source code was modified and the style was mimicked ▪ SUNSPOT is used to insert the SUNBURST backdoor into the Orion build through hijacking MsBuild.exe process. ▪ Target source code is modified before it has been read by the compiler. ▪ Hides by obfuscation ▪ SolarWinds.Orion.Core.BusinessLayer.dll is a malware base ▪ DNS beaconing to Command and Control
Analyzing SunBurst kill chain
How to detect it? FireEye recommendations ❖ Yara rules to detect TEARDROP ❖ querying internet-wide scan data sources for an organization’s hostnames ❖ impossible rate of travel if a compromised account is being used ❖ LogonTracker module to graph all logon activity ❖ monitor existing scheduled tasks for temporary updates Stellar particle
Official recommendations: https://www.solarwinds.com/securityadvisory ➢ Versions affected: Orion Platform 2019.4 HF5, version 2019.4.5200.9083 Orion Platform 2020.2 RC1, version 2020.2.100.12219 Orion Platform 2020.2 RC2, version 2020.2.5200.12394 Orion Platform 2020.2, version 2020.2.5300.12432 Orion Platform 2020.2 HF1, version 2020.2.5300.12432 ➢ Incidents with abuse of Security Assertion Markup Language (SAML) tokens consistent with attack and no SolarWinds instances. Follow-up the updates! ➢ If SAML abuse is identified, simply mitigating individual issues, systems, servers, accounts will not lead to the adversary’s removal from the network. In such cases, organizations should consider the entire identity trust store as compromised.
Tools to identify infiltration: https://us-cert.cisa.gov/ncas/alerts/aa20-352a • Sparrow.ps1 to help detect possible compromised accounts and applications in the Azure/M365 environment. Sparrow focuses on the identity- and authentication-based attacks https://github.com/cisagov/Sparrow. • Impossible logins, Long SAML token validity, same creation and use timestamp, tokens with missing MFA details • Check the public list of Indicators of compromise (malicious domain, IPv4 or hash)
Immediate mitigations ▪ utilize Orion Platform release 2020.2.1 HF 1 ▪ Ensure that SolarWinds servers are isolated / contained ▪ If SolarWinds infrastructure is not isolated, restrict scope of connectivity and admin accounts, block outcoming traffic for endpoints with SolarWinds software. ▪ Consider (at a minimum) changing passwords for accounts that have access to SolarWinds servers / infrastructure. ▪ Consider a review of network configurations if Orion management software was used. ▪ Review federation trusts & OAuth application & service principal credentials: https://msrc- blog.microsoft.com/2020/12/13/customer-guidance-on- recent-nation-state-cyber-attacks/
Lessons learnt ▪ Diligently performing updates improves security? Not always! ▪ The most high-profile victim is the US government: no one is protected from highly sophisticated attack ▪ One of the biggest ever cyber- attacks: removing is highly complex and challenging ▪ Be aware, stay informed, keep the logs
TIPS: ASSUME BREACHED – prepare response 12© sirris | www.sirris.be | info@sirris.be | 15/01/2021 1. Asset inventory • You cannot protect what you don’t know: understand the attack surface, your keys to the kingdom • Data, Applications, Devices • Know what was installed, used, or connected to your network and when: keep a trace
TIPS: ASSUME BREACHED – prepare response 13© sirris | www.sirris.be | info@sirris.be | 15/01/2021 2. Logging • You can never have enough logging • Store logs securely, retain them as long as possible, up to 18 months if you can • DNS, DHCP, firewalls, routers, WiFi, application servers, access points, authentication logs, EDR logs, … • Make sure NOT to log passwords, identities, PII in clear text!!
TIPS: ASSUME BREACHED – prepare response 14© sirris | www.sirris.be | info@sirris.be | 15/01/2021 3. File integrity monitoring • For servers, containers, … • Track changes to critical configuration files, scheduled tasks, scripts
TIPS: ASSUME BREACHED – prepare response 15© sirris | www.sirris.be | info@sirris.be | 15/01/2021 4. Network flow • Keep traffic metadata (netflow) (check Elastic Stack, Zeek.org, or commercial software) • Full packet capture for critical applications / cases (check Arkime, Wireshark, …)
TIPS: ASSUME BREACHED – prepare response 16© sirris | www.sirris.be | info@sirris.be | 15/01/2021 5. Keep spam & phishing filter content • Best: archive ALL e-mail • Good: archive all suspicious, filtered or flagged mail, including mails that have been released by users
PREVENTIVE MEASURES 17© sirris | www.sirris.be | info@sirris.be | 15/01/2021 1. Know and reduce your attack surface area • Know what is on your network (Asset inventory, internal vulnerability scanning, …) • Know what is exposed publicly (External scanning, e.g. Sweepatic) • Remove or disable unused or unnecessary applications, services or data • Archive or remove data that is not longer needed • Leave deception beacons lingering around
PREVENTIVE MEASURES 18© sirris | www.sirris.be | info@sirris.be | 15/01/2021 2. Network Detection and Response • Egress traffic filtering • Understand your traffic, identify top talkers, identify anomalies in traffic patterns • Deploy deception technology, honeypots
PREVENTIVE MEASURES 19© sirris | www.sirris.be | info@sirris.be | 15/01/2021 3. Strict patching and endpoint protection • Active exploitation of 0-day vulnerabilities often starts within 4-8 hours, so immediately patch high-risk vulnerabilities • Deploy decent enterprise-grade EDR software on all endpoints • Decommission what can’t be patched (out of support)
PREVENTIVE MEASURES 20© sirris | www.sirris.be | info@sirris.be | 15/01/2021 4. Segmentation • Segment off critical assets, old assets, endpoints, IoT devices, … • Use a zero-trust security architecture
PREVENTIVE MEASURES 21© sirris | www.sirris.be | info@sirris.be | 15/01/2021 5. Authentication & Authorization • Least privilege where possible • MFA for at least all key staff, people with elevated privileges
How Sirris/Agoria can help you? Contact us for a free 1hr intake Opt for a collective workshop to strengthen solid foundations. Choose 1 or 2-day orienting advise in order to take advantage of our expertise combining both manufacturing and IT technology Are you protected or dangerously exposed?
Roadmap to cyber security Free 1hr intake Collective initiatives Master class Learning network Orienting advise Maturity level Security scan Action plan
Upcoming events: Sirris+Agoria ▪ Master Class Cyber Security in 30 Steps Jan, 20th, 2021 ▪ Internal IT Security, Basic Cyber Resilience, Cyber Hygiene ▪ Kick-off 20/01, then 3 sessions on 27/01, 10/02 and 10/03. ▪ Master Class Security for Digital Service Builders Jan, 26th and Feb, 2nd 2021 ▪ DevSecOps, AppSec, OWASP, security pipeline ▪ 2 half-days, 8:30-12:00 ▪ Learning Network Security in Manufacturing Q2 2021 ▪ Demand-driven topics: anomalities in OT, changing perception of security as cost ▪ Webinar: Trusted Mobile Apps Feb 2021 ▪ Webinar: OT security in Manufacturing Feb 2021 ▪ Webinar: Cyber security in digital services, March 2021 ▪ Thematic Event: CS meets Manufacturing Q1,2021
Feedback & Questions THANK YOU!

Recommended

SolarWInds-Incident-ppt.pptx
SolarWInds-Incident-ppt.pptxSolarWInds-Incident-ppt.pptx
SolarWInds-Incident-ppt.pptxTusharPuri20
 
Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]David Sweigert
 
Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)LJ PROJECTS
 
The Current ICS Threat Landscape
The Current ICS Threat LandscapeThe Current ICS Threat Landscape
The Current ICS Threat LandscapeDragos, Inc.
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
The Seismic Impact of the SolarWinds Hack
The Seismic Impact of the SolarWinds HackThe Seismic Impact of the SolarWinds Hack
The Seismic Impact of the SolarWinds HackNicole Fucile-Borsian
 
Application Security
Application SecurityApplication Security
Application SecurityReggie Niccolo Santos
 

Recommended

SolarWInds-Incident-ppt.pptx
SolarWInds-Incident-ppt.pptxSolarWInds-Incident-ppt.pptx
SolarWInds-Incident-ppt.pptxTusharPuri20
 
Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]David Sweigert
 
Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)LJ PROJECTS
 
The Current ICS Threat Landscape
The Current ICS Threat LandscapeThe Current ICS Threat Landscape
The Current ICS Threat LandscapeDragos, Inc.
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
The Seismic Impact of the SolarWinds Hack
The Seismic Impact of the SolarWinds HackThe Seismic Impact of the SolarWinds Hack
The Seismic Impact of the SolarWinds HackNicole Fucile-Borsian
 
Application Security
Application SecurityApplication Security
Application SecurityReggie Niccolo Santos
 
Breach and attack simulation tools
Breach and attack simulation toolsBreach and attack simulation tools
Breach and attack simulation toolsBangladesh Network Operators Group
 
How to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your NetworkHow to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your NetworkSqrrl
 
Solar winds supply chain breach - Insights from the trenches
Solar winds supply chain breach - Insights from the trenchesSolar winds supply chain breach - Insights from the trenches
Solar winds supply chain breach - Insights from the trenchesInfosec
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersInfosec
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Managementasherad
 
Beginner's Guide to SIEM
Beginner's Guide to SIEM Beginner's Guide to SIEM
Beginner's Guide to SIEM AlienVault
 
ISACA -Threat Hunting using Native Windows tools .pdf
ISACA -Threat Hunting using Native Windows tools .pdfISACA -Threat Hunting using Native Windows tools .pdf
ISACA -Threat Hunting using Native Windows tools .pdfGurvinder Singh, CISSP, CISA, ITIL v3
 
Cyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceCyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceTom K
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)k33a
 
Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceVishal Kumar
 
Intrusion Detection Systems and Intrusion Prevention Systems
Intrusion Detection Systems and Intrusion Prevention Systems Intrusion Detection Systems and Intrusion Prevention Systems
Intrusion Detection Systems and Intrusion Prevention Systems Cleverence Kombe
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation centerMuhammad Sahputra
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Frameworkn|u - The Open Security Community
 
Using the Threat Agent Library to improve threat modeling
Using the Threat Agent Library to improve threat modelingUsing the Threat Agent Library to improve threat modeling
Using the Threat Agent Library to improve threat modelingEric Jernigan MSIA, CISSP, CISM, CRISC
 
100 Security Operation Center Tools.pdf
100 Security Operation Center Tools.pdf100 Security Operation Center Tools.pdf
100 Security Operation Center Tools.pdfMAHESHUMANATHGOPALAK
 
Sqrrl and IBM: Threat Hunting for QRadar Users
Sqrrl and IBM: Threat Hunting for QRadar UsersSqrrl and IBM: Threat Hunting for QRadar Users
Sqrrl and IBM: Threat Hunting for QRadar UsersSqrrl
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for BeginnersSKMohamedKasim
 
IBM Security QRadar
IBM Security QRadar IBM Security QRadar
IBM Security QRadarVirginia Fernandez
 
Threat hunting on the wire
Threat hunting on the wireThreat hunting on the wire
Threat hunting on the wireInfoSec Addicts
 
Web Application Firewall
Web Application FirewallWeb Application Firewall
Web Application FirewallChandrapal Badshah
 
Corona| COVID IT Tactical Security Preparedness: Threat Management
Corona| COVID IT Tactical Security Preparedness: Threat ManagementCorona| COVID IT Tactical Security Preparedness: Threat Management
Corona| COVID IT Tactical Security Preparedness: Threat ManagementRedZone Technologies
 
Cyber attacks on your SAP S/4HANA systems? So you can stay relaxed. [Webinar]
Cyber attacks on your SAP S/4HANA systems? So you can stay relaxed. [Webinar]Cyber attacks on your SAP S/4HANA systems? So you can stay relaxed. [Webinar]
Cyber attacks on your SAP S/4HANA systems? So you can stay relaxed. [Webinar]akquinet enterprise solutions GmbH
 

More Related Content

What's hot

How to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your NetworkHow to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your NetworkSqrrl
 
Solar winds supply chain breach - Insights from the trenches
Solar winds supply chain breach - Insights from the trenchesSolar winds supply chain breach - Insights from the trenches
Solar winds supply chain breach - Insights from the trenchesInfosec
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersInfosec
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Managementasherad
 
Beginner's Guide to SIEM
Beginner's Guide to SIEM Beginner's Guide to SIEM
Beginner's Guide to SIEM AlienVault
 
Cyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceCyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceTom K
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)k33a
 
Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceVishal Kumar
 
Intrusion Detection Systems and Intrusion Prevention Systems
Intrusion Detection Systems and Intrusion Prevention Systems Intrusion Detection Systems and Intrusion Prevention Systems
Intrusion Detection Systems and Intrusion Prevention Systems Cleverence Kombe
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation centerMuhammad Sahputra
 
100 Security Operation Center Tools.pdf
100 Security Operation Center Tools.pdf100 Security Operation Center Tools.pdf
100 Security Operation Center Tools.pdfMAHESHUMANATHGOPALAK
 
Sqrrl and IBM: Threat Hunting for QRadar Users
Sqrrl and IBM: Threat Hunting for QRadar UsersSqrrl and IBM: Threat Hunting for QRadar Users
Sqrrl and IBM: Threat Hunting for QRadar UsersSqrrl
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for BeginnersSKMohamedKasim
 
Threat hunting on the wire
Threat hunting on the wireThreat hunting on the wire
Threat hunting on the wireInfoSec Addicts
 

What's hot (20)

Breach and attack simulation tools
Breach and attack simulation toolsBreach and attack simulation tools
Breach and attack simulation tools
 
How to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your NetworkHow to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your Network
 
Solar winds supply chain breach - Insights from the trenches
Solar winds supply chain breach - Insights from the trenchesSolar winds supply chain breach - Insights from the trenches
Solar winds supply chain breach - Insights from the trenches
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down Intruders
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Management
 
Beginner's Guide to SIEM
Beginner's Guide to SIEM Beginner's Guide to SIEM
Beginner's Guide to SIEM
 
ISACA -Threat Hunting using Native Windows tools .pdf
ISACA -Threat Hunting using Native Windows tools .pdfISACA -Threat Hunting using Native Windows tools .pdf
ISACA -Threat Hunting using Native Windows tools .pdf
 
Cyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceCyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General Audience
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
 
Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement Matrice
 
Intrusion Detection Systems and Intrusion Prevention Systems
Intrusion Detection Systems and Intrusion Prevention Systems Intrusion Detection Systems and Intrusion Prevention Systems
Intrusion Detection Systems and Intrusion Prevention Systems
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
 
Using the Threat Agent Library to improve threat modeling
Using the Threat Agent Library to improve threat modelingUsing the Threat Agent Library to improve threat modeling
Using the Threat Agent Library to improve threat modeling
 
100 Security Operation Center Tools.pdf
100 Security Operation Center Tools.pdf100 Security Operation Center Tools.pdf
100 Security Operation Center Tools.pdf
 
Sqrrl and IBM: Threat Hunting for QRadar Users
Sqrrl and IBM: Threat Hunting for QRadar UsersSqrrl and IBM: Threat Hunting for QRadar Users
Sqrrl and IBM: Threat Hunting for QRadar Users
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for Beginners
 
IBM Security QRadar
IBM Security QRadar IBM Security QRadar
IBM Security QRadar
 
Threat hunting on the wire
Threat hunting on the wireThreat hunting on the wire
Threat hunting on the wire
 
Web Application Firewall
Web Application FirewallWeb Application Firewall
Web Application Firewall
 

Similar to 2021/0/15 - Solarwinds supply chain attack: why we should take it sereously

Corona| COVID IT Tactical Security Preparedness: Threat Management
Corona| COVID IT Tactical Security Preparedness: Threat ManagementCorona| COVID IT Tactical Security Preparedness: Threat Management
Corona| COVID IT Tactical Security Preparedness: Threat ManagementRedZone Technologies
 
Cyber attacks on your SAP S/4HANA systems? So you can stay relaxed. [Webinar]
Cyber attacks on your SAP S/4HANA systems? So you can stay relaxed. [Webinar]Cyber attacks on your SAP S/4HANA systems? So you can stay relaxed. [Webinar]
Cyber attacks on your SAP S/4HANA systems? So you can stay relaxed. [Webinar]akquinet enterprise solutions GmbH
 
2021 01-13 reducing risk-of_ransomware
2021 01-13 reducing risk-of_ransomware2021 01-13 reducing risk-of_ransomware
2021 01-13 reducing risk-of_ransomwareAlgoSec
 
2019-06-12 aOS Aix Marseille - B2 - Sécuriser son digital Workplace - Seyfall...
2019-06-12 aOS Aix Marseille - B2 - Sécuriser son digital Workplace - Seyfall...2019-06-12 aOS Aix Marseille - B2 - Sécuriser son digital Workplace - Seyfall...
2019-06-12 aOS Aix Marseille - B2 - Sécuriser son digital Workplace - Seyfall...aOS Community
 
Securiser son digital workplace avec Microsoft Threat Protection
Securiser son digital workplace avec Microsoft Threat ProtectionSecuriser son digital workplace avec Microsoft Threat Protection
Securiser son digital workplace avec Microsoft Threat Protection☁️Seyfallah Tagrerout☁ [MVP]
 
Securing Systems - Still Crazy After All These Years
Securing Systems - Still Crazy After All These YearsSecuring Systems - Still Crazy After All These Years
Securing Systems - Still Crazy After All These YearsAdrian Sanabria
 
Journey to the Center of Security Operations
Journey to the Center of Security OperationsJourney to the Center of Security Operations
Journey to the Center of Security Operations♟Sergej Epp
 
3 Reasons You Need Proactive Protection Against Malware
3 Reasons You Need Proactive Protection Against Malware3 Reasons You Need Proactive Protection Against Malware
3 Reasons You Need Proactive Protection Against MalwareAkamai Technologies
 
Essentials of Web Application Security: what it is, why it matters and how to...
Essentials of Web Application Security: what it is, why it matters and how to...Essentials of Web Application Security: what it is, why it matters and how to...
Essentials of Web Application Security: what it is, why it matters and how to...Cenzic
 
What CISOs should know about SAP security
What CISOs should know about SAP securityWhat CISOs should know about SAP security
What CISOs should know about SAP securityERPScan
 
Symantec Webinar: What Cyber Threats Are Lurking in Your Network?
Symantec Webinar: What Cyber Threats Are Lurking in Your Network?Symantec Webinar: What Cyber Threats Are Lurking in Your Network?
Symantec Webinar: What Cyber Threats Are Lurking in Your Network?Symantec
 
Managing privileged account security
Managing privileged account securityManaging privileged account security
Managing privileged account securityRaleigh ISSA
 
World best web apps security and Active detection of malicious link
World best web apps security and Active detection of malicious linkWorld best web apps security and Active detection of malicious link
World best web apps security and Active detection of malicious link임채호 박사님
 
Marlabs cyber threat management
Marlabs cyber threat managementMarlabs cyber threat management
Marlabs cyber threat managementRajendra Menon
 
Jak využít cloudu pro zvýšení bezpečnosti vašeho IT
Jak využít cloudu pro zvýšení bezpečnosti vašeho ITJak využít cloudu pro zvýšení bezpečnosti vašeho IT
Jak využít cloudu pro zvýšení bezpečnosti vašeho ITMarketingArrowECS_CZ
 
WHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & HandlingWHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & HandlingAPNIC
 
CIO Summit: Data Security in a Mobile World
CIO Summit: Data Security in a Mobile WorldCIO Summit: Data Security in a Mobile World
CIO Summit: Data Security in a Mobile WorldiMIS
 
CIO Summit: Data Security in a Mobile World
CIO Summit: Data Security in a Mobile WorldCIO Summit: Data Security in a Mobile World
CIO Summit: Data Security in a Mobile WorldiMIS
 
6 Biggest Cyber Security Risks and How You Can Fight Back
6 Biggest Cyber Security Risks and How You Can Fight Back6 Biggest Cyber Security Risks and How You Can Fight Back
6 Biggest Cyber Security Risks and How You Can Fight BackMTG IT Professionals
 

Similar to 2021/0/15 - Solarwinds supply chain attack: why we should take it sereously (20)

Corona| COVID IT Tactical Security Preparedness: Threat Management
Corona| COVID IT Tactical Security Preparedness: Threat ManagementCorona| COVID IT Tactical Security Preparedness: Threat Management
Corona| COVID IT Tactical Security Preparedness: Threat Management
 
Cyber attacks on your SAP S/4HANA systems? So you can stay relaxed. [Webinar]
Cyber attacks on your SAP S/4HANA systems? So you can stay relaxed. [Webinar]Cyber attacks on your SAP S/4HANA systems? So you can stay relaxed. [Webinar]
Cyber attacks on your SAP S/4HANA systems? So you can stay relaxed. [Webinar]
 
2021 01-13 reducing risk-of_ransomware
2021 01-13 reducing risk-of_ransomware2021 01-13 reducing risk-of_ransomware
2021 01-13 reducing risk-of_ransomware
 
2019-06-12 aOS Aix Marseille - B2 - Sécuriser son digital Workplace - Seyfall...
2019-06-12 aOS Aix Marseille - B2 - Sécuriser son digital Workplace - Seyfall...2019-06-12 aOS Aix Marseille - B2 - Sécuriser son digital Workplace - Seyfall...
2019-06-12 aOS Aix Marseille - B2 - Sécuriser son digital Workplace - Seyfall...
 
Securiser son digital workplace avec Microsoft Threat Protection
Securiser son digital workplace avec Microsoft Threat ProtectionSecuriser son digital workplace avec Microsoft Threat Protection
Securiser son digital workplace avec Microsoft Threat Protection
 
Securing Systems - Still Crazy After All These Years
Securing Systems - Still Crazy After All These YearsSecuring Systems - Still Crazy After All These Years
Securing Systems - Still Crazy After All These Years
 
Journey to the Center of Security Operations
Journey to the Center of Security OperationsJourney to the Center of Security Operations
Journey to the Center of Security Operations
 
3 Reasons You Need Proactive Protection Against Malware
3 Reasons You Need Proactive Protection Against Malware3 Reasons You Need Proactive Protection Against Malware
3 Reasons You Need Proactive Protection Against Malware
 
Be the Hunter
Be the Hunter Be the Hunter
Be the Hunter
 
Essentials of Web Application Security: what it is, why it matters and how to...
Essentials of Web Application Security: what it is, why it matters and how to...Essentials of Web Application Security: what it is, why it matters and how to...
Essentials of Web Application Security: what it is, why it matters and how to...
 
What CISOs should know about SAP security
What CISOs should know about SAP securityWhat CISOs should know about SAP security
What CISOs should know about SAP security
 
Symantec Webinar: What Cyber Threats Are Lurking in Your Network?
Symantec Webinar: What Cyber Threats Are Lurking in Your Network?Symantec Webinar: What Cyber Threats Are Lurking in Your Network?
Symantec Webinar: What Cyber Threats Are Lurking in Your Network?
 
Managing privileged account security
Managing privileged account securityManaging privileged account security
Managing privileged account security
 
World best web apps security and Active detection of malicious link
World best web apps security and Active detection of malicious linkWorld best web apps security and Active detection of malicious link
World best web apps security and Active detection of malicious link
 
Marlabs cyber threat management
Marlabs cyber threat managementMarlabs cyber threat management
Marlabs cyber threat management
 
Jak využít cloudu pro zvýšení bezpečnosti vašeho IT
Jak využít cloudu pro zvýšení bezpečnosti vašeho ITJak využít cloudu pro zvýšení bezpečnosti vašeho IT
Jak využít cloudu pro zvýšení bezpečnosti vašeho IT
 
WHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & HandlingWHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & Handling
 
CIO Summit: Data Security in a Mobile World
CIO Summit: Data Security in a Mobile WorldCIO Summit: Data Security in a Mobile World
CIO Summit: Data Security in a Mobile World
 
CIO Summit: Data Security in a Mobile World
CIO Summit: Data Security in a Mobile WorldCIO Summit: Data Security in a Mobile World
CIO Summit: Data Security in a Mobile World
 
6 Biggest Cyber Security Risks and How You Can Fight Back
6 Biggest Cyber Security Risks and How You Can Fight Back6 Biggest Cyber Security Risks and How You Can Fight Back
6 Biggest Cyber Security Risks and How You Can Fight Back
 

More from Sirris

Presentation - webinar embedded machine learning
Presentation - webinar embedded machine learningPresentation - webinar embedded machine learning
Presentation - webinar embedded machine learningSirris
 
2 - Pattyn - Smart Products Webinar 03-02-2023.
2 - Pattyn - Smart Products Webinar 03-02-2023.2 - Pattyn - Smart Products Webinar 03-02-2023.
2 - Pattyn - Smart Products Webinar 03-02-2023.Sirris
 
2021 01-27 - webinar - Corrosie van 3D geprinte onderdelen
2021 01-27 - webinar - Corrosie van 3D geprinte onderdelen2021 01-27 - webinar - Corrosie van 3D geprinte onderdelen
2021 01-27 - webinar - Corrosie van 3D geprinte onderdelenSirris
 
20200923 inside metal am webinar_laborelec
20200923 inside metal am webinar_laborelec20200923 inside metal am webinar_laborelec
20200923 inside metal am webinar_laborelecSirris
 
20200923 inside metal am webinar sirris-crm
20200923 inside metal am webinar sirris-crm20200923 inside metal am webinar sirris-crm
20200923 inside metal am webinar sirris-crmSirris
 
Challenges and solutions for improved durability of materials - Opin summary ...
Challenges and solutions for improved durability of materials - Opin summary ...Challenges and solutions for improved durability of materials - Opin summary ...
Challenges and solutions for improved durability of materials - Opin summary ...Sirris
 
Challenges and solutions for improved durability of materials - Hybrid joints...
Challenges and solutions for improved durability of materials - Hybrid joints...Challenges and solutions for improved durability of materials - Hybrid joints...
Challenges and solutions for improved durability of materials - Hybrid joints...Sirris
 
Challenges and solutions for improved durability of materials - Corrosion mon...
Challenges and solutions for improved durability of materials - Corrosion mon...Challenges and solutions for improved durability of materials - Corrosion mon...
Challenges and solutions for improved durability of materials - Corrosion mon...Sirris
 
Challenges and solutions for improved durability of materials - Concrete in m...
Challenges and solutions for improved durability of materials - Concrete in m...Challenges and solutions for improved durability of materials - Concrete in m...
Challenges and solutions for improved durability of materials - Concrete in m...Sirris
 
Challenges and solutions for improved durability of materials - Coatings done...
Challenges and solutions for improved durability of materials - Coatings done...Challenges and solutions for improved durability of materials - Coatings done...
Challenges and solutions for improved durability of materials - Coatings done...Sirris
 
Futureproof by sirris- product of the future
Futureproof by sirris- product of the futureFutureproof by sirris- product of the future
Futureproof by sirris- product of the futureSirris
 
2018 11-07-verbinden-ongelijksoortige-materialen-hupico multimaterial welding
2018 11-07-verbinden-ongelijksoortige-materialen-hupico multimaterial welding2018 11-07-verbinden-ongelijksoortige-materialen-hupico multimaterial welding
2018 11-07-verbinden-ongelijksoortige-materialen-hupico multimaterial weldingSirris
 
2018 11-07-verbinden-ongelijksoortige-materialen-bil ongelijksoortige materia...
2018 11-07-verbinden-ongelijksoortige-materialen-bil ongelijksoortige materia...2018 11-07-verbinden-ongelijksoortige-materialen-bil ongelijksoortige materia...
2018 11-07-verbinden-ongelijksoortige-materialen-bil ongelijksoortige materia...Sirris
 
2018 11-07-verbinden-ongelijksoortige-materialen-sirris bil-flanders_make_mmj
2018 11-07-verbinden-ongelijksoortige-materialen-sirris bil-flanders_make_mmj2018 11-07-verbinden-ongelijksoortige-materialen-sirris bil-flanders_make_mmj
2018 11-07-verbinden-ongelijksoortige-materialen-sirris bil-flanders_make_mmjSirris
 
2018 11-07-verbinden-ongelijksoortige-materialen-ku leuven-lijmen
2018 11-07-verbinden-ongelijksoortige-materialen-ku leuven-lijmen2018 11-07-verbinden-ongelijksoortige-materialen-ku leuven-lijmen
2018 11-07-verbinden-ongelijksoortige-materialen-ku leuven-lijmenSirris
 
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Lcv lasercladding for...
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Lcv lasercladding for...Slotevent ‘Verbinden van ongelijksoortige materialen’ - Lcv lasercladding for...
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Lcv lasercladding for...Sirris
 
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Juno industries mecha...
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Juno industries mecha...Slotevent ‘Verbinden van ongelijksoortige materialen’ - Juno industries mecha...
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Juno industries mecha...Sirris
 
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Castolin verbinden v...
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Castolin verbinden v...Slotevent ‘Verbinden van ongelijksoortige materialen’ - Castolin verbinden v...
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Castolin verbinden v...Sirris
 
Masterclass Mechatronics 4.0 - Indoor and outdoor localisation and positionin...
Masterclass Mechatronics 4.0 - Indoor and outdoor localisation and positionin...Masterclass Mechatronics 4.0 - Indoor and outdoor localisation and positionin...
Masterclass Mechatronics 4.0 - Indoor and outdoor localisation and positionin...Sirris
 
Invisible but functional - protective coatings
Invisible but functional - protective coatingsInvisible but functional - protective coatings
Invisible but functional - protective coatingsSirris
 

More from Sirris (20)

Presentation - webinar embedded machine learning
Presentation - webinar embedded machine learningPresentation - webinar embedded machine learning
Presentation - webinar embedded machine learning
 
2 - Pattyn - Smart Products Webinar 03-02-2023.
2 - Pattyn - Smart Products Webinar 03-02-2023.2 - Pattyn - Smart Products Webinar 03-02-2023.
2 - Pattyn - Smart Products Webinar 03-02-2023.
 
2021 01-27 - webinar - Corrosie van 3D geprinte onderdelen
2021 01-27 - webinar - Corrosie van 3D geprinte onderdelen2021 01-27 - webinar - Corrosie van 3D geprinte onderdelen
2021 01-27 - webinar - Corrosie van 3D geprinte onderdelen
 
20200923 inside metal am webinar_laborelec
20200923 inside metal am webinar_laborelec20200923 inside metal am webinar_laborelec
20200923 inside metal am webinar_laborelec
 
20200923 inside metal am webinar sirris-crm
20200923 inside metal am webinar sirris-crm20200923 inside metal am webinar sirris-crm
20200923 inside metal am webinar sirris-crm
 
Challenges and solutions for improved durability of materials - Opin summary ...
Challenges and solutions for improved durability of materials - Opin summary ...Challenges and solutions for improved durability of materials - Opin summary ...
Challenges and solutions for improved durability of materials - Opin summary ...
 
Challenges and solutions for improved durability of materials - Hybrid joints...
Challenges and solutions for improved durability of materials - Hybrid joints...Challenges and solutions for improved durability of materials - Hybrid joints...
Challenges and solutions for improved durability of materials - Hybrid joints...
 
Challenges and solutions for improved durability of materials - Corrosion mon...
Challenges and solutions for improved durability of materials - Corrosion mon...Challenges and solutions for improved durability of materials - Corrosion mon...
Challenges and solutions for improved durability of materials - Corrosion mon...
 
Challenges and solutions for improved durability of materials - Concrete in m...
Challenges and solutions for improved durability of materials - Concrete in m...Challenges and solutions for improved durability of materials - Concrete in m...
Challenges and solutions for improved durability of materials - Concrete in m...
 
Challenges and solutions for improved durability of materials - Coatings done...
Challenges and solutions for improved durability of materials - Coatings done...Challenges and solutions for improved durability of materials - Coatings done...
Challenges and solutions for improved durability of materials - Coatings done...
 
Futureproof by sirris- product of the future
Futureproof by sirris- product of the futureFutureproof by sirris- product of the future
Futureproof by sirris- product of the future
 
2018 11-07-verbinden-ongelijksoortige-materialen-hupico multimaterial welding
2018 11-07-verbinden-ongelijksoortige-materialen-hupico multimaterial welding2018 11-07-verbinden-ongelijksoortige-materialen-hupico multimaterial welding
2018 11-07-verbinden-ongelijksoortige-materialen-hupico multimaterial welding
 
2018 11-07-verbinden-ongelijksoortige-materialen-bil ongelijksoortige materia...
2018 11-07-verbinden-ongelijksoortige-materialen-bil ongelijksoortige materia...2018 11-07-verbinden-ongelijksoortige-materialen-bil ongelijksoortige materia...
2018 11-07-verbinden-ongelijksoortige-materialen-bil ongelijksoortige materia...
 
2018 11-07-verbinden-ongelijksoortige-materialen-sirris bil-flanders_make_mmj
2018 11-07-verbinden-ongelijksoortige-materialen-sirris bil-flanders_make_mmj2018 11-07-verbinden-ongelijksoortige-materialen-sirris bil-flanders_make_mmj
2018 11-07-verbinden-ongelijksoortige-materialen-sirris bil-flanders_make_mmj
 
2018 11-07-verbinden-ongelijksoortige-materialen-ku leuven-lijmen
2018 11-07-verbinden-ongelijksoortige-materialen-ku leuven-lijmen2018 11-07-verbinden-ongelijksoortige-materialen-ku leuven-lijmen
2018 11-07-verbinden-ongelijksoortige-materialen-ku leuven-lijmen
 
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Lcv lasercladding for...
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Lcv lasercladding for...Slotevent ‘Verbinden van ongelijksoortige materialen’ - Lcv lasercladding for...
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Lcv lasercladding for...
 
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Juno industries mecha...
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Juno industries mecha...Slotevent ‘Verbinden van ongelijksoortige materialen’ - Juno industries mecha...
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Juno industries mecha...
 
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Castolin verbinden v...
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Castolin verbinden v...Slotevent ‘Verbinden van ongelijksoortige materialen’ - Castolin verbinden v...
Slotevent ‘Verbinden van ongelijksoortige materialen’ - Castolin verbinden v...
 
Masterclass Mechatronics 4.0 - Indoor and outdoor localisation and positionin...
Masterclass Mechatronics 4.0 - Indoor and outdoor localisation and positionin...Masterclass Mechatronics 4.0 - Indoor and outdoor localisation and positionin...
Masterclass Mechatronics 4.0 - Indoor and outdoor localisation and positionin...
 
Invisible but functional - protective coatings
Invisible but functional - protective coatingsInvisible but functional - protective coatings
Invisible but functional - protective coatings
 

Recently uploaded

EY_Graph Database Powered Sustainability
EY_Graph Database Powered SustainabilityEY_Graph Database Powered Sustainability
EY_Graph Database Powered SustainabilityNeo4j
 
Building Real-Time Data Pipelines: Stream & Batch Processing workshop Slide
Building Real-Time Data Pipelines: Stream & Batch Processing workshop SlideBuilding Real-Time Data Pipelines: Stream & Batch Processing workshop Slide
Building Real-Time Data Pipelines: Stream & Batch Processing workshop SlideChristina Lin
 
cybersecurity notes for mca students for learning
cybersecurity notes for mca students for learningcybersecurity notes for mca students for learning
cybersecurity notes for mca students for learningVitsRangannavar
 
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...MyIntelliSource, Inc.
 
Hand gesture recognition PROJECT PPT.pptx
Hand gesture recognition PROJECT PPT.pptxHand gesture recognition PROJECT PPT.pptx
Hand gesture recognition PROJECT PPT.pptxbodapatigopi8531
 
Unit 1.1 Excite Part 1, class 9, cbse...
Unit 1.1 Excite Part 1, class 9, cbse...Unit 1.1 Excite Part 1, class 9, cbse...
Unit 1.1 Excite Part 1, class 9, cbse...aditisharan08
 
BATTLEFIELD ORM: TIPS, TACTICS AND STRATEGIES FOR CONQUERING YOUR DATABASE
BATTLEFIELD ORM: TIPS, TACTICS AND STRATEGIES FOR CONQUERING YOUR DATABASEBATTLEFIELD ORM: TIPS, TACTICS AND STRATEGIES FOR CONQUERING YOUR DATABASE
BATTLEFIELD ORM: TIPS, TACTICS AND STRATEGIES FOR CONQUERING YOUR DATABASEOrtus Solutions, Corp
 
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...kellynguyen01
 
Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...
Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...
Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...soniya singh
 
Advancing Engineering with AI through the Next Generation of Strategic Projec...
Advancing Engineering with AI through the Next Generation of Strategic Projec...Advancing Engineering with AI through the Next Generation of Strategic Projec...
Advancing Engineering with AI through the Next Generation of Strategic Projec...OnePlan Solutions
 
Salesforce Certified Field Service Consultant
Salesforce Certified Field Service ConsultantSalesforce Certified Field Service Consultant
Salesforce Certified Field Service ConsultantAxelRicardoTrocheRiq
 
What is Fashion PLM and Why Do You Need It
What is Fashion PLM and Why Do You Need ItWhat is Fashion PLM and Why Do You Need It
What is Fashion PLM and Why Do You Need ItWave PLM
 
Professional Resume Template for Software Developers
Professional Resume Template for Software DevelopersProfessional Resume Template for Software Developers
Professional Resume Template for Software DevelopersVinodh Ram
 
Adobe Marketo Engage Deep Dives: Using Webhooks to Transfer Data
Adobe Marketo Engage Deep Dives: Using Webhooks to Transfer DataAdobe Marketo Engage Deep Dives: Using Webhooks to Transfer Data
Adobe Marketo Engage Deep Dives: Using Webhooks to Transfer DataBradBedford3
 
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdfThe Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdfkalichargn70th171
 
Project Based Learning (A.I).pptx detail explanation
Project Based Learning (A.I).pptx detail explanationProject Based Learning (A.I).pptx detail explanation
Project Based Learning (A.I).pptx detail explanationkaushalgiri8080
 
Engage Usergroup 2024 - The Good The Bad_The Ugly
Engage Usergroup 2024 - The Good The Bad_The UglyEngage Usergroup 2024 - The Good The Bad_The Ugly
Engage Usergroup 2024 - The Good The Bad_The UglyFrank van der Linden
 
Cloud Management Software Platforms: OpenStack
Cloud Management Software Platforms: OpenStackCloud Management Software Platforms: OpenStack
Cloud Management Software Platforms: OpenStackVICTOR MAESTRE RAMIREZ
 
ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...
ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...
ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...Christina Lin
 

Recently uploaded (20)

EY_Graph Database Powered Sustainability
EY_Graph Database Powered SustainabilityEY_Graph Database Powered Sustainability
EY_Graph Database Powered Sustainability
 
Building Real-Time Data Pipelines: Stream & Batch Processing workshop Slide
Building Real-Time Data Pipelines: Stream & Batch Processing workshop SlideBuilding Real-Time Data Pipelines: Stream & Batch Processing workshop Slide
Building Real-Time Data Pipelines: Stream & Batch Processing workshop Slide
 
cybersecurity notes for mca students for learning
cybersecurity notes for mca students for learningcybersecurity notes for mca students for learning
cybersecurity notes for mca students for learning
 
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
 
Hand gesture recognition PROJECT PPT.pptx
Hand gesture recognition PROJECT PPT.pptxHand gesture recognition PROJECT PPT.pptx
Hand gesture recognition PROJECT PPT.pptx
 
Unit 1.1 Excite Part 1, class 9, cbse...
Unit 1.1 Excite Part 1, class 9, cbse...Unit 1.1 Excite Part 1, class 9, cbse...
Unit 1.1 Excite Part 1, class 9, cbse...
 
BATTLEFIELD ORM: TIPS, TACTICS AND STRATEGIES FOR CONQUERING YOUR DATABASE
BATTLEFIELD ORM: TIPS, TACTICS AND STRATEGIES FOR CONQUERING YOUR DATABASEBATTLEFIELD ORM: TIPS, TACTICS AND STRATEGIES FOR CONQUERING YOUR DATABASE
BATTLEFIELD ORM: TIPS, TACTICS AND STRATEGIES FOR CONQUERING YOUR DATABASE
 
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
 
Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...
Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...
Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...
 
Advancing Engineering with AI through the Next Generation of Strategic Projec...
Advancing Engineering with AI through the Next Generation of Strategic Projec...Advancing Engineering with AI through the Next Generation of Strategic Projec...
Advancing Engineering with AI through the Next Generation of Strategic Projec...
 
Salesforce Certified Field Service Consultant
Salesforce Certified Field Service ConsultantSalesforce Certified Field Service Consultant
Salesforce Certified Field Service Consultant
 
What is Fashion PLM and Why Do You Need It
What is Fashion PLM and Why Do You Need ItWhat is Fashion PLM and Why Do You Need It
What is Fashion PLM and Why Do You Need It
 
Professional Resume Template for Software Developers
Professional Resume Template for Software DevelopersProfessional Resume Template for Software Developers
Professional Resume Template for Software Developers
 
Adobe Marketo Engage Deep Dives: Using Webhooks to Transfer Data
Adobe Marketo Engage Deep Dives: Using Webhooks to Transfer DataAdobe Marketo Engage Deep Dives: Using Webhooks to Transfer Data
Adobe Marketo Engage Deep Dives: Using Webhooks to Transfer Data
 
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdfThe Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
 
Call Girls In Mukherjee Nagar 📱 9999965857 🤩 Delhi 🫦 HOT AND SEXY VVIP 🍎 SE...
Call Girls In Mukherjee Nagar 📱 9999965857 🤩 Delhi 🫦 HOT AND SEXY VVIP 🍎 SE...Call Girls In Mukherjee Nagar 📱 9999965857 🤩 Delhi 🫦 HOT AND SEXY VVIP 🍎 SE...
Call Girls In Mukherjee Nagar 📱 9999965857 🤩 Delhi 🫦 HOT AND SEXY VVIP 🍎 SE...
 
Project Based Learning (A.I).pptx detail explanation
Project Based Learning (A.I).pptx detail explanationProject Based Learning (A.I).pptx detail explanation
Project Based Learning (A.I).pptx detail explanation
 
Engage Usergroup 2024 - The Good The Bad_The Ugly
Engage Usergroup 2024 - The Good The Bad_The UglyEngage Usergroup 2024 - The Good The Bad_The Ugly
Engage Usergroup 2024 - The Good The Bad_The Ugly
 
Cloud Management Software Platforms: OpenStack
Cloud Management Software Platforms: OpenStackCloud Management Software Platforms: OpenStack
Cloud Management Software Platforms: OpenStack
 
ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...
ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...
ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...
 

2021/0/15 - Solarwinds supply chain attack: why we should take it sereously

  • 1. SolarWinds supply chain attack: why we should take it seriously Analysis, discussion and mitigation By Patrick Coomans (Agoria, Sirris) and Tatiana Galibus (Sirris)
  • 2. How to categorize this type of attack 2© sirris | www.sirris.be | info@sirris.be | 15/01/2021 Known knowns Known Unknowns Unknown Unknowns
  • 3. The story of SunBurst: global intrusion campaign ▪ When? we can trace up to October 2019-June 2020, detected in December. ▪ How? SolarWinds, Orion IT management software, normal update ▪ Who is affected? 18 000 companies affected, government, consulting, technology, telecom and extractive entities in North America, Europe, Asia and the Middle East. ▪ …and Belgium too ▪ What can it do? Surveillance and execute random code
  • 4. 3 key takeaways ➢Is it possible to keep track of new attack types? ➢How to provide supply chain security? ➢Why it is crucial to keep the logs and info for a long time?
  • 5. How does it work? ▪ Source code was modified and the style was mimicked ▪ SUNSPOT is used to insert the SUNBURST backdoor into the Orion build through hijacking MsBuild.exe process. ▪ Target source code is modified before it has been read by the compiler. ▪ Hides by obfuscation ▪ SolarWinds.Orion.Core.BusinessLayer.dll is a malware base ▪ DNS beaconing to Command and Control
  • 7. How to detect it? FireEye recommendations ❖ Yara rules to detect TEARDROP ❖ querying internet-wide scan data sources for an organization’s hostnames ❖ impossible rate of travel if a compromised account is being used ❖ LogonTracker module to graph all logon activity ❖ monitor existing scheduled tasks for temporary updates Stellar particle
  • 8. Official recommendations: https://www.solarwinds.com/securityadvisory ➢ Versions affected: Orion Platform 2019.4 HF5, version 2019.4.5200.9083 Orion Platform 2020.2 RC1, version 2020.2.100.12219 Orion Platform 2020.2 RC2, version 2020.2.5200.12394 Orion Platform 2020.2, version 2020.2.5300.12432 Orion Platform 2020.2 HF1, version 2020.2.5300.12432 ➢ Incidents with abuse of Security Assertion Markup Language (SAML) tokens consistent with attack and no SolarWinds instances. Follow-up the updates! ➢ If SAML abuse is identified, simply mitigating individual issues, systems, servers, accounts will not lead to the adversary’s removal from the network. In such cases, organizations should consider the entire identity trust store as compromised.
  • 9. Tools to identify infiltration: https://us-cert.cisa.gov/ncas/alerts/aa20-352a • Sparrow.ps1 to help detect possible compromised accounts and applications in the Azure/M365 environment. Sparrow focuses on the identity- and authentication-based attacks https://github.com/cisagov/Sparrow. • Impossible logins, Long SAML token validity, same creation and use timestamp, tokens with missing MFA details • Check the public list of Indicators of compromise (malicious domain, IPv4 or hash)
  • 10. Immediate mitigations ▪ utilize Orion Platform release 2020.2.1 HF 1 ▪ Ensure that SolarWinds servers are isolated / contained ▪ If SolarWinds infrastructure is not isolated, restrict scope of connectivity and admin accounts, block outcoming traffic for endpoints with SolarWinds software. ▪ Consider (at a minimum) changing passwords for accounts that have access to SolarWinds servers / infrastructure. ▪ Consider a review of network configurations if Orion management software was used. ▪ Review federation trusts & OAuth application & service principal credentials: https://msrc- blog.microsoft.com/2020/12/13/customer-guidance-on- recent-nation-state-cyber-attacks/
  • 11. Lessons learnt ▪ Diligently performing updates improves security? Not always! ▪ The most high-profile victim is the US government: no one is protected from highly sophisticated attack ▪ One of the biggest ever cyber- attacks: removing is highly complex and challenging ▪ Be aware, stay informed, keep the logs
  • 12. TIPS: ASSUME BREACHED – prepare response 12© sirris | www.sirris.be | info@sirris.be | 15/01/2021 1. Asset inventory • You cannot protect what you don’t know: understand the attack surface, your keys to the kingdom • Data, Applications, Devices • Know what was installed, used, or connected to your network and when: keep a trace
  • 13. TIPS: ASSUME BREACHED – prepare response 13© sirris | www.sirris.be | info@sirris.be | 15/01/2021 2. Logging • You can never have enough logging • Store logs securely, retain them as long as possible, up to 18 months if you can • DNS, DHCP, firewalls, routers, WiFi, application servers, access points, authentication logs, EDR logs, … • Make sure NOT to log passwords, identities, PII in clear text!!
  • 14. TIPS: ASSUME BREACHED – prepare response 14© sirris | www.sirris.be | info@sirris.be | 15/01/2021 3. File integrity monitoring • For servers, containers, … • Track changes to critical configuration files, scheduled tasks, scripts
  • 15. TIPS: ASSUME BREACHED – prepare response 15© sirris | www.sirris.be | info@sirris.be | 15/01/2021 4. Network flow • Keep traffic metadata (netflow) (check Elastic Stack, Zeek.org, or commercial software) • Full packet capture for critical applications / cases (check Arkime, Wireshark, …)
  • 16. TIPS: ASSUME BREACHED – prepare response 16© sirris | www.sirris.be | info@sirris.be | 15/01/2021 5. Keep spam & phishing filter content • Best: archive ALL e-mail • Good: archive all suspicious, filtered or flagged mail, including mails that have been released by users
  • 17. PREVENTIVE MEASURES 17© sirris | www.sirris.be | info@sirris.be | 15/01/2021 1. Know and reduce your attack surface area • Know what is on your network (Asset inventory, internal vulnerability scanning, …) • Know what is exposed publicly (External scanning, e.g. Sweepatic) • Remove or disable unused or unnecessary applications, services or data • Archive or remove data that is not longer needed • Leave deception beacons lingering around
  • 18. PREVENTIVE MEASURES 18© sirris | www.sirris.be | info@sirris.be | 15/01/2021 2. Network Detection and Response • Egress traffic filtering • Understand your traffic, identify top talkers, identify anomalies in traffic patterns • Deploy deception technology, honeypots
  • 19. PREVENTIVE MEASURES 19© sirris | www.sirris.be | info@sirris.be | 15/01/2021 3. Strict patching and endpoint protection • Active exploitation of 0-day vulnerabilities often starts within 4-8 hours, so immediately patch high-risk vulnerabilities • Deploy decent enterprise-grade EDR software on all endpoints • Decommission what can’t be patched (out of support)
  • 20. PREVENTIVE MEASURES 20© sirris | www.sirris.be | info@sirris.be | 15/01/2021 4. Segmentation • Segment off critical assets, old assets, endpoints, IoT devices, … • Use a zero-trust security architecture
  • 21. PREVENTIVE MEASURES 21© sirris | www.sirris.be | info@sirris.be | 15/01/2021 5. Authentication & Authorization • Least privilege where possible • MFA for at least all key staff, people with elevated privileges
  • 22. How Sirris/Agoria can help you? Contact us for a free 1hr intake Opt for a collective workshop to strengthen solid foundations. Choose 1 or 2-day orienting advise in order to take advantage of our expertise combining both manufacturing and IT technology Are you protected or dangerously exposed?
  • 23. Roadmap to cyber security Free 1hr intake Collective initiatives Master class Learning network Orienting advise Maturity level Security scan Action plan
  • 24. Upcoming events: Sirris+Agoria ▪ Master Class Cyber Security in 30 Steps Jan, 20th, 2021 ▪ Internal IT Security, Basic Cyber Resilience, Cyber Hygiene ▪ Kick-off 20/01, then 3 sessions on 27/01, 10/02 and 10/03. ▪ Master Class Security for Digital Service Builders Jan, 26th and Feb, 2nd 2021 ▪ DevSecOps, AppSec, OWASP, security pipeline ▪ 2 half-days, 8:30-12:00 ▪ Learning Network Security in Manufacturing Q2 2021 ▪ Demand-driven topics: anomalities in OT, changing perception of security as cost ▪ Webinar: Trusted Mobile Apps Feb 2021 ▪ Webinar: OT security in Manufacturing Feb 2021 ▪ Webinar: Cyber security in digital services, March 2021 ▪ Thematic Event: CS meets Manufacturing Q1,2021