Posts by John Reeman
Endpoint Security Part 5: How to setup an automated isolation workflow when malware is detected
In this continuing series on endpoint security protections I’ll be showing you how to fully automate host isolation using ‘Tines’ and ‘Elastic’. This article assumes you are familiar with using Elastic SIEM and have some exposure to Tines. Tines is a smart automation workflow solution that I came across last year. What I like about…
READ MORE >>Endpoint Security Part 4: How to create a playbook to isolate a machine and alert your SOC team
Overview In this fourth article of a 5 part series on ‘Endpoint Security’ I’m going to be showing you how to create a rule in your Elastic SIEM to generate an alert and isolate a host if the presence of malware is detected. Step One – Create the detection rule In your Kibana console select:…
READ MORE >>Endpoint Security Part 3: How to correlate threat intelligence
Overview In this third article of a 5 part series on ‘Endpoint Security’ I’m going to be showing you how you can incorporate ‘Threat Intelligence’ into your security operations strategy. There has been a lot written about threat intelligence over the last decade and it has different meanings to people depending on what industry you…
READ MORE >>What you should be doing when you receive an unsolicited One Time Passcode
If you receive an unsolicited One Time Passcode (OTP) for a service that you use, either as an SMS or Email you should be concerned and act immediately! Why should I be concerned? This basically means that your credentials have been stolen and someone is trying to gain access to your account. The only reason…
READ MORE >>Endpoint Security Part 2: Enriching your security event data
In this second part series on ‘Endpoint Security’ I’m going to delve into how you can enrich your security event data to provide further context to assist your security analysts when investigating incidents. In this example we will lead off where we ended from ‘Endpoint Security Part 1’ and so if you were following the…
READ MORE >>Top targeted vulnerabilities of 2023: STOP this madness
In 2023 the top 10 targeted vulnerabilities used by threat actors to actively exploit victims were more than 10 years old! In order of CVE ranking we have: CVE-2017-0199 – Microsoft Office and Worpad CVE-2017-11882 – Microsoft Exchange Server CVE-2020-1472 – Microsoft NetLogon CVE-2012-1461 – GZIP file parser utility I would really like to know…
READ MORE >>Endpoint Security Part1: Collecting the essential security events for your windows systems
Beware of new Ransomware Tactic
2 days ago ALPHV/BlackCat in a bid to apply further pressure to get their latest victim MeridanLink to pay, filed a compliant against them with the U.S. Securities and Exchange Commission (SEC) for failing to report a breach! This is an interesting tactic and will apply even more pressure on organisations, CISOs’ and Boards to…
READ MORE >>Cyber Resilience – Are you prepared?
In this 4 min video clip, I share my top 5 practical strategies that you should be adopting as an organisation to remain cyber resilient. Whilst there is no silver bullet these should reduce risk and keep you safe from cyber crime attacks such as ransomware.
READ MORE >>Everything you need to know about IRAP
Introduction In this article I will take you through everything you need to know about an IRAP assessment and how to successfully achieve IRAP Accreditation; what it is, what’s involved, why it’s important and a checklist of things you will need to do to kick start your IRAP journey. What is the Information Security…
READ MORE >>