Author: Robert Timlick

  • Want to Grow Vulnerability Management into Exposure Management? Start Here!

    Want to Grow Vulnerability Management into Exposure Management? Start Here!

    Vulnerability Management (VM) has long been a cornerstone of organizational cybersecurity. Nearly as old as the discipline of cybersecurity itself, it aims to help organizations identify and address potential security issues before they become serious problems. Yet, in recent years, the limitations of this approach have become increasingly evident. 
    At its core, Vulnerability Management
  • Hackers Target Uyghurs and Tibetans with MOONSHINE Exploit and DarkNimbus Backdoor

    Hackers Target Uyghurs and Tibetans with MOONSHINE Exploit and DarkNimbus Backdoor

    A previously undocumented threat activity cluster dubbed Earth Minotaur is leveraging the MOONSHINE exploit kit and an unreported Android-cum-Windows backdoor called DarkNimbus to facilitate long-term surveillance operations targeting Tibetans and Uyghurs.
    “Earth Minotaur uses MOONSHINE to deliver the DarkNimbus backdoor to Android and Windows devices, targeting WeChat, and possibly making it a
  • Cyber Experts Say You Should Use These Best Practices for Event Logging

    Cyber Experts Say You Should Use These Best Practices for Event Logging

    Today’s businesses are no stranger to the word cybersecurity. They are facing a growing wave of cyberattacks. These come from ransomware to sophisticated phishing schemes. How do you stand ahead of these threats? A strong cybersecurity strategy is essential. One crucial component of this strategy is event logging. It’s one that not every business owner is aware of.

    Think of event logging as a digital detective. What does tracking activities and events across your IT systems do? It helps you spot potential security breaches and respond swiftly. As your managed IT service provider, we’re committed to helping you. We can help you understand the importance of event logging as well as how to put in place best practices to safeguard your network.

    What Is Event Logging?

    Event logging is the act of tracking all events that happen within your IT systems. “Event” can be many different things, such as:

    • Login attempts
    • File access
    • Software installs
    • Network traffic
    • Denial of access
    • System changes
    • And many others

    Event logging means to track all these and add a time stamp. This provides a robust picture of what is going on in your IT ecosystem. It’s through that ongoing picture that you can detect and respond to threats promptly.

    Why is it critical to track and log all these events?

    • Detect suspicious activity by monitoring user behavior and system events.
    • Respond quickly to incidents by providing a clear record of what happened in a breach.
    • Meet regulations that require businesses to maintain accurate records of system activities.

    Best Practices to Use Event Logging Effectively

    Event logging is most effective when you follow best practices. Here are some standard guidelines to follow. These are helpful if you’re just starting out as well as for those improving existing event-logging processes.

    Log What Matters Most

    Let’s be honest: You don’t need to track every digital footstep.  Logging every single action on your network can create a mountain of data that’s hard to sift through. Instead, focus on the events that truly matter. These are those that can reveal security breaches and compliance risks.

    The most important things to log are:

    • Logins and Logouts: Keep tabs on who’s accessing your systems and when. This includes failed attempts, password changes, and new user accounts.
    • Accessing Sensitive Data: Track who’s peeking at your most valuable information. Logging file and database access helps spot unauthorized snooping.
    • System Changes: Keep a record of any changes to your system. Including software installations, configuration tweaks, and system updates. This helps you stay on top of changes and identify potential backdoors.

    Event logging is much more manageable when you start with the most critical areas. This also makes it easier for small businesses.

    Centralize Your Logs

    Imagine trying to solve a puzzle with pieces scattered across different rooms. It’s chaos! That is what happens when you try to work with several logs for different devices and systems. Centralizing your logs is a game-changer. A Security Information and Event Management (SIEM) gathers logs in one place. This includes those from various devices, servers, and applications.

    This makes it easier to:

    • Spot patterns: Connect the dots between suspicious activities across different systems.
    • Respond faster: Have all the evidence you need at your fingertips. This is helpful when an incident strikes.
    • Get a complete picture: See your network as a whole. This makes it easier to identify vulnerabilities.

    Ensure Logs Are Tamper-Proof

    It’s important to protect your event logs! Attackers love to cover their tracks by deleting or altering logs. That’s why it’s vital to make your logs tamper-proof.

    Here are some tips:

    • Encrypt your logs: Lock them down with encryption. This makes them unreadable to unauthorized eyes.
    • Use WORM storage: Once a log is written, it’s locked in place, preventing changes or deletions.
    • Use strong access controls: Limit who can see and change your logs to trusted personnel only.

    Tamper-proof logs provide an accurate record of events even if a breach occurs. They also keep the bad guys from seeing all your system activity tracking.

    Establish Log Retention Policies

    Keeping logs forever isn’t practical (or always necessary). But deleting them too soon can be risky, too. That’s why you need clear log retention policies. 

    Here are some things to consider:

    • Compliance requirements: Some industries have specific rules about how long to keep logs.
    • Business needs: How long do you need logs to investigate incidents or for auditing?
    • Storage capacity: Make sure your log retention policy doesn’t overwhelm your storage.

    Strike the right balance with retention. You want to ensure you have the data you need without sacrificing performance.

    Check Logs Regularly

    Event logging is only as good as your ability to use it. Don’t “set and forget” your logs. You should check them regularly. This helps you spot anomalies and identify suspicious patterns. It also helps you respond to threats before they cause serious damage. Use security software to help automate this process.

    Here’s how to do it effectively:

    • Set up automated alerts: Get notified immediately of critical events. Such as failed logins or unauthorized access.
    • Perform periodic reviews: Dive into your logs regularly. Look for patterns that might show a threat.
    • Correlate events: Use your SIEM to connect the dots between different activities. It can reveal more complex attacks.

    Need Help with Event Logging Solutions?

    As a trusted managed IT service provider, we’re here to support you. We can help you install these practices and ensure your business stays protected.

    Give us a call or email to schedule a chat.

    —

    Featured Image Credit

    This Article has been Republished with Permission from The Technology Press.

  • Cisco Warns of Exploitation of Decade-Old ASA WebVPN Vulnerability

    Cisco Warns of Exploitation of Decade-Old ASA WebVPN Vulnerability

    Cisco on Monday updated an advisory to warn customers of active exploitation of a decade-old security flaw impacting its Adaptive Security Appliance (ASA).
    The vulnerability, tracked as CVE-2014-2120 (CVSS score: 4.3), concerns a case of insufficient input validation in ASA’s WebVPN login page that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack
  • NachoVPN Tool Exploits Flaws in Popular VPN Clients for System Compromise

    NachoVPN Tool Exploits Flaws in Popular VPN Clients for System Compromise

    Cybersecurity researchers have disclosed a set of flaws impacting Palo Alto Networks and SonicWall virtual private network (VPN) clients that could be potentially exploited to gain remote code execution on Windows and macOS systems.
    “By targeting the implicit trust VPN clients place in servers, attackers can manipulate client behaviours, execute arbitrary commands, and gain high levels of access
  • North Korean Kimsuky Hackers Use Russian Email Addresses for Credential Theft Attacks

    North Korean Kimsuky Hackers Use Russian Email Addresses for Credential Theft Attacks

    The North Korea-aligned threat actor known as Kimsuky has been linked to a series of phishing attacks that involve sending email messages that originate from Russian sender addresses to ultimately conduct credential theft.
    “Phishing emails were sent mainly through email services in Japan and Korea until early September,” South Korean cybersecurity company Genians said. “Then, from mid-September,
  • Horns&Hooves Campaign Delivers RATs via Fake Emails and JavaScript Payloads

    Horns&Hooves Campaign Delivers RATs via Fake Emails and JavaScript Payloads

    A newly discovered malware campaign has been found to target private users, retailers, and service businesses mainly located in Russia to deliver NetSupport RAT and BurnsRAT.
    The campaign, dubbed Horns&Hooves by Kaspersky, has hit more than 1,000 victims since it began around March 2023. The end goal of these attacks is to leverage the access afforded by these trojans to install stealer
  • A Guide to Securing AI App Development: Join This Cybersecurity Webinar

    A Guide to Securing AI App Development: Join This Cybersecurity Webinar

    Artificial Intelligence (AI) is no longer a far-off dream—it’s here, changing the way we live. From ordering coffee to diagnosing diseases, it’s everywhere. But while you’re creating the next big AI-powered app, hackers are already figuring out ways to break it.
    Every AI app is an opportunity—and a potential risk. The stakes are huge: data leaks, downtime, and even safety threats if security
  • SmokeLoader Malware Resurfaces, Targeting Manufacturing and IT in Taiwan

    SmokeLoader Malware Resurfaces, Targeting Manufacturing and IT in Taiwan

    Taiwanese entities in manufacturing, healthcare, and information technology sectors have become the target of a new campaign distributing the SmokeLoader malware.
    “SmokeLoader is well-known for its versatility and advanced evasion techniques, and its modular design allows it to perform a wide range of attacks,” Fortinet FortiGuard Labs said in a report shared with The Hacker News.
    “While
  • THN Recap: Top Cybersecurity Threats, Tools and Tips (Nov 25 – Dec 1)

    THN Recap: Top Cybersecurity Threats, Tools and Tips (Nov 25 – Dec 1)

    Ever wonder what happens in the digital world every time you blink? Here’s something wild – hackers launch about 2,200 attacks every single day, which means someone’s trying to break into a system somewhere every 39 seconds.
    And get this – while we’re all worried about regular hackers, there are now AI systems out there that can craft phishing emails so convincingly, that even cybersecurity