Friends or foes? Sino-American relations in Cyberspace

Published:

It may seem to some that China and America are experiencing a rapprochement of sorts in the cyber realm. Compared to previous years, today there are are markedly fewer headlines about breaches of American public and private institutions by the hands of Chinese hackers. Overall, there are fewer indictments being thrown at members of the People’s Liberation Army (PLA) and the level of political and economic sanctions being prepared against Chinese organisations and individuals has fallen since 2014/2015.

Continue reading

The Stacked Vulnerabilities Behind Mega-breaches

Published:

On the 23rd October 2015, it became public knowledge that 156,959 TalkTalk customers had their personal data exposed due to the insecure retention of customer records.

The breach dealt a major reputational blow to the telecommunications provider, and for many, the company has joined a growing list of brands that are now synonymous with a major breach of personal data.

Continue reading

The dark reality of cyberspace: the case of CVE-2017-0199

Published:

Threat actors do not exist in a cyber vacuum. Hackers, organised criminal gangs, and nation states all operate within the same cyberspace and have access to the same systems and vulnerabilities. Whilst the tactics, techniques and procedures (TTPs) vary between different threat actor categories (in  terms of method, capability and sophistication), the infection vectors they target remain the same.

Continue reading
Intelligence led security testing

The Benefits of Intelligence-led Security Testing

Published:

The UK’s Ministry of Defence defines intelligence as the directed and co-ordinated acquisition and analysis of information to assess capabilities, intent and opportunities for exploitation by decision-makers at all levels.

Information, on the other hand, is defined as unprocessed data of every description that may be used in the production of intelligence.

I describe intelligence as actionable information

The key question to ask when presented with ‘intelligence’ is:

“what can I do with it?”

Continue reading

Only Human: Protecting Against Unwitting Insider Threats

Published:

Within the corporate world, the spectre of insider threat is one that is difficult to come to terms with. A malicious insider in an organisation has, by virtue of their position, access to privileged information and functionality that an outside attacker would be able to leverage only with great difficulty.

Continue reading

Election Hacking: an old threat in new clothes

Published:

There is a general consensus that Russia interfered in the 2016 US Presidential Elections. According to the US intelligence community, it has been assessed with ‘high confidence’ that Russia used nation state proxy groups to influence the outcome of the presidential election in favour of Donald Trump.

Continue reading

The Weakest Link: The Supply Chain as an Intrusion Vector

Published:

In April 2017, PwC and BAE Systems released a report that investigated the activities of a Chinese advanced persistent threat (APT) actor, known as APT10 or Stone Panda (amongst other things).

The report assesses that this group’s primary technique is to target managed service providers (MSPs) as a pivot point to gain a foothold into the network of their clients. In other words, this threat actor is using the supply chain as the infection vector into their target’s environment.

Continue reading
Convergence of Cybercrime and Traditional Crime

The Convergence of Cybercrime and Traditional Crime

Published:

It’s easy to forget that cybercrime is a relatively new term that didn’t exist 30 years ago. Today, excluding some violent crimes, it appears that almost every conceivable crime can have a cyber element to it.  Cybercrime can be described as any illegal activity that is dependent on a computer or network-connected device.  But as devices are increasingly network connected, could we see a blurring of the line between traditional crime and cybercrime?

Continue reading