Nikhil Mittal

𝐈𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐏𝐨𝐥𝐢𝐜𝐲 𝐅𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤 Categorising various policies into three main domains 🔹 𝐓𝐞𝐜𝐡𝐧𝐢𝐜𝐚𝐥 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐏𝐨𝐥𝐢𝐥𝐜𝐲 Access Control Policy Encryption Policy Boundary Protection Policy Legacy IT Hardware & Software Security Policy Forensic Readiness Policy Secure Configuration Policy Patching Policy Hardware & Software Security Policy Protective Monitoring Policy Network Security Policy Telecommunications Policy Cloud Security Policy AV Malware Policy Application Security Policy Identification & Authentication Policy Back-Up Policy 🔹𝐎𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐩𝐨𝐥𝐢𝐜𝐲 This domain addresses the day-to-day processes and procedures that ensure secure operations. Key policies include: Acceptable Use Policy Clear Desk & Screen Policy Data Handling Policy Mobile & Remote Working Policy Password Management Policy Removable Media Policy Sanitisation, Reuse, Disposal & Destruction Policy Business Continuity Policy Bring Your Own Device Policy Disaster Recovery Policy Social Media Policy 🔹𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 𝐩𝐨𝐥𝐢𝐜𝐲 Education & Awareness Policy Information Security Incident Policy Asset Management Policy Audit Policy Vulnerability Assessment Policy Supply Chain Security Policy System Acquisition Policy Contract & Supplier Security Policy 🔹𝐏𝐨𝐥𝐢𝐜𝐲 𝐇𝐢𝐞𝐫𝐚𝐫𝐜𝐡𝐲 𝐚𝐧𝐝 𝐑𝐞𝐥𝐚𝐭𝐢𝐨𝐧𝐬𝐡𝐢𝐩𝐬 -The Information Security Policy sits at the core, informed by Information Governance, Physical Security, and Personnel Security Policies. -Information Security Classification supports the implementation of all three domains. -Each domain contains specific policies that address different aspects of information security, ensuring a comprehensive and layered approach. 𝐃𝐢𝐬𝐜𝐥𝐚𝐢𝐦𝐞𝐫 - This post has only been shared for an educational and knowledge-sharing purpose related to Technologies. #technology #learning #cybersecurity #ciso

569

14 Comments

🛡️ Must-Know SOC Log Types 🖥️ System Logs Track OS-level events like startups, shutdowns, and system errors. 📲 Application Logs Monitor application performance, user activity, and error messages. 🌐 Network Logs Capture network traffic data to detect intrusions and anomalies. 💻 Endpoint Logs Log activities on user devices—crucial for identifying threats at the edge. 🛡️ Security Logs Record authentication attempts, access controls, and policy violations. ☁️ Cloud Logs Offer visibility into cloud service usage, changes, and potential misconfigurations. 📊 Why It Matters? Understanding different log types enables more effective threat detection, faster incident response, and better compliance with security standards. #InfoSec #CyberSe #Security #DataSecurity #ITSecurity #NetworkSecurity #InformationSecurity #CyberProtection #CyberDefense #OnlineSafety #CyberAwareness #CyberAttack #HolidayCyberThreats #CyberSecurity #CyberAwareness #IncidentResponse #Phishing #Ransomware #DataProtection #BusinessSecurity #DigitalSafety #cybercrime #VPN #CyberSecurity #OnlinePrivacy #DataSecurity #RemoteWork #DigitalTransformation #SecureBrowsing #Encryption #TechTips #CloudSecurity #OnlineSafety #Networking #InternetFreedom #VPNProtocols #TechInsights #SecureWiFi #PrivacyFirst #CyberAware #InfoSec #Security #DataSecurity #ITSecurity #NetworkSecurity #InformationSecurity #CyberProtection

131

As a cybersecurity professional, I have set strict security rules at home, covering both cybersecurity and physical security aspects. Here are some key policies I follow: 1. Digital Security •Two-Factor Authentication(2FA) is enabled on all critical accounts. •Regular updates for the operating system, software, and security frameworks. •Strong, unique passwords are managed through a password manager. •Internet connections always go through a secure VPN, especially on public Wi-Fi. •No downloads or clicks on suspicious files or links. Sensitive data is encrypted on storage devices. •Logs and access records are monitored for any unusual activity. 2. Physical Security •All devices are locked with strong passwords or biometrics when not in use. •Security cameras are installed, with access restricted. •Doors and windows remain locked, particularly when leaving the house. •Sensitive documents are securely shredded before disposal. 3. Personal and Family Data Protection •No sharing of real-time locations on social media. •Only trusted applications are installed on personal and work devices. •Family members are educated about social engineering and phishing threats. 4. IoT and Home Network Security •Smart devices (e.g., cameras, smart assistants) are on a separate network. •Default passwords for all routers and IoT devices are changed immediately. •Unnecessary features like UPnP and WPS are disabled on the router. 5. Emergency Preparedness •A data recovery plan is in place with encrypted offline backups. •Clear action steps are defined in case of a data breach or cyberattack. These security measures ensure both personal safety and cyber resilience at home. Do you have any specific security rules for your home. این‌ها قوانینی هستند که در خانه اجرا می‌کنم تا هم امنیت شخصی و هم امنیت سایبری در سطح بالایی حفظ شود. تو هم قوانینی برای امنیت خانه خودت داری؟ — CISO as a Service — | Strategic Cyber Defense & GRC Resilient Through Knowledge 2025.03.26

170

8 Comments

Oracle Got Hacked — Then Said “It's all lies, We’re Fine” So last Thursday Oracle FINALLY acknowledged that they had suffered two significant data breaches. The first breach allegedly exposed SSO credentials, sensitive data from over 140,000 cloud tenants and an estimated 6 million records leaked. A hacker going by "rose87168" claimed responsibility. The second breach hit Oracle Health (formerly Cerner), with unauthorized access to legacy servers and patient data exposure. Now its pretty embarrassing when a tech giant such as Oracle gets hacked but what makes this particular situation even worse is how they responded when asked about the data breaches. You see, Oracle had initially denied reports of a breach in their cloud infrastructure. In response to claims that a hacker had stolen approximately 6 million records from Oracle Cloud, the company stated: "There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data" However, subsequent investigations and reports indicated that Oracle had infact privately acknowledged a security incident to select clients. The company informed some customers that an attacker had accessed a "legacy environment" not in use for eight years, leading to the theft of old client log-in credentials. In other words, Oracle knew they had suffered data breaches and yet refused to publicly acknowledge it while in secret, informing a select few of their clients. Why does this matter? Denial-first response models undermine trust, both with customers and internal teams. Also, Incident response isn't just about fixing the breach — it’s about how you communicate. Transparency matters more than spin, especially in the infosec community This is a textbook example of why we need strong internal processes, honest communication, and better decommissioning of legacy systems. Because eventually, the truth always leaks — just like the data.

213

32 Comments

🛡️ Periodic Table of Cybersecurity – What’s in the Mix? 🔴 Threats – The attackers: phishing, malware, ransomware, and DDoS. 👁️ These are what your systems face every day on the front lines. 🟠 Vulnerabilities – The weak spots: unpatched software, insecure defaults, injection flaws. 👁️ These give attackers a way in — if you don’t catch them first. 🟢 Tools – The gear: Nmap, Metasploit, Burp Suite, Hydra, and more. 🛠️ Used by red teams, blue teams, and defenders alike. 🔵 Frameworks & Standards – The rules: MITRE ATT&CK, ISO 27001, NIST CSF, OWASP. 📏 These guide how we build secure systems and measure risk. ⚪ Concepts & Operations – The process: threat intel, patching, monitoring, and security posture. 🧠 This is how mature security teams operate daily. ⚫ Defensive Measures – The shields: firewalls, VPNs, MFA, SIEM, encryption. 🛡️ These keep threats out and data in. ⬛ Roles & Protocols – The people and practices: SOC analysts, red teamers, CISOs, IAM. 💼 These are the humans running the mission. 🚨 Cybersecurity isn’t one tool or one person — it’s a full ecosystem. This table visualizes it all, from strategy to execution. 🛡️ At Cybernara, we help companies build and defend that entire ecosystem — with expert teams, proven frameworks, and modern security operations. 📞 Want a stronger security foundation? Contact Cybernara today. #CyberSecurity #Threats #Tools #RedTeam #BlueTeam #SecurityOperations #Frameworks #SIEM #SOC #PeriodicTable #Cybernara #CyberAwareness #TechSimplified #Infosec #CISO #MFA #NIST #MITRE #ZeroTrust #DataProtection

2,289

34 Comments

Ultimate Guide to Penetration Testing by Bugcrowd. 🔐 Penetration Testing: Beyond Compliance, Towards Resilience Penetration testing isn’t just a checkbox for compliance—it’s a critical security practice that helps organizations stay ahead of real-world threats. According to NIST, pen testing is “security testing in which assessors mimic real-world attacks to identify methods for circumventing security features.” In simpler terms: it’s about thinking like an attacker before an attacker does. 📌 Key Takeaways from Modern Pen Testing Approaches: Traditional pen tests are often slow, limited in scope, and miss high-risk vulnerabilities. Pen Testing as a Service (PTaaS) is changing the game—bringing agility, scalability, and continuous coverage. Crowdsourced testing leverages the global hacker community, uncovering 7x more critical vulnerabilities than traditional methods. Combining pen testing + bug bounty programs creates a layered defense strategy that balances compliance and proactive risk reduction. 👉 As cyber threats evolve, organizations must move beyond “checklist security” and embrace continuous, high-impact testing to safeguard assets, data, and reputation. 💡 Question to my network: How often do you think organizations should run penetration tests in today’s fast-moving DevSecOps environment—quarterly, monthly, or continuously? #CyberSecurity #PenetrationTesting #RedTeam #BugBounty #PTaaS #GRC #ThreatIntelligence #InfoSec #EthicalHacking #AppSec #CloudSecurity #NetworkSecurity #VAPT #OffensiveSecurity #SOC #CISO #CyberResilience #RiskManagement #ThreatHunting #CyberAwareness #ISO27001 #NIST #ZeroTrust #DataProtection #SecurityTesting #SecurityCompliance #DevSecOps

70

2 Comments

HyperDbg: A free debugger for Fuzzing and Reversing! An open-source, hypervisor-assisted debugger designed for reverse engineering, malware analysis, fuzzing, and kernel debugging. Instead of relying on any APIs and software debugging mechanisms, it leverages Extended Page Tables (EPT), also known as Second Layer Page Tables, to gain low-level visibility and control over both kernel-mode and user-mode execution. • Hidden and inline EPT hooks • Kernel-level memory monitoring • SYSCALL/SYSRET/CPUID/RDTSC hooking • Powerful kernel-side scripting • Transparent debugging (anti-debug evasion) • Support for symbols and PDB parsing • PCI/PCIe space inspection and IDT/APIC dumping • Extensive customization and scripting options It also features a powerful and efficient scripting engine that runs entirely in kernel space, enabling deep, low-level automation without relying on user-mode components. Source: https://lnkd.in/g7xgsziW Instead of looking at long, complicated logs or system events, data analysis can highlight what’s unusual or suspicious, like strange behavior from a program, hidden activity in memory, or unusual system changes. Discover over 10+ essential data analysis techniques for effective threat hunting in my "Cyber Threat Hunt 101" YouTube series, explained simply: https://lnkd.in/gkVB6B2j Please share and subscribe if you enjoy the content! #cybersecurity #threathunting #threatdetection #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #DataAnalysis #IncidentResponse

52

2 Comments

Yesterday’s phishing tricked users. Today’s phishing tricks the browser.    For years, attackers chased:     Passwords.     Fake login pages.     OTP theft.    But with agentic browsers, they don’t need these anymore. Why?    Because they can just hijack the AI assistant already logged in.     From there, it can perform anything they want.     The browser itself becomes the insider!    Lets see how.    (Context: We all use browsers but now we are starting to see Agentic browsers i.e. AI Assistants within browsers. Perplexity Comet is one such AI browser). credits: LayerX.    𝗔𝘁𝘁𝗮𝗰𝗸 𝗙𝗹𝗼𝘄:    1) Attacker crafts a special URL and distributes it (email, chat) > This URL contains query parameter with a hidden prompt that tells Comet what to do next.    2) Victim clicks the link inside Perplexity Comet (the AI-enabled browser).    3) Comet parses the URL > The URL contains a prompt that triggers Perplexity to look for data via connected services (e.g., Gmail, Calendar), encode the results, and POST them to an attacker-controlled endpoint! Refer to pic.   4) The AI assistant connects to its memory/connectors (mail, calendar, drive) as it assumes the instruction came from the user > Starts executing them.    5) The output is encoded into base64 format > The assistant now sends the encoded data to an attacker endpoint > Sensitive data gets exfiltrated without user's knowledge!    𝗔 𝗙𝗲𝘄 𝗧𝗵𝗼𝘂𝗴𝗵𝘁𝘀:    1) A regular browser renders. An agentic browser 'autonomously' interprets and acts. That extra step, from seeing to doing, is the new attack vector. This shift in attack surface is huge.   2) You may ask: how exactly does a URL trick the browser? In Perplexity, it is possible to initiate a local conversation using a URL. This works by concatenating the query into the URL itself:     hxxps[://]www[.]perplexity[.]ai/search/?q='[THE_QUERY]'&mode=concise&comet_max_assistant_enabled=true&model_preference=pplx_pro&collection=[Memory trigger]    By manipulating these URL parameters, it is possible to force the browser to execute attacker instructions.     3) Perplexity does have safeguards. It separates page data from user memory. But here’s the catch: if the attacker encodes or obfuscates data, those safeguards don’t help. Base64 is enough to fool the filter.   4) This attack isn’t limited to just stealing data. A compromised AI agent could potentially be instructed to send emails on the user’s behalf, search for files in connected corporate drives, or perform any other action it is authorized to do.    5) In an enterprise environment, a single click could allow an attacker to steal sensitive info that can be used to further gain a foothold. It is crucial to begin evaluating protective measures that can detect and neutralize malicious AI prompts before these become widespread campaigns. If you enjoyed this or learned something, follow me at Rohit Tamma for more in future! #cybersecurity #AIsecurity #infosec #informationsecurity #security

177

6 Comments

The impact of a security incident is largely dependent on the quality and swiftness of the response. Complete Incident Response playbooks for common threats, tabletop exercises, and simulations help your team respond fast and comprehensively. Do you have updated IR playbooks for common cloud threats ? if not, here are some resources that can help you: 1) A new app I created in PartyRock that builds initial IR plans for you to use as template for your plans: https://lnkd.in/dMf492ee I instructed it to provide: 1.Preparation Steps, 2. Detection Mechanisms, 3. Response Procedures (Containment, Eradication, Recovery), 4. Post-Incident Activities (While I'm not a fan of using GenAI for everything, this is actually a good use case, as it provides good ideas with commands that speed up the response) 2) Sample playbooks from our AWS Customer Incident Response Team: https://lnkd.in/dyy2TV7P 3) Threat Technique Catalog for AWS (like a Mitre Att&ck framework for AWS): https://lnkd.in/dsHNjWNc 4) AWS SkillBuilder subscriptions include access to the AWS Jam platform (gamification) that has challenges for the blue team to practice incident response in live aws accounts. https://skillbuilder.aws/ 5) AWS ProServe has a service offering to run tabletop exercises for your AWS Cloud workloads. Contact your AWS Account Manager to request more details if you're interested in this service offering or contact proserve sales from here: https://lnkd.in/dRtv7RVE The AWS Security Maturity Model has multiple recommendations related to this topic: - Define incident response playbooks (phase: Foundational) - Run TableTop Exercises - Simulations (phase: Efficient) - Forming a Blue Team (phase: Optimized) and several others, you can find the SMM here: https://lnkd.in/dztMvSUs Any other important resource is missing here? I read your comments. Any feedback for improvement in any of these assets ? please connect via Linkedin with the feedback on the invitation or write it here on the comments. Follow Dario Goldfarb for more resources on Cloud Security

371

17 Comments

Mobile Penetration Testing, including insights on Android Penetration Testing with Frida! This document covers a wide range of methods to test mobile applications, from dynamic analysis to advanced exploitation techniques. Whether you're focused on Android or iOS security, this guide provides essential tools and techniques for comprehensive mobile app testing. #MobilePenTesting #AndroidPenTesting #Frida #MobileSecurity #AppSec #PenetrationTesting #EthicalHacking #BugBounty #CyberSecurity #MobileAppSecurity #Infosec #BugHunting #RedTeam #SecureDevelopment #SecurityResearch #ThreatHunting #AppTesting"

107

 ₹5.05 Crore Fine on ICCL: SEBI’s Love Letter to Cybersecurity Negligence Oh wow, who would have thought that ignoring cybersecurity and compliance could actually have consequences? 🤯 SEBI just slapped a ₹5.05 Crore fine on ICCL for failing to meet cybersecurity norms—because, apparently, protecting critical financial infrastructure is optional until the regulator says otherwise. To all the SEBI-registered entities (REs) out there still treating cybersecurity like a weekend DIY project—how’s that working out? 💸 Maybe, just maybe, investing in actual security measures instead of waiting for an enforcement action might be a better strategy? Here’s a free tip: "Compliance isn’t a checklist; it’s a responsibility." 🛑 SEBI has been screaming about cybersecurity guidelines, yet incidents like this keep proving that enforcement is the only way some will take it seriously. But let’s be real—many SEBI REs treat cybersecurity like a box to tick rather than a real business risk. They either go for the cheapest solution (because security is “expensive”) or blindly trust big names without verifying actual capabilities. Then, when things go south, it’s all about damage control and PR statements. So, what’s next? Another fine? Another "we take security seriously" PR statement? Or will this finally be the wake-up call for REs to start acting before SEBI knocks on the door? Newsflash: A compliance certificate won’t save you from a breach, and SEBI won’t care who your vendor was when they come knocking. Choose wisely or pay the price—literally. #CyberSecurity #SEBI #Compliance #RiskManagement #WakeUpCall

30

🟠 Today’s Suggestion: Master Digital Forensics with the Ultimate Field Guide! 🧑‍💻🔍 Whether you’re starting out in digital forensics or looking to sharpen your incident response skills, the Ultimate Digital Forensics Handbook (by Codelivly) is a must-have resource for analysts, SOC teams, IT auditors, and anyone responsible for cyber investigations. What’s inside this comprehensive guide? 🗂️ Digital Forensics Investigation Methodology • Structured process following NIST SP800-86: Collection → Examination → Analysis → Reporting • Emphasis on chain of custody and evidence integrity 🧰 Building Your Forensics Toolkit • How to prepare bootable USBs, forensics workstations, and clean evidence drives • Recommended tools: SIFT Workstation , Eraser, FTK Imager 🧠 Evidence Acquisition & Preservation • Collecting volatile memory, disk images, network traffic, and cloud-based evidence • Live vs. dead-box imaging, remote and virtual evidence acquisition (Velociraptor, WinPmem) 🔬 Evidence Analysis • Memory analysis with tools like Volatility, Autopsy • Log analysis, registry hives, MFT, and prefetch files (Registry Explorer) • Network packet analysis (Wireshark, tcpdump) 🦠 Malware Analysis • Static & dynamic techniques (PEStudio, FLARE VM) • Top resources: VirusTotal, Hybrid Analysis, MalwareBazaar 📄 Documentation & Reporting • Real-world report templates (Sample), chain of custody forms (Template) • Detailed guidance on writing defensible, comprehensive forensic reports 📚 Bonus Resources • SANS posters & cheat sheets: Memory Forensics, Malware Analysis, Cloud Forensics • Network forensics video bootcamp: YouTube Series 💡 Why does this matter? Because the ability to capture, analyze, and document digital evidence is foundational for effective cyber defense, incident response, and legal proceedings. This handbook distills best practices, tools, and workflows into actionable steps—perfect for anyone in the trenches of security operations. Want to discuss practical forensics workflows, need the full PDF, or want to swap favorite tools? Let’s connect! #DigitalForensics #IncidentResponse #MalwareAnalysis #CyberSecurity #SOC #DFIR #MemoryForensics #ForensicsTools #ChainOfCustody #Investigation #NetworkForensics #BlueTeam #InfoSec

473

23 Comments

𝐘𝐞𝐭 𝐚𝐧𝐨𝐭𝐡𝐞𝐫 𝐚𝐜𝐜𝐞𝐬𝐬 𝐜𝐨𝐧𝐭𝐫𝐨𝐥 𝐢𝐬𝐬𝐮𝐞 𝐨𝐟𝐭𝐞𝐧 𝐨𝐯𝐞𝐫𝐥𝐨𝐨𝐤𝐞𝐝 𝐢𝐧 𝐰𝐞𝐛𝐚𝐩𝐩𝐬 👇 There are times when a user's privileges have to be revoked: 1. user no longer needs the permissions 2. user has changed his job attributions 3. user did something wrong and is not trusted anymore So what are we looking for in case of orphaned privileges vulnerabilities? ---- We look for cases when an admin revoked a user permissions. This is reflected in the user interface, but the backend API fails to enforce them. Admin thinks that the user doesn't have access. The application shows that the user role was changed. But when the user tries to access old privileged API endpoints -> he can still do it! 𝐇𝐨𝐰 𝐭𝐨 𝐟𝐢𝐧𝐝 𝐨𝐫𝐩𝐡𝐚𝐧𝐞𝐝 𝐩𝐫𝐢𝐯𝐢𝐥𝐞𝐠𝐞𝐬 1. Using an admin account, grant an user additional privileges (or upgrade his role) 2. Perform elevated API calls using the new privileges of the user 3. Using the admin account, revoke the user's privileges 4. Perform again the API calls from step 2) which required the additional privileges 5. Confirm that the privilege revocation was enforced, and that the user permissions were indeed removed I've seen many cases where the privileges are not revoked until a new user session is generated. And then again, there are the cases where the privs were never actually revoked. ***** 𝐋𝐢𝐤𝐞 𝐭𝐡𝐢𝐬 𝐩𝐨𝐬𝐭? -> 𝐂𝐡𝐞𝐜𝐤 𝐨𝐮𝐭 𝐭𝐡𝐞 "𝐖𝐞𝐞𝐤𝐥𝐲 𝐏𝐞𝐧𝐭𝐞𝐬𝐭 𝐓𝐢𝐩𝐬 & 𝐓𝐫𝐢𝐜𝐤𝐬" 𝐜𝐨𝐮𝐫𝐬𝐞 𝐟𝐨𝐫 120+ 𝐦𝐨𝐫𝐞 𝐥𝐞𝐬𝐬𝐨𝐧𝐬

127

6 Comments

🛑Free certifications 🛑 Five fresh, sector-focused cybersecurity certificates you can earn free of charge • Cybrary “Windows Artifact Analysis” – Registry, Event Logs, prefetch labs; free badge. cybrary.it/free-content • Google Cloud Skills Boost “Incident Response & Forensics” – packet mirroring, Chronicle labs; free quest badge. cloudskillsboost.google • OWASP “DevSecOps Fundamentals” – shift-left testing & supply-chain risk; printable cert. https://lnkd.in/gF--6ewD • Microsoft Learn “Secure IoT Solutions” – Azure IoT Defender, firmware signing; free Credly badge. https://lnkd.in/gbV6ZSf2 • MITRE ATT&CK Defender “Threat Intel Analyst” – map TTPs, build STIX feeds; first exam attempt free. https://lnkd.in/gJ9HXEGz Learn Hacking from Basic to Pro series Follow Shivam Rawat 🔗 Links to join us - LinkedIn - https://lnkd.in/g_k3XWJV Instagram - https://lnkd.in/gDFj3Dny Youtube - https://lnkd.in/gbxnxAwi Whatsapp - https://lnkd.in/gCdtcmMW #Bughunting #bugbounty #freecourse #Cybersecurity #Bug #bugcrowd #DFIR #Digitalforensics #Cyberforensics #Blueteam #SOC #ethicalhacking #Ethicalhacking #Devsecops #OWASP

106