MUNIMADUGU SOMASEKHAR

𝐈𝐓 𝐆𝐞𝐧𝐞𝐫𝐚𝐥 𝐂𝐨𝐧𝐭𝐫𝐨𝐥𝐬 (𝐈𝐓𝐆𝐂) 𝐂𝐡𝐞𝐜𝐤𝐥𝐢𝐬𝐭 𝐀𝐜𝐜𝐞𝐬𝐬 𝐂𝐨𝐧𝐭𝐫𝐨𝐥𝐬 -User access provisioning and de-provisioning processes are established. -Access rights are assigned based on job responsibilities. -Segregation of duties (SoD) controls are in place. -Regular access reviews are conducted. -Strong password policies are enforced. 𝐂𝐡𝐚𝐧𝐠𝐞 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 -Formal change management processes exist for all system changes. -Changes are documented, approved, and tested before implementation. -Segregation of duties between development, testing, and production environments. -Regular reviews of change management are conducted. 𝐁𝐚𝐜𝐤𝐮𝐩 & 𝐑𝐞𝐜𝐨𝐯𝐞𝐫𝐲 -Regular backups of critical systems and data are performed. -Backup integrity checks are regularly conducted. -Backup and recovery procedures are documented and tested. -Off-site storage of backups is maintained for disaster mitigation. 𝐈𝐧𝐜𝐢𝐝𝐞𝐧𝐭 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 -Formal incident response plans are in place. -Procedures for reporting and documenting incidents are established. -Incident response teams are trained and ready. -Post-incident reviews are conducted for improvement. 𝐍𝐞𝐭𝐰𝐨𝐫𝐤 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 -Intrusion detection/prevention and antivirus are deployed. -Network segmentation minimizes breaches. -Regular vulnerability assessments and penetration testing are conducted. -Wireless network security controls prevent unauthorized access. 𝐃𝐚𝐭𝐚 𝐏𝐫𝐢𝐯𝐚𝐜𝐲 -Policies protect sensitive data. -Data encryption is used in transit and at rest. -Data classification policies categorize data by sensitivity. -Regular data privacy training for employees. 𝐌𝐨𝐧𝐢𝐭𝐨𝐫𝐢𝐧𝐠 & 𝐋𝐨𝐠𝐠𝐢𝐧𝐠 -Logging mechanisms record security-related events. -Regular review and analysis of logs for security incidents. -Monitoring of system performance and availability. -Intrusion detection systems monitor suspicious activity. 𝐕𝐞𝐧𝐝𝐨𝐫 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 -Vendor risk assessments before engaging third parties. -Vendor contracts include security and compliance provisions. -Ongoing monitoring and oversight of vendor activities. -Procedures for terminating vendor access. 𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 & 𝐀𝐮𝐝𝐢𝐭 -Regular compliance assessments and audits. -Documentation of IT policies, procedures, and controls is maintained. -Remediation of control deficiencies or non-compliance issues. Credit: Abdul Khaliq 𝐃𝐢𝐬𝐜𝐥𝐚𝐢𝐦𝐞𝐫 - This post has only been shared for an educational and knowledge-sharing purpose related to Technologies. Information was obtained from the source above source. All rights and credits are reserved for the respective owner(s). #ciso #cybersecurity #itgc #technology #learning

1,958

73 Comments

Breaking Down Key SOC Concepts: Alert, Incident, Risk Score, and Investigation As a Security Analyst, your role involves distinguishing between core SOC terms like Alerts, Incidents, Risk Scores, and Investigations to prioritize threats effectively. Let’s understand these Alert - An alert is a notification triggered when a specific condition or rule within a security monitoring system is met. Alerts are generated by security tools like SIEMs, IDS/IPS, EDR, or firewalls. While not all alerts are malicious, they signify potential threats. Example: Your SIEM raises an alert for an unusually high number of outbound connections from a workstation to an unfamiliar IP address over a short period (indicating possible data exfiltration). Incident - An incident is a collection of correlated alerts and events that together represent a security breach, attack, or policy violation. Incidents carry significant implications for security and often require immediate action. Example: Correlating alerts for multiple failed login attempts, unusual privilege escalation, and file deletion on a critical server reveals a coordinated insider attack exploiting stolen credentials. Risk Score - A risk score is a numerical value assigned to alerts or entities to prioritize response based on the threat's potential impact, likelihood, and criticality of affected assets. Advanced systems often calculate this using factors like MITRE ATT&CK techniques, asset importance, and historical data. Example: - Alert 1: A failed login attempt from an unrecognized IP on a non-critical asset might score 30/100 (low risk). - Alert 2: An encrypted connection from an unusual country to a domain controller scores 90/100 (high risk). This scoring helps analysts prioritize investigations. Investigation is the process of analyzing alerts and incidents to determine the root cause, scope, and impact of a security event. It often involves log analysis, endpoint activity review, packet captures, and threat intelligence correlation. Example: For the encrypted connection alert: - Review logs to trace the source IP and actions taken on the domain controller. - Use EDR to check for suspicious processes on the affected server. - Cross-check IP reputation using threat intelligence feeds. Key Takeaway - Alerts signal potential threats but may not always indicate malicious activity. - Incidents aggregate and correlate alerts into actionable security events. - Risk Scoreshelp prioritize the most critical threats. - Investigation uncovers the root cause, enabling timely and accurate remediation. #SOC #CyberSecurity #ThreatDetection #IncidentResponse #SecurityOperations

82

𝐒3 𝐁𝐮𝐜𝐤𝐞𝐭 𝐇𝐚𝐜𝐤𝐞𝐝: Leaks Payment and UPI Info [ 𝐓𝐨𝐧𝐧𝐞𝐬 𝐨𝐟 𝐟𝐢𝐥𝐞𝐬 𝐈 𝐬𝐲𝐧𝐜 𝐭𝐨𝐝𝐚𝐲] During today’s 𝐨𝐟𝐟𝐞𝐧𝐬𝐢𝐯𝐞 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐚𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭 [ 𝐎𝐂𝐏𝐓 𝐂𝐞𝐫𝐭 𝐓𝐫𝐚𝐢𝐧𝐢𝐧𝐠], we uncovered a 𝐦𝐢𝐬𝐜𝐨𝐧𝐟𝐢𝐠𝐮𝐫𝐞𝐝 𝐒3 𝐛𝐮𝐜𝐤𝐞𝐭 that exposed 𝐬𝐞𝐧𝐬𝐢𝐭𝐢𝐯𝐞 𝐩𝐚𝐲𝐦𝐞𝐧𝐭 and 𝐔𝐏𝐈 𝐢𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧. The bucket contained tonnes of files, and after syncing and analyzing the data, we confirmed the severity of the leak. 🔍 𝐖𝐡𝐚𝐭 𝐰𝐞 𝐟𝐨𝐮𝐧𝐝: ➥ Misconfigured permissions allowing public access. ➥ Sensitive payment and UPI details stored without encryption. ➥ A potential goldmine for attackers if left unaddressed. 🚨 𝐈𝐦𝐩𝐚𝐜𝐭: ➥ This highlights the critical importance of securing cloud storage configurations. ➥ A single misstep can lead to massive data breaches, financial fraud, and reputational damage. 💡 𝐋𝐞𝐬𝐬𝐨𝐧 𝐥𝐞𝐚𝐫𝐧𝐞𝐝: ✓ Always audit your cloud storage permissions. ✓ Encrypt sensitive data at rest and in transit. ✓ Regular pentesting is essential to catch these vulnerabilities before attackers do. ✓ Today’s session was a stark reminder of why cloud security hygiene is non-negotiable. Let’s work together to make the cloud a safer place! Hacker Associate 𝗖𝗼𝗺𝗺𝘂𝗻𝗶𝘁𝘆! Join the Hacker Associate 𝗖𝗼𝗺𝗺𝘂𝗻𝗶𝘁𝘆 𝘄𝗶𝘁𝗵 𝟭𝟭𝟮𝗞+ 𝗺𝗲𝗺𝗯𝗲𝗿𝘀 and start your hacking journey today! 🚀 𝐒𝐭𝐚𝐲 𝐮𝐩𝐝𝐚𝐭𝐞𝐝 𝐚𝐥𝐥 𝐢𝐧 𝐨𝐧𝐞 𝐩𝐥𝐚𝐜𝐞 with [Harshad Shah ] for Daily Hacking Tips!  [ 34𝐤+ 𝐦𝐞𝐦𝐛𝐞𝐫𝐬 ] #CyberSecurity #CloudPentesting #S3Bucket #DataBreach #EthicalHacking #CloudSecurity #infosec #aws #networksecurity

50

Most Cybersecurity Risk Reviews Fail for One Simple Reason: They don’t answer: “So what?” → “Unpatched server.” (noise) → “Unpatched server could take down payroll for 3 days.” (impact) → “Over-privileged IAM role.” (noise) → “Over-privileged IAM role could let a contractor delete production data.” (impact) → “Open S3 bucket.” (noise) → “Open S3 bucket exposes 10K customer records—potential GDPR fine.” (impact) → “Weak MFA adoption.” (noise) → “Weak MFA adoption leaves executive accounts exposed to phishing.” (impact) Noise gets ignored. Impact gets funded.

44

1 Comment

Troubleshooting Active Directory Trust Relationships: 6 Methods Have you encountered trust relationship issues in Active Directory? Here are 6 methods to solve them: Method 1: Unlink and join the domain 1. Disjoin: djoin / leave 2. Reboot 3. Join: djoin /domain <DomainName> /user <DomainAdminUser> /password :* 4. Restart again Method 2: PowerShell Repair 1. Test-ComputerSecureChannel -Repair -Credential <DomainName>\Administrator 2. Reboot Method 3: Reset Computer Password (PowerShell) 1. reset-ComputerMachinePassword -server <DomainServer> -Credential <DomainName>\Administrator 2. Reboot Method 4: Netdom Reset 1. netdom resetpwd /Server:<DomainController> /UserD:<DomainAdmin> /PasswordD:* 2. Reboot Method 5: Delete and Recreate a Computer Object 1. Remove the computer object from ADUC 2. Delete the -UnjoinDomainCredential <DomainName>\Administrator computer 3. Restart and join: Add-Computer -DomainName " <DomainName> " -Credential <DomainName>\Administrator -Restart Method 6: Time Synchronization 1. W32TM / Resync 2. Manually set the time synchronization if necessary: w32tm /config /manualpeerlist:"(link not available)" /syncfromflags:manual /update These methods can help troubleshoot trust relationship issues in Active Directory. Try them out and see what works best for you. Active Directory, trust, IT, Windows Server, PowerShell.</DomainName></DomainName></DomainName></DomainAdmin></DomainController></DomainName></DomainServer></DomainName></DomainAdminUser></DomainName>

1,281

191 Comments

Simplified RADIUS Authentication Protocol: A Quick Guide for CISSP, and Security Aspirants Unlock the complexities of RADIUS authentication with this easy-to-understand guide. Perfect for those preparing for CISSP and other security certifications, this simplified breakdown makes mastering the protocol effortless. #CyberSecurity #CISSP #CISM #RADIUS #NetworkSecurity #Infosec #SecurityCertifications #TechLearning #SecurityProfessionals #CyberAware #InfoSecCommunity #SecurityEssentials #TechTips #CertificationJourney Prabh Nair For the community of infosec

69

🚨𝗜𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁 𝗣𝗖𝗜 𝗗𝗦𝗦 𝗟𝗶𝗸𝗲 𝗮 𝗣𝗥𝗢🚨 This post will upskill your Security career with hands-on experience in PCI DSS Compliance, Risk Assessment, Security Monitoring, and toolkit 🔰 𝗨𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱𝗶𝗻𝗴 𝗣𝗖𝗜 𝗗𝗦𝗦 🔶 PCI DSS Overview https://lnkd.in/d4jFmDnK 🔶 12 Requirements of  PCI DSS v4.0 https://lnkd.in/dRdpdmts 🔰 𝗥𝗶𝘀𝗸 𝗔𝘀𝘀𝗲𝘀𝘀𝗺𝗲𝗻𝘁 𝗮𝗻𝗱 𝗖𝗵𝗲𝗰𝗸𝗹𝗶𝘀𝘁 🔶 PCI DSS Checklist https://lnkd.in/danyFdgQ 🔶 PCI DSS Comprehensive Checklist https://lnkd.in/dtiPtPqm 🔶 Conducting a Risk Assessment for PCI DSS https://lnkd.in/dX47rqhy 🔶 PCI Compliance—Which SAQ is Right For Me?  https://lnkd.in/drqn6_2k 🔶 Implementation Toolkit with documents https://lnkd.in/d9ijDuVG 🔰 𝗥𝗲𝗮𝗹-𝘁𝗶𝗺𝗲 𝗣𝗖𝗜 𝗗𝗦𝗦 𝗠𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 🔶 Auditing with the Splunk App https://lnkd.in/dYj9mYD2 🔶 Detection rules for PCI compliance monitoring https://lnkd.in/dezBUdqY 🔶 Using Wazuh for PCI DSS compliance https://lnkd.in/dwYpu7qv 🔶 Vulnerability Detection Using Wazuh for PCI DSS https://lnkd.in/dMik-XCr 🔶 Using Splunk for PCI DSS Incident Detection & Response https://lnkd.in/dCdu6ebw 🔰 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗖𝗼𝗻𝘁𝗿𝗼𝗹𝘀 𝗳𝗼𝗿 𝗣𝗖𝗜 𝗗𝗦𝗦 🔶 Flow Diagram https://app.diagrams.net/ 🔶 File Integrity Monitoring https://wazuh.com 🔶 Network IDS https://suricata.io/ 🔶 Network Device Change Monitoring https://lnkd.in/d_xvkJA7 🔶 Log Monitoring https://lnkd.in/dRwkX-yj ♻️ Share this with someone who may need it Follow Rajneesh G.  for more such resources! 🚀

101

3 Comments

Bug Bounty Tip: HTTP Parameter Pollution (HPP) Some apps mishandle duplicate parameters. You can bypass logic or elevate privileges by injecting multiple values: GET /transfer?amount=100&admin=true&amount=1 ⚠️ Always test: •param=value1&param=value2 •Encoded (%26,) #BugBounty Tip by Nullsecurityx

256

3 Comments

If you are appearing for SOC Level 1 & 2 interview, be prepared to answer the following scenario based questions:- How do you differentiate between false positives and true security incidents in a SIEM alert queue? What steps would you take if a SIEM raises an alert for suspicious outbound traffic to a known malicious domain? How do you prioritize alerts in a SOC environment to ensure critical threats are addressed first? What initial steps would you take when investigating a potential ransomware attack? How do you handle an alert for unauthorized access to a privileged account? What are Indicators of Compromise (IoCs), and how do you use them in an investigation? How do you analyze firewall logs to detect potential threats? What steps would you take to investigate a phishing attack using email logs? How do you use endpoint logs to detect malware infections? How do MSSPs ensure continuous monitoring for multiple clients? What challenges arise when managing SIEM configurations across multiple customers? How do MSSPs handle incident escalation across different client environments? How do you use SOAR (Security Orchestration, Automation, and Response) to streamline incident response? What are the benefits of integrating threat intelligence feeds into SIEM? How do you fine-tune SIEM correlation rules to reduce false positives? How do you investigate a potential Distributed Denial-of-Service (DDoS) attack? What steps would you take to analyze IDS/IPS alerts for malicious activity? How do you detect lateral movement within a network using SIEM logs? How do you investigate an endpoint security alert for suspicious process execution? What steps would you take to contain and remediate a malware infection? How do you analyze Windows Event Logs to detect security incidents? How do you investigate unauthorized access to cloud resources? What security measures would you implement to protect cloud workloads? How do you use Microsoft Defender for Identity to detect compromised accounts? How do MSSPs ensure compliance with security frameworks like NIST and ISO 27001? What steps would you take to investigate a data breach involving Personally Identifiable Information (PII)? How do you ensure proper log retention policies for regulatory compliance? How do you communicate security incidents to non-technical stakeholders? What steps would you take to train clients on security awareness? How do you handle high-pressure situations in a SOC environment? #SOC #InterviewQuestions #SOCLevel1 #SecurityEngineer #MSSP #SIEM #EDR #MDR #XDR #WorldITJobs #JobSeeker #CyberSecurity #SecurityOperationsCentre

309

11 Comments

🚨 PCI DSS 11.3.1.1: The Hidden Landmine No One’s Talking About 🚨 The PCI Security Standards Council recently released an Infographic: PCI DSS Vulnerability Management Processes - https://lnkd.in/g7cSNewt. It offers an excellent overview of the expected process, but one thing caught my eye: how they are defining the term "addressed" for vulnerabilities. For a little context, requirement 11.3.1.1 is associated with internal vulnerability scans and is stated as: > “11.3.1.1 All other applicable vulnerabilities (those not ranked as high-risk vulnerabilities or critical vulnerabilities according to the entity’s vulnerability risk rankings defined at Requirement 6.3.1) are managed as follows: • Addressed based on the risk defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1.” Up until this point, it was unclear as to what "addressed" meant in the context of PCI DSS. Can addressed mean accept, or do you have to fix? The new infographic clarifies this: > Address – the entity determines whether to resolve the vulnerability or to mitigate the risk by addressing the vulnerability in another way (e.g., with a compensating control or by disabling a vulnerable service). Whoa - wait a minute. Did they just say that ALL vulnerabilities must be fixed? Yes, they did. No more filtering out the low-risk stuff. No more ignoring the noisy ones. If it showed up on your scan report and it’s not “false positive” — it’s on the chopping block. With this concern in hand, I decided to contact several of my QSA network to make sure that my interpretation was accurate. Unfortunately, this is the consensus: all vulnerabilities must be addressed at some point. And to be clear, I'm not referring to patch-related vulnerabilities. This has been a requirement already for a while with PCI DSS (req. 6.3.3). These are information disclosures and other low to medium risk vulnerabilities that would be most likely related to configuration issues. Practically, I think this is ridiculous, especially if you consider that now PCI requires credential-based scanning. So a vulnerability found on a backend server that is only on the local system that only admins have access to now has to be fixed, even though the risk is super low. Additionally, I have experience working in large-scale PCI environments with thousands of assets. Fixing all vulnerabilities in these environments is essentially unfesable, not to mention the principle of diminishing returns. So... 💡 Why aren’t more people talking about how wild this interpretation is becoming? 💡 What happened to risk-based security? 💡 Will QSAs take a hard approach on this if you still have low vulns open over a year? 💡 Will the PCI Council back off this? 👀 #PCIDSS #Cybersecurity #RiskManagement #Compliance #Infosec #QSAs #11.3.1.1 #VulnerabilityManagement

336

73 Comments

GRC Jobs: The Most Underrated Cybersecurity Career Everyone wants to be an ethical hacker or a penetration tester, but GRC? Bhai, yeh bhi goldmine hai! Problem? Log isko boring paperwork samajh ke ignore kar dete hain—phir interview me ISO 27001 ka naam sunke bechain ho jate hain. 😉 Agar GRC me career banana hai, here’s your roadmap: Step 1: Understand the Basics – Compliance, Risk Management, Audit, Policies—this is the foundation of cybersecurity. Step 2: Get Certified – Start with ISO 27001 Lead Implementer/Auditor, CISA, or CRISC (Naam bhaari hain, but zaroori hain). Step 3: Develop Key Skills 3.1: Risk assessment (pehla sawaal hamesha yahi hota hai: “Risk kya hai?”). 3.2: Writing policies (kyunki bina policy, cybersecurity sirf jugad hai). 3.3: Compliance frameworks (ISO 27001, NIST, PCI-DSS, SOC 2… naam yaad ho gaye to aadha kaam ho gaya). Step 4: Get Hands-on Experience 4.1: Open-source compliance projects join karo. 4.2: Startups ke security policies likhne me madad karo. 4.3: Internships ya freelance projects dhundo. Step 5: Job Search Strategy 5.1: Network with GRC professionals on LinkedIn. 5.2: Apply for roles like GRC Analyst, Risk Analyst, Compliance Associate. 5.3: Build a portfolio of policies, risk assessments, and compliance reports. GRC isn’t boring—it’s where the big decisions happen. No hacking, but a lot of power. So, thinking about a GRC career? Kaha phas rahe ho? Let’s discuss. 👇 #GRC #CyberSecurityCareers #RiskManagement #Compliance #ISO27001 #CareerGrowth

65

16 Comments

Cybersecurity Careers in OT!! Ever wondered what roles exist in Operational Technology (OT) Security? This quick snapshot covers: ✅ In-demand roles like OT Security Analyst, SCADA Specialist, Pen Tester ✅ Industries where OT security is critical – energy, water, manufacturing, healthcare ✅ Skills and certifications that actually matter – think GICSP, IEC 62443, CISSP Whether you’re from IT or just starting out, OT security offers exciting and meaningful career paths in protecting critical infrastructure. 📌 Save this. Share with a friend. Or explore if this could be your next move. ♻️ Reshare to Help Others Learn. 🔔 Follow and press bell to get notified of my posts. 🤝 Subscribe OT Security Digest Newsletter (6600+) https://lnkd.in/grvyEmZy #OTSecurity #Cybersecurity #ICS #IEC62443 #CyberCareers #CriticalInfrastructure #OTSecurityHuddle

151

13 Comments