Newsletter – Hackcraft

From Compliance to Resilience: The Synergy between DORA, TIBER EU and Red Teaming for Enhanced Security in the Financial Sector

30/07/2024/in Newsletter/by Villy Varsou

The number of cyber-attacks has nearly doubled since the start of the COVID-19 pandemic. The IMF’s Global Financial Stability Report highlights the high exposure of the financial sector to cyber risks, with almost one-fifth of all incidents affecting financial firms. While cyber incidents have not been systematic so far, severe incidents at major financial institutions could pose a significant threat to macrofinancial stability through a loss of confidence, disruption of critical services, and due to technological and financial interconnectedness. As a result, regulatory bodies have acknowledged the need for enhanced cybersecurity measures to protect critical infrastructure and consumer data. This has led to the development of frameworks such as the Digital Operational Resilience Act (DORA) and the Threat Intelligence-Based Ethical Red Teaming (TIBER EU) initiative. These regulatory frameworks emphasize the importance of not only complying with regulations, but also building a resilient organization capable of withstanding and recovering from cyber-attacks.

TIBER-EU: A Dedicated Red Teaming Framework

TIBER-EU (Threat Intelligence-Based Ethical Red Teaming) was developed by the European Central Bank (ECB) to enhance the resilience of entities that provide core financial infrastructure against cyber threats. However, it can be used for entities in all critical sectors, not just the financial sector. It mandates bespoke Red Teaming tests that simulate realistic cyberattacks on institutions’ critical functions using threat intelligence.

Promotion of Red Teaming:

Targeted Exercises: Under TIBER-EU, financial institutions undergo Red Teaming exercises designed to replicate the specific threats they face. These exercises are orchestrated by external teams, ensuring an unbiased and thorough evaluation.
Risk Identification: By simulating sophisticated attacks, TIBER-EU helps institutions uncover hidden vulnerabilities and assess their ability to detect and respond to real threats.
Actionable Insights: The findings from these exercises are used to strengthen the institution’s cybersecurity measures, enhancing their resilience against actual cyber threats.

DORA: Integrating Red Teaming into Comprehensive Resilience Testing

DORA (Digital Operational Resilience Act) aims to ensure the operational resilience of financial entities within the EU against digital disruptions. It establishes comprehensive requirements for ICT risk management, incident reporting and resilience testing.

Promotion of Red Teaming:

Broad Scope: While DORA covers all aspects of ICT risk management, it specifically includes Red Teaming as a key component of resilience testing.
Regulatory Compliance: Financial entities are required to conduct regular Red Teaming exercises to demonstrate their preparedness against cyber threats and ensure compliance with DORA’s stringent standards.
Continuous Improvement: DORA emphasizes the need for ongoing resilience testing, including Red Teaming, to adapt to the evolving threat landscape and continuously enhance security measures.

The Synergy Between TIBER-EU and DORA

Enhanced Cyber Resilience:

Both TIBER-EU and DORA recognize Red Teaming as essential for enhancing the cyber resilience of financial institutions. These frameworks encourage the use of realistic attack simulations to identify and mitigate vulnerabilities.

Regulatory Alignment:

Conducting Red Teaming exercises helps financial institutions align with the regulatory requirements of both TIBER-EU and DORA. This proactive approach demonstrates a commitment to maintaining high security standards and protecting customer data.

Operational Continuity:

By integrating Red Teaming into their risk management strategies, institutions can better prepare for and respond to cyber incidents. This ensures operational continuity and minimizes the impact of potential disruptions.

Implementing Hackcraft Red Teaming: Best Practices

Hackcraft Red Teaming is a genuine, advanced and tailor-made exercise that entails simulating real-world adversarial tactics, techniques and procedures, with the objective of evaluating your organization’s capability to prevent, identify and address both cyber and physical assaults. Our specialized experts use the latest threat intelligence to tailor for your organization Red Teaming exercises that reflect current and emerging threats.

Regular Red Teaming exercises are crucial for staying ahead of evolving threats and strengthening your defenses. After each simulated attack, the Hackcraft Red Team provides valuable metrics to help organizations enhance their incident response processes. Thorough documentation of findings and remediation actions will drive organizational learning and compliance reporting. Integrating these findings into your incident response plans will test and improve your organization’s ability to detect and respond to attacks.

As cybersecurity threats continue to rise, it’s crucial for financial institutions to stay a step ahead. Regulatory frameworks like TIBER-EU and DORA highlight the vital role of Red Teaming in keeping organizations safe. With Hackcraft Red Teaming, simulated real-world attacks provide invaluable insights into vulnerabilities and preparedness for cyber incidents. Embracing this approach doesn’t just ensure regulatory compliance – it also boosts an organization’s cyber resilience significantly.

Don’t wait until it’s too late – integrate Hackcraft Red Teaming into your risk management practices and build stronger defenses against cyber threats. Contact us!

Beyond Checkboxes: Red Teaming vs Traditional Security Assessments

14/05/2024/in Newsletter/by Villy Varsou

Beyond Checkboxes: Red Teaming vs Traditional Security Assessments

In today’s ever-evolving cyber threat landscape, organizations require a robust security posture to safeguard their critical assets. While traditional security assessments have long been a cornerstone of security strategy, they may not always provide a comprehensive view of an organization’s true cyber resilience. This is where Red Teaming steps in.

Traditional security assessments: The Limitations of Checkboxes

Traditional security assessments, like penetration testing and vulnerability scanning, seem to be a necessary security foundation, as they play a vital role in identifying security weaknesses within your IT infrastructure. These assessments often follow a checklist approach, checking for specific vulnerabilities and configuration errors. While valuable, traditional assessments have limitations. They may miss zero-day vulnerabilities or novel attack vectors not yet included in existing vulnerability databases. Additionally, they often focus on technical aspects, potentially overlooking human factors contributing to security risks.

Red Teaming: Going Beyond the Checklist

Red Teaming takes security assessments to the next level, as it goes beyond the checkbox mentality of traditional security assessments. It involves adversarial attack simulation of real-world threats (Advanced Persistent Threats), where a team of ethical hackers (the Red Team) attempts to breach your defenses using the same techniques and tools as real attackers. Their aim is to test and measure the effectiveness and responsiveness of the people, processes and technology used to defend an organization digitally and physically. Unlike traditional assessments, which focus on compliance and adherence to security standards, Red Teaming takes a holistic approach to security testing, mimicking the tactics, techniques and procedures (TTPs) of actual adversaries. The Hackcraft Red Teaming, notably, is based on tailor-made scenarios, without whitelisting and exceptions that evaluates overall security posture.

Key Differences

Scope and Methodology: Traditional security assessments typically follow a predefined scope and methodology, focusing on specific areas such as network security, application security, or compliance requirements. In contrast, Red Teaming adopts a more adversarial mindset, using tactics such as social engineering, penetration testing and reconnaissance to emulate the tactics of real attackers.
Realism and Immersion: Red Teaming strives to create a realistic and immersive testing environment that closely mirrors the tactics and techniques used by real adversaries. This approach allows organizations to identify blind spots, weak points and hidden vulnerabilities that may not be uncovered through traditional security assessments.
Focus on Detection and Response: While traditional security assessments primarily focus on identifying vulnerabilities and weaknesses, Red Teaming also emphasizes detection and response capabilities. By simulating realistic attack scenarios, Red Teams help organizations evaluate their ability to detect, respond to and mitigate cyber threats in real-time.

Benefits of Red Teaming

Comprehensive Risk Assessment: Red Teaming provides a more comprehensive and realistic assessment of an organization’s security posture, uncovering hidden vulnerabilities and weaknesses that may go undetected by traditional assessments.
Enhanced Preparedness: By simulating real-world cyberattacks, Red Teaming helps organizations better understand their adversaries’ tactics and develop proactive strategies to mitigate risks and strengthen defenses.
Improved Detection and Response: Red Teaming helps organizations test and refine their detection and response capabilities, enabling them to identify and mitigate cyber threats more effectively.
Provides Actionable Insights: Red Teaming delivers specific recommendations to address vulnerabilities and strengthen your overall security posture.
Cultural Shift: Red Teaming encourages a cultural shift towards a proactive and security-aware mindset, fostering collaboration, innovation and continuous improvement across the organization.

Benefits of Hackcraft Red Teaming

Identifying Real Life Attacks Impact

Hackcraft Red Team replicates real-world attack scenarios, providing organizations with a comprehensive view of their preparedness. The exercise’s realism produces results identical to an actual incident, which cannot be ignored or disputed.

Pinpointing weaknesses

By conducting simulated attacks, Hackcraft Red Team identifies vulnerabilities in an organization that may not be uncovered during routine security assessments.

Improving detection mechanisms

After the simulated attack, Hackcraft experts provide a detailed timeline and IOCs to help organizations create strict and proactive detection rules.

Enhanced Incident Response

The ethical simulated attacks offered by Hackcraft help organizations refine their incident response strategies and prepare them to respond swiftly and effectively when faced with a real threat. After each simulated attack, the Hackcraft Red Team provides detailed metrics, including Time to Detect, Time to Respond and other useful data, to assist organizations enhance their incident response process and procedures.

Continuous Improvement

Red Teaming is not an one-time exercise for Hackcraft. It is an ongoing process that enables organizations to adapt and evolve their defenses based on emerging threats.

Awareness stimulation

Tailored awareness training can be provided to the organization’s personnel based on attack statistics resulting from the scenarios created and used by Hackcraft Red Team.

Team of devoted experts

If you’re looking for a reliable and efficient way to enhance your organization’s cybersecurity, then Hackcraft is an excellent option to consider. Hackcraft Red Team uses their unmatched expertise to create and conduct tailored ethical attacks that meet the specific needs of each organization.

Red Teaming and Traditional Security Assessments: Two peas in a pod

Red Teaming and traditional assessments are not mutually exclusive. Traditional assessments provide a foundational understanding of your security posture, while Red Teaming adds depth by simulating a real-world attack. Together, they offer a more complete picture of your organization’s security resilience. Moving beyond the limitations of checkboxes, Hackcraft Red Team offers a valuable tool for organizations seeking proactive and dynamic approaches to strengthen their cyber defenses. With Red Teaming organizations can identify, assess and mitigate cyber risks, gain valuable insights into their security posture and improve their readiness to defend against real-world threats. By embracing both Red Teaming and traditional security assessments, organizations can enhance their resilience, agility and preparedness to defend against evolving cyber threats and safeguard their critical assets and data.

Ready to take your security posture to the next level? Consider incorporating Hackcraft Red Teaming into your security strategy!

Defending Against the Surge: Red Teaming in the Wake of Ransomware Attacks in Europe and Greece

23/02/2024/in Newsletter/by Villy Varsou

As we bid farewell to 2023, let us highlight some enlightening insights. The research conducted by Corvus Insurance has shown a significant increase of over 95% in ransomware attacks compared to the previous year. According to Statista, over 72% of businesses worldwide were affected by ransomware attacks during 2023. Education, local and state government, healthcare, distribution and transport were among the top targets.

Moreover, Statista mentions that 36% of the organizations suffered ransomware attacks because of exploited vulnerabilities in 2023, with leisure and entertainment industry to be the most vulnerable to ransomware attacks. Credential compromise was the second-most common cause of successful ransomware attacks, while malicious e-mail ranked third. Consequently, 51% of organizations are planning to increase security investments as a result of a breach, including incident response planning and testing, employee training, threat detection and response tools, as IBM points out.

Source: Corvus Insurance

Significant Ransomware attacks in Headlines

The International Battleground

In recent years, we have witnessed a surge in ransomware attacks targeting organizations across all sectors. From disrupting critical infrastructure to paralyzing healthcare systems, these attacks have not only caused financial losses but have also shaken the foundations of trust in our digital systems and in several organizations.

To start with one of the most far-reaching cyber-attacks of the year, the file-transferring software MOVEit was victim to a ransomware attack starting in May 2023, unknown SQL injection vulnerability (CVE-2023-34362) in the MOVEit Transfer software which led to the attack affecting hundreds of billion-dollar companies including the BBC, Zellis, British Airways, Ofcom, Ernst and Young, Transport for London and more. In April, financial services firm, NCR, was hit by a ransomware attack that disrupted payment processing systems. Last but not least, in November China’s biggest lender, ICBC, U.S. arm, was a ransomware victim.

Greece’s Wake-Up Call

Beyond Europe, ransomware has cast its dark shadow across Greece. Major corporations, government agencies and even critical infrastructure have fallen prey to sophisticated attacks. The ripple effects have been felt not only in financial terms but also in terms of the broader implications for national security and public trust.

To mention some noteworthy ransomware attacks, Papaki.gr, the well-known Greek domain registrar, reported on July 27th that their systems had been accessed without authorization. While the details of the cyber-attack have not been disclosed, Papaki has informed that it is likely that two clients were affected by data leak. Moreover, Hellenic Public Properties Company (HPPC) experienced such an attack last November with limited impact on the organization’s service operations as backups were properly configured and regularly updated. Also in November, the University of the Aegean had important documents published into the dark web after refusing to pay the ransom to attackers.

Hackcraft: A Proactive Αrtful Defense Strategy

In the face of this escalating threat landscape, organizations must adopt a proactive stance in defending against ransomware attacks. Neurosoft’s powerful service is Hackcraft, a Red Team highly capable of delivering exceptional Adversary Simulation services (Red Teaming). Red Teaming involves an adversary attack simulation of real-world threats (Advanced Persistent Threats) based on realistic scenarios that evaluate the overall security posture in order to test and measure the effectiveness and responsiveness of the people, processes and technology used to defend an organization digitally and physically.

Understanding Ransomware Simulation Exercises

To empower organizations towards this ransomware surge Hackcraft members have designed Ransomware Simulation Exercises. These exercises simulate real-life attack scenarios to test the organizations’ ransomware prevention and detection capabilities. Based on threat intelligence, these Exercises are tailored to meet the specific needs and objectives of each organization, providing a comprehensive and customized solution to the unique challenges faced by different business sectors.

Benefits of Hackcraft Ransomware Simulation

Realistic Scenario Testing
Hackcraft Red Team creates tailor-made ransomware attacks based on real-life ransomware samples such as Cl0p and Lockbit. These ethical attacks help organizations better prepare and understand their team’s response to the pressure of an actual ransomware attack.
Identifying Vulnerabilities
Hackcraft Ransomware Simulation allows organizations to evaluate the overall ransomware readiness, security posture and anti-ransomware controls. Identifying vulnerabilities and weaknesses in their current cybersecurity measures against ransomware threats helps in addressing potential gaps in security.
Testing Incident Response Plans
During a Ransomware Simulation, Hackcraft can help organizations assess the readiness of their incident response plans. This includes evaluating communication processes, decision-making, coordination among various teams, security controls, and in-place mechanisms, processes and policies.
Employee Training and Awareness
Hackcraft Ransomware Simulations offer a chance to train employees in identifying and responding to ransomware threats, raising awareness and improving overall security hygiene.
Meeting Compliance Requirements
In some industries conducting regular Red Team Exercises, including Ransomware Simulation Exercises, is a requirement for compliance. It helps organizations demonstrate their commitment to cybersecurity best practices.
Strategic Decision-Making
Insights gained from Hackcraft Ransomware Simulation debriefing enable informed strategic decision-making regarding cybersecurity investments and improvements. It supports a culture of continuous improvement, ensuring that defenses evolve to address emerging threats.

Hackcraft Ransomware Simulation vs Ransomware

The recent ransomware incidents that occurred in Greece and Europe should be a wake-up call for organizations to prioritize proactive cybersecurity measures. One such effective strategy is to adopt Ransomware Simulation, which allows organizations to foresee, detect and prevent potential threats before they escalate into crippling attacks. As we forge ahead, Hackcraft views Ransomware Simulation not merely as a security measure, but as a readiness evaluation against the known and the unknown of the ransomware threat landscape. It is a weapon of choice for safeguarding our digital future against the rising tide of ransomware.

Social Media

LinkedIn

Twitter

Github

Services

Contact