Hallo Experts
     
For our Security Operations Center (SOC), we are searching for a tool that can collect “Threat Artifacts”. When I worked with McAfee in the past, they used GetSusp to collect information about undetected malware on their computer.
     
We are searching for a similar tool that we can use in the network to collect information remotely. What would you recommend us? It would be nice, if the tool would work on Windows & Linux, albeit this is not a must.
   
Thanks a lot

Dont see such a benchmark guide at CIS site.
Anyone can share/point me to one?

Hi all,

I am a complete newbie in the cyber security world. I am tasked to setup SPF and DMARC in order to combat email spoofing. We successfully enabled SPF on our domains, now is the turn for DMARC.

My question is, if I setup the DMARC policy on none or quarantine and if I see any legit vendor spoofing our domain that is being quarantined, how do I allow that vendor to spoof our domain ? Do I just add their IP as a sender in our SPF record ?

Thanks for your guidance.

Greetings! I have well over 15 years in the I.T. world specifically in working with Servers & Workstations, I am considering branching out to another field in the I.T. world specifically in the Cyber Security. I have minimal I.T. Security related experience and knowledge.
Q4U: What Cyber Security Certification would be ideal for a novice like me?
There are so many and I would like to focus on the one that will open the doors to that side of the I.T. world.
Thank you in advance!

Our local CyberSecurity Agency has come out with a directive:
•      Review internal structure to ensure C-Suite has oversight of cybersecurity risks as part of enterprise risk management
•      Ensure security team has direct line to C-Suite

EE expert has provided the CISO handbook below but I'll need more "Terms of Ref" that will cover a
CISO's  "Scope of Work (& what is out of scope)", "Authority", need for "impartiality/independence":
currently all risks-related roles come under CFO but CFO's kpi is on cost control and one
link says this is inappropriate as CISO may need to spend on compliances, manpower,
tools, services etc

Extract from EE:
"In most cases, the agency’s internal policies delegate management of the agency’s information to the Chief Information Officer (CIO). Under FISMA, the CIO may then delegate  tasks related to information security to the senior agency information security officer (often referred to as CISO).
There are more information on reporting requirements specific to agency responsibility and how these key stakeholders are involved.
https://www.cio.gov/assets/files/CISO_Handbook.pdf


https://www.securityroundtable.org/whats-the-best-reporting-structure-for-the-ciso/
Above link gives various suggestions but will need something authoritative like
ISO standard or to further support what CyberSecurity Agency has provided above.


Deloitte & one ErnstY papers statistics show most sites still adopt the model of
CISO going under CIO:
…

What's the latest easy and simple defense against comment spam? mybigdata.co.uk has a contact form and BOTS submit spam as a message. The solution will be something else than captcha as other businesses also don't use it.

I am trying the to find an application were if my laptop or desktop was compromise meaning by cyber-attack, and it’s a new an unknown bug I would like to setup a data file or word document, which if the attack click on the file or document it will trigger an email to my email account.

we need to set up within 8 weeks a small SIEM for 30 servers  n hopefully its something low-cost, fast to set up n easy to use/manage.

Solarwinds, ManageEngine, Websense or ?

In one presentation by an IT regulator & Cyber Security Agency,
one slide mentioned about reviewing "Netflow" & a couple of
slides later, it require us is to perform periodic "review of
information flow" :

though I raised if these are related ie by reviewing "Cisco Netflow",
we are deemed to have addressed the requirement to "review
information flow" : the presenter doesn't quite seem to know,
thus I'm clarifying here:
does Cisco Netflow offers a form of documenting information
flow?

I've set our web.config file on a WP site we've built to have secure cookies but all tests we've run online suggest cookies are still not secure. The httpOnly setting also hasn't taken effect.

The code snippet from the web.config is below and always the PHPSESSID cookie doesn't have these settings

<system.web>
    <httpCookies httpOnlyCookies="true" requireSSL="true"  />
</system.web>

Select all Open in new window

What else do we need to look at to ensure this setting takes effect?

Thanks
Iain