Cybersecurity 🔐 And Much More Newsletter 📪 Vol. 3 Num. 12

12 min readMar 26, 2023

Greetings, friends. 👋

📫 Welcome to my newsletter, if you have not yet subscribed, please do so 🥹. It might include books📚, articles ✍️, tech 💻, tips💡, and cool stuff about cybersecurity 🔒.

Enjoy!

What’s Happening

🚨 Three Must-Reads from CISA

🪪 CISA and NSA Release Identity and Access Management Guidance

The US Cybersecurity and Infrastructure Agency (CISA) and the National Security Agency (NSA) have collaborated in providing the Enduring Security Framework Guidance on Identity and Access Management. This guidance is particularly important in the current digital landscape where cyber threats are rampant and constantly evolving.

The Recommended Best Practices Guide for Administrators that comes with the guidance provides detailed suggestions for mitigating threat actors’ commonly used attack techniques. These techniques include but are not limited to taking control of accounts of former employees; using/creating alternative system access points, gaining access to systems, and exploiting stored credentials.

The guide also provides advice on how to develop effective identity and access management policies and how to implement them in different organizations. By following the best practices outlined in the guide, administrators can ensure that their organizations remain safe from cyber threats and that their sensitive data is protected from unauthorized access.

Security Engineering

🔎🔐 SOC in a Box — Kali is not only Offense, but starting to be Defense 🟣

On Kali’s 10th anniversary, the Kali Linux team released a new version of their operating system, Kali Linux 2023.1. One of the new features of this release is Kali Purple, a new “SOC in a box” platform that allows users to quickly and easily set up a security operations center (SOC) using Kali Linux.

Kali Purple is designed to be a full-stack SOC solution, including tools for monitoring, detection, analysis, and response. It includes open-source tools like Elastic Stack, TheHive, Cortex, and MISP, as well as custom Kali Linux tools like Kali NetHunter and Kali Undercover.

With Kali Purple, users can set up a SOC in as little as 15 minutes, according to the Kali Linux team. The platform is designed to be scalable, with support for multiple users and teams.

Kali Purple is just one of the new announcements in Kali Linux 2023.1. Other updates include a new default shell, ZSH, and improved support for ARM devices. The Kali Linux team has also updated many of the tools included in the operating system, including Metasploit, OpenVAS, and Wireshark.

Overall, Kali Linux 2023.1 is a major update to the popular penetration testing and ethical hacking operating system. With the addition of Kali Purple and other new features, it is sure to be a valuable tool for security professionals and enthusiasts alike.

Cloud Security

☁️ 🔐 Cloud Security Basics — Data Discovery in the Cloud

Performing Data Discovery in the Cloud

Data protection is a crucial aspect of any organization’s security program. One of the most important parts of data protection is figuring out what data is sensitive and where it is stored. In the cloud, sensitive data can be scanned and found with the help of native tools and scripts from the cloud service provider (CSP).

Native CSP Tools to get you started

CSPs such as AWS, Azure, and Google Cloud offer various built-in tools to perform data discovery. These tools can scan the cloud environment and identify sensitive data stored in databases, file storage systems, and other types of storage. For example, AWS offers Amazon Macie, a fully managed data security and data privacy service that uses machine learning and pattern matching to find and protect sensitive data stored in S3 buckets, such as personally identifiable information (PII), financial data, and intellectual property.

Azure offers Azure Information Protection, a cloud-based solution that helps organizations classify and label sensitive data, and detect and respond to data leakage risks. Google Cloud provides Data Loss Prevention (DLP), which can scan and classify data stored in Google Cloud Storage, BigQuery, and Cloud Datastore. These tools can be set up to scan automatically at set times or on demand, so data can be found and protected all the time.

Conclusion

In conclusion, data discovery is a crucial step in data protection. In the cloud environment, native CSP tools and scripts can be used to scan and identify sensitive data stored in databases, file storage systems, and other types of storage. Organizations should use these tools and scripts to find and protect data continuously, making sure that sensitive data is found and kept safe. By putting in place a strong data protection program, organizations can reduce the risk of data theft and make sure they are following the rules for data protection.

Application Security

🧑🏻‍💻 🔐 Fixing AppSec — Continuous Security Testing

Best Practices to Succeed in Implementing Continuous Pentesting

Continuous pentesting is crucial for maintaining the security of software applications, networks, and systems. By doing pentests on a regular basis, organizations can find security flaws and weaknesses and fix them before bad actors take advantage of them. Here are some best practices to succeed in implementing continuous pentesting:

1. Develop a Pentesting Plan

Before conducting pentests, organizations should develop a pentesting plan that outlines the scope of the pentest, the goals and objectives, the types of vulnerabilities to test for, and the methodology to be used. The plan should also include a timeline for conducting regular pentests and a process for reporting and addressing vulnerabilities.

2. Use Automated Pentesting Tools

Automated pentesting tools can help organizations conduct pentests more quickly, efficiently, and accurately. These tools can scan for vulnerabilities in web applications, networks, and systems and provide detailed reports on the vulnerabilities found. Some popular automated pentesting tools include Burp Suite, Nessus, and OpenVAS.

3. Conduct Manual Pentesting

Even though automated tools for pentesting are helpful, they can’t replace the knowledge and experience of human pentesters. Organizations should also conduct manual pentesting to identify vulnerabilities that automated tools may miss. Manual pentesting can involve techniques such as social engineering, penetration testing, and code review.

4. Integrate Pentesting into the SDLC

Pentesting should be part of an organization’s software development lifecycle (SDLC) to make sure security is a top priority from the start of the development process. By conducting pentests at each stage of the SDLC, organizations can identify and address vulnerabilities early on, which can save time and money in the long run.

5. Continuous Improvement

Continuous improvement is key to the success of any security program, including continuous pentesting. Organizations should check their pentesting plan, method, and tools on a regular basis to make sure they are up-to-date and working well. They should also track and analyze the results of pentests and use this information to improve their security posture.

By following these best practices, organizations can succeed in implementing continuous pentesting and maintaining a strong security posture.

Telecom Security

☎️ 🔐 Telecommunication — Private 5G

Private 5G: Use Cases and Security

As organizations continue to adopt 5G networks, many are turning to private 5G as a way to improve network security and performance. Private 5G networks are built and managed by organizations themselves, rather than relying on public carriers. This allows for greater control and customization of the network, as well as improved security.

Use Cases for Private 5G

Private 5G networks can be used in a variety of industries and settings. Here are a few examples:

Manufacturing
Private 5G networks can be used in manufacturing plants to improve communication and automate processes.
For example, sensors can be used to monitor machinery and track inventory, while robots can be used to assemble products.
Private 5G networks can also be used to improve worker safety by providing real-time monitoring of hazardous environments.
Healthcare
Private 5G networks can be used in healthcare settings to improve patient care and safety. For example, sensors can be used to monitor patients and track vital signs, while telemedicine can be used to provide remote consultations.
Private 5G networks can also be used to improve the security of patient data by providing a closed network that is less susceptible to breaches.
Transportation
Private 5G networks can be used in transportation settings to improve safety and efficiency. For example, sensors can be used to monitor traffic and optimize routing, while autonomous vehicles can communicate with one another to avoid collisions.
Private 5G networks can also be used to provide real-time updates to passengers, such as delays and schedule changes.

Security Considerations for Private 5G

While private 5G networks offer improved security over public networks, they still require careful planning and management to ensure they are secure. Here are a few considerations:

Authentication and Authorization
Private 5G networks should require strong authentication and authorization mechanisms to ensure that only authorized devices and users can access the network.
This can be done through the use of digital certificates, and mutual authentication.
Encryption
Private 5G networks should use strong encryption to protect data in transit. This can be done through the use of VPNs or other encryption protocols.
Network Segmentation
Private 5G networks should be segmented to limit the attack surface and reduce the impact of any potential breaches.
Monitoring and Response
Private 5G networks should be monitored for suspicious activity and breaches, and a response plan should be in place in case of an incident.
This can include the use of security information and event management (SIEM) tools and incident response plans.

Private 5G networks offer greater control and customization, and improved security. Careful planning and management are required to ensure security. Organizations can follow best practices for authentication, encryption, network segmentation, and monitoring to take advantage of these benefits. Additionally, private 5G networks must be properly configured and maintained, including regular software and firmware updates, access controls, and employee training.

My Favorites

📚 🤩 Security Books to Explore

Here are three books to learn about 🐞 Bug Bounty:

“The Bug Hunter’s Diary: A Guided Tour Through the Wilds of Software Security” by Tobias Klein. This book is a firsthand account of the author’s experience as a bug bounty hunter, detailing his methods and strategies for finding vulnerabilities. Key takeaways include the importance of persistence and creativity, as well as the need to understand the mindset of attackers. This book is suitable for beginners.
“Web Application Security Testing with Burp Suite” by Sunny Wear. This book focuses specifically on using Burp Suite, a popular web application security testing tool, to identify vulnerabilities. It covers topics such as reconnaissance, mapping, and exploitation, as well as how to use Burp Suite effectively. This book is suitable for intermediate-level readers.
“Fuzzing: Brute Force Vulnerability Discovery” by Michael Sutton, Adam Greene, and Pedram Amini. This book provides a comprehensive overview of fuzzing, a technique for identifying vulnerabilities by sending random or semi-random inputs to a target system. It covers different types of fuzzing, such as mutation-based and generation-based, as well as how to build a custom fuzzer. Key takeaways include the need to understand the target system and how to identify and triage bugs. This book is suitable for advanced readers.

📚 🤩 Non-Fiction Books to Explore

Here are three books to learn about how to learn:

“The First 20 Hours: How to Learn Anything Fast” by Josh Kaufman. This book provides a framework for learning any new skill quickly and efficiently. The author argues that by focusing on the most important aspects of skill and practicing deliberately for 20 hours, anyone can become proficient. Key takeaways include the importance of setting a clear goal, breaking the skill down into manageable parts, and practicing consistently. This book is suitable for beginners.
“Peak: Secrets from the New Science of Expertise” by Anders Ericsson and Robert Pool. This book provides a comprehensive overview of the science of expertise and how to achieve it. The authors argue that deliberate practice is key to developing expertise and providing a framework for how to structure practice sessions effectively. Key takeaways include the need to push beyond one’s comfort zone, receive feedback, and practice consistently over a long period of time. This book is suitable for intermediate-level readers.
“Mastery” by Robert Greene. This book examines the lives of historical and contemporary masters in various fields and identifies common traits and strategies that contributed to their success. The author argues that mastery is a process that requires intense focus, discipline, and persistence. Key takeaways include the importance of finding one’s life’s task, developing a deep understanding of one’s craft, and embracing failure as part of the learning process. This book is suitable for advanced readers.

👨‍🏫 🔐 How Long Does It Take to Learn a Skill?

Author Malcolm Gladwell popularized the “10,000-hour rule,” which states that it takes roughly 10,000 hours of purposeful work to become an expert in a field. Several experts, however, have argued that the time needed to master a skill varies according to the difficulty of the skill, the individual’s innate abilities and background, and the quality of practice; therefore, this rule is not universally accepted.

As an added note, while competence in some disciplines may require 10,000 hours of practice, this figure may be arbitrary. Some basic computer skills, for example, can be learned in a matter of weeks, while it could take decades to master a musical instrument.

Ultimately, the number of factors determines how long it takes to master a new talent. Anyone can get good at anything by putting in a focused effort, figuring out where they need to improve, and practicing in a systematic way.

🎙 Listen/Watch — How to Learn Anything… Fast — Josh Kaufman

Author and business adviser Josh Kaufman reveals a new approach to acquiring new skills quickly with just a small amount of practice each day.

Watch the keynote.

Quote of the Week

“The beautiful thing about learning is that no one can take it away from you.” — B.B. King

If you’re interested in starting a career in cybersecurity, watch this one, and don’t forget to 🔥 ***Subscribe to my Youtube Channel*** and leave a comment if there are any topics you’re interested in seeing in my next video.