Cybersecurity And Much More Newsletter — Week 52 (2021)

6 min readMar 28, 2022

Greetings, friends.

Welcome to my weekly newsletter, if you are not yet subscribed, please do. It might include books, articles, tech, tips, and of course interesting stuff about cybersecurity.

This newsletter also includes some of the key takeaways from my recent publications, articles, and posts.

Enjoy!

A word about the end of 2021

It’s the end of the year. Yes, I know that we all had a long list of goals to accomplish, but we are just humans and might or might not have reached those goals. But at the end of the day, we all have achieved something to a certain extent.

So, what to do? We must keep in mind that the journey is more important than the destination, goals are like wishes, and they can’t decide how we should be living our lives or what makes us happy.

Once we realize that perfection is an illusion that will drive us into becoming professional procrastinators, we will get more things done, oh wait, we will get the most important things done, because it’s not about quantity, it’s about the importance and the impact it has on our lives. Why? because done is better than perfect.

It’s never the right time to do or not do something, just take small steps and keep moving forward.

Books I’m reading right now

P.S: I will be doing some book summaries really soon.

RISK — by McChrystal
Frames of Minds — By Howard Gardner

Books I recommend reading

Lives Of The Stoics — By Ryan Holiday and Stephen Hansel
Doesn’t Hurt To Ask — By Trey Gowdy
Learn To Learn — By Petter Lynch

Articles I’ve read recently

Interesting Content To Watch

The Robot That Eats Trash! By MARK ROBER on Youtube
Medical diagnosis using AI! By PRATIK SHASH at TEDX

Learn How To Say “No”

Saying “No” is an art? Well, it’s a really important skill to learn. A lot of people link it to pleasance or deception, being rude or nice, and that we are not living to make people happy, because we’re not selling ice cream. But in reality saying “No” can be done graciously when not having time or energy to engage with someone, when having more important things to focus on, or just because it’s not aligned with your long-term goals. In some cases, you might say it just because you can’t give it the attention it deserves to come up with good quality output.

Long story short, when people say “No”, they must have a reason, same to you, explain yourself with grace, and put first things first.

What Is Paralysis Analysis?

We live in an era where information is the nerve of society, it makes it or break it, and it’s affecting all of us.

Overthinking is a big problem these days, especially due to the high volume of information we are exposed to, and this is making us unable to make decisions or pushing us to take the wrong path.

Too many options are often the source of most of the problems, from choosing a school to picking the best career path, or even when buying a car or investing in stocks.

The fear of choosing the wrong option increase exponentially with the amount of information we’re exposed to.

The solution is to take it easy, and don’t try to eat the elephant in one bite. Take small steps toward your goals, this will give a peace of mind, time to adjust and improve but especially spread the risk.

Again, remember that done is better than perfect.

2021 Cybersecurity Rewinds

Breaches

Twitch: In October 2021, 125GB of data was posted online from Twitch with 6000 internal repositories, SDKs, and red teaming tools.
LinkedIn: In April 2021, 500 million profiles were leaked including the users’ personal information.
Colonial Pipeline: In May 2021, Colonial Pipeline, the largest pipeline company in the US had to take its operations down due to a Ransomware attack.
Kaseya: In July 2021, REvil Ransomware Gand exploited a zero-day vulnerability on the Kaseya VSA solution (CVE-2021–30116) to gain admin access, and use it as a getaway to launch ransomware attacks on Kaseya’s customers. REvil asked for a $70M ransom and affected tens of thousands of customers.
NSO: In July 2021, a new report published by Amnesty International described how the Pegasus spyware is deployed, how it operates, and some of the high-profile cases subject to espionage.
Microsoft: In March 2021, A Microsoft Exchange vulnerability led to multiple data breaches for at least 30,000 companies.
Log4J: On November 24th, 2021, Alibaba’s Cloud Security Team had privately disclosed Log4Shell or CVE-2021–44228 zero-day vulnerability to the Apache Software Foundation, then was made public on December 9th, 2021. This vulnerability can be explained simply as indecision to differentiate between data and executable commands that allow attackers to run their malicious code.

Alliances

Here are some of the recent security mergers and acquisitions.

Zscaler acquired Smokescreen Technologies for active defense and deception technologies.
Splunk acquired TruSTAR, the threat intelligence exchange company.
Tenable acquiring Alsid Limited for quantum encryption.
Cisco acquired Kenna Security for risk intelligence and vulnerability management.
Forcepoint acquiring Cyberinc for remote browser isolation.
Deloitte acquired aeCyber solution to help with cyber resilience, regulatory, and compliance.
Imperva acquired CloudVector for advanced API security.

Technology

I would say that the technology to highlight is “Multi-factor Authentication”, yes it’s still on the top list of recommendations, and yes it can be bypassed sometimes, but like we said, “Done is better than perfect”. However, not only because of last year or since the pandemic started, but the controls/technologies below were neglected for ages, and now they came back to the surface.

Insider Threat Management: by far one of the hardest risks to deal with as an organization is to protect sensitive information from insiders as they’re already in and are trusted. However, It’s still a challenge, but a lot of technologies help prevent insiders breaches, the detection is still tricky where security is not mature enough, but this area needs definitely more attention.
Data Governance: organizations’ growth and adoption of digital technologies are exponentially increasing the volume of data to be stored, backed up, managed, protected, and destroyed. For that, it’s crucial to manage and protect the data through its lifecycle, from creation to destruction, from classification, to access control, backup, and destruction.
AI and Deep Learning: for automating detection, response, and processing of natural language.
Active Defense: Where security teams use offensive tactics to slow down or stop hackers to make cyber attacks more difficult to undertake. This also uses deception technologies.
Deception: Distract attacks from the company’s valuable assets and redirect them to a trap.
Behavioral Analysis: new threats are discovered every day and zero-days are a reality, this makes traditional security not effective and slow at detecting non-authorized actions and malicious behaviors. That’s why it’s important to establish baselines for users and machines to identify the drift and detect anomalies.
Securing Backups: Ransomware attacks are the new normal, and are also targeting backups to reduce the chances that the victims can recover their data and not pay the ransom. This made securing backups a must, not only with security controls like encryption and isolations but also with processes.
Zero Trust: A lot of companies are still struggling with segmentation and having both external and internal networks at an acceptable level of security. Assuming that the network is compromised and not trusting anything while enforcing controls, policies, automation, and monitoring is the key.
Mobile Security: Mobile devices are the most devices these days and for sure contain more sensitive data than before. That’s why it getting greater attention this year and this is making the mobile security market booming offering software and hardware to keep these previous pieces of glass secure.
3rd Party Risk: Protecting your company from the unknown is frustrating, especially when a breach is caused by a lack of security on your trusted MSP side. That’s why having the right policies and technologies in place to vet 3rd parties but also to monitor any abnormal activities is a must to diminish this inherent risk.

Check out my latest video about Risk Management, If you’re interested in starting a career in Cybersecurity, watch this one, and don’t forget to subscribe to my channel and leave a comment if there are any topics you’re interested in seeing on my next videos.

Check my other stuff here.

Originally published at https://www.linkedin.com.