Cloud Range, the industry’s leading cyber range solution to reduce exposure to cyber risk across the organization, today announced the launch of its new training program, Cybersecurity Incident Commander Training. Offered for a limited time at no cost, the training is tailored to those managing incidents in the security operations center (SOC).
Previously existing tools and training only focus on individual jobs and tasks in the SOC and, while critical to the team’s ability to detect and remediate incidents, they do not target the Incident Commander role. Further, many teams do not have a specific “commander” role or backup if the designated team lead is unavailable. This new training by Cloud Range is dedicated to the Incident Commander who oversees the SOC team when an incident or event occurs, such as a ransomware attack, data breach, or any other cybersecurity incident.
Aligned with the job description developed by FEMA and the National Incident Management System (NIMS), the Incident Commander is one of the most critical roles during an incident because it orchestrates the team and resources and is the source of “ground truth” on the incident. That’s why the Incident Commander role requires “soft skills” such as leadership and communication that, without, can lead to team breakdowns.
The Incident Commander training is a new stand-alone, online, self-paced course valued at $499. The goal is to provide security professionals with an overview of the responsibilities and skills needed to swiftly resolve an incident. Incorporating real-world scenarios enables learners to determine how to assign tasks, communicate across multiple levels of the organization, and lead the team effectively. The course is designed to highlight strengths and weaknesses so the trainee can improve their ability to manage their team in future situations. The result is that the Incident Commander has a better understanding of their role, how to manage an incident and improve time management, and how to elevate the performance of the incident response team.
After successfully taking the course, which is the first part of the certification process, trainees receive a badge to show completion.
Trainees are eligible for the complete certification after also being the Incident Commander during two of Cloud Range’s live-fire cyber attack exercises, which are dynamic, team-based simulations of real-world attacks on Cloud Range’s virtual cyber range. Like a flight simulator, the attack simulations enable the Incident Commander to fully step into the role, guide the team, work with the incident reporter, and practice all the skills and techniques required to be effective. The comprehensive, two-part training process gives security professionals deep knowledge, insight, and hands-on experience that equips them to be an effective Incident Commander.
Learn more and sign up for the Cloud Range Incident Commander Training, valued at $499 and offered at no cost for a limited time here.
US Agencies warn of ransomware gang targeting critical infrastructure
Posted in Commentary with tags Security on March 5, 2024 by itnerdThe CISA, the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released an advisory warning of TTPs Phobos ransomware attacks are using to target government and critical infrastructure entities.
“Structured as a ransomware as a service (RaaS) model, […] Phobos ransomware actors have targeted entities including municipal and county governments, emergency services, education, public healthcare, and critical infrastructure to successfully ransom several million in U.S. dollars,” the advisory said.
Attack chains typically leveraged phishing as an initial access vector, or vulnerable networks are breached by hunting for exposed RDP services and exploiting them by means of a brute-force attack.
Once successful, the threat actors deploy additional remote access tools, taking advantage of process injection techniques to execute malicious code and evade detection, and making Windows Registry modifications to maintain persistence within compromised environments.
“Additionally, Phobos actors have been observed using built-in Windows API functions to steal tokens, bypass access controls, and create new processes to escalate privileges by leveraging the SeDebugPrivilege process. Phobos actors attempt to authenticate using cached password hashes on victim machines until they reach domain administrator access,” the agencies said.
Phobos has been active since May 2019, with multiple variants identified. Cisco Talos disclosed in November that those behind 8Base ransomware are utilizing a variant of Phobos for their attacks.
BullWall Executive, Carol Volk had this to say:
“The recent Phobos advisory from CISA, the FBI, and the MS-ISAC sheds light on the continued rise of ransomware attacks targeting government and critical infrastructure sectors. As with many ransomware attacks, the Phobos attacks employed phishing and exploitation of vulnerable RDP services and highlights the importance of robust cybersecurity measures at every level.
“Organizations must prioritize implementing multi-layered defense mechanisms, including strong email security protocols and regular security awareness training to thwart phishing attempts. Additionally, securing remote access points and promptly patching vulnerabilities in RDP services can significantly reduce the risk of exploitation.
“However, we continue to see that even well prepared defenses will be breached by determined actors, so regular air-gapped backups, a ransomware containment system and MFA to protect RDP sessions should be part of the defense stack for the day your defenses are breached.”
John Benkert, CEO, Cigent follows with this:
“Broken record here. Protecting critical infrastructure from Ransomware-as-a-Service (RaaS) attacks requires a multifaceted approach that spans technological, regulatory, and educational domains. Given the increasing sophistication and accessibility of RaaS platforms, which allow even low-skilled attackers to launch ransomware campaigns, the security of essential services such as healthcare, energy, transportation, and water systems has never been more important.
“The foundational step in defending against these threats involves the implementation of robust cybersecurity measures that already exist. This includes regular software updates and patch management to close vulnerabilities, advanced threat detection systems to identify and neutralize threats early, and comprehensive data backup strategies to ensure data integrity in the event of a breach.
“Let me be clear, solutions already exist in the commercial sector to protect against these threats. Instead of cultivating these commercial solutions, the government is more concerned with putting out regulations and standards that take years to approve and become obsolete before they are published.”
This should be a clear warning that defences for critical infrastructure specifically, but all organizations and sectors in general need to be a priority. The question is, how many warnings will it take for organizations to get the message?
Leave a comment »