Zachary Ignoffo

Understanding how to utilize Kroll Artifact Parser and Extractor (KAPE) can significantly enhance your forensic analysis capabilities. KAPE is a tool designed to parse and extract Windows forensics artifacts swiftly, expediting incident response processes. KAPE operates through the concepts of targets and modules. Targets are the forensic artifacts to be collected, while modules are programs that process these artifacts to extract information. With KAPE, you can collect files from live systems or storage devices and process them efficiently. Using KAPE involves configuring targets and modules. Targets specify what artifacts to collect, and modules dictate how to process them. Compound targets allow for the collection of multiple artifacts with a single command, streamlining the triage process. Understanding the structure of KAPE files (.tkape for targets, .mkape for modules) is essential. These files define the paths, categories, and file masks for collection. Similarly, modules (.mkape) specify the commands to run on collected data and their output formats. KAPE's functionality extends to the command line, offering flexibility and automation. Commands can be crafted to specify target sources, destinations, and module processing, granting fine-grained control over forensic procedures. Additionally, batch mode enables the execution of multiple commands in sequence, ideal for repetitive tasks. In a cybersecurity analyst position, mastering KAPE empowers you to conduct efficient forensic analysis, aiding in incident response, evidence collection, and data processing. Through KAPE, you can streamline workflows, optimize resource utilization, and bolster your investigative capabilities. TryHackMe Merit America

2

Kroll Cyber Risk - Making sure the only bag you are holding after a Cyber Threat is a cornhole beanbag. Come visit us at Booth 556 at the Gartner Security and Risk Management Summit!

24

Miss out on MUS2024 this year? You can catch my keynote and learn about some sneaky things that shortcuts can do by tuning in Wednesday! Learn how I was able to not only mimic spyware capabilities in native iOS but also track all of their actions and artifacts!

31

Is it material? Time to decide. Advanced Cyber Law can help.

22

1 Comment

Below is a good example of why every DIB contractor/company must have a cybersecurity third-party risk program. While there are tools and services available to help vet partners and sevice providers, don’t simply rely on those reports. Use the reports to conduct your research to dig deeper and validate the true headquarters, corporate linkage and ultimate beneficial owners of a company. In 2023 alone, I discovered over 30 companies which were registered as U.S. owned companies. The companies were not U.S. owned or based. They were actually headquartered overseas, with links to companies or owned by citizens of adversarial countries and/or companies that are members of the BRICS alliance. Kudos to Nick Roy who discovered the cloud server in question for this article. https://lnkd.in/gPyjRz9M

1

The Mystery of the Targeted Ad and the Library Patron, it reads like a book, our audiobook, interesting https://lnkd.in/eN_n4W7a

4

Are you applying to dozens, if not hundreds of security operations openings and not hearing back? Quinnlan Varcoe will be teaching Hacker in Heels Insiders how to stand out in a unique way, and form genuine connections with people who can give you the opportunity to start or advance your career in security operations. Join me and our impressive, niche community of women in cybersecurity as we talk all things security operations tonight. 📆 Tuesday, June 11 @ 4P PT / 5P MT / 6P CT / 7P ET EXTRA: Would you, or someone you know make an excellent guest mentor? I'm looking for someone for our July 9th call. Priority will be given to women of color and/or women who want to speak on a cybersecurity subject (as opposed to personal branding, confidence, etc.) Share your proposed topic in the comments, or tag a nominee! P.S.—We offer to pay all our guest mentors, because we believe all women should have the option to be compensated for their labor 💜 #womenincybersecurity #cybersecurity #securityoperations #secops

63

15 Comments

Join the NIST Privacy Framework Team for our upcoming Ready, Set, Update! Privacy Framework 1.1 + Data Governance and Management Profile Workshop. Mark your calendars for June 25th and June 26th, 2024, as we dive into panels and breakout sessions to help shape the Privacy Framework Version 1.1 update and development of a joint NIST Frameworks Data Governance and Management (DGM) Profile. Hope to see you there in DC! For more information about the workshop, including the agenda and registration, please visit the event page: https://lnkd.in/gYkpKYX9 #privacy #privacyframework #datagovernance #NIST

38

2 Comments

#RSAC Reporter’s notebook, Day 3: There seems to be a trend in cybersecurity marketing of claiming common terms are no longer functional concepts, but replacing them with similar tools they say are obsolete. For example, there are people walking around with yellow signs proclaiming SOAR (security orchestration, automation, and response) is “dead”. This comes from the people at Torq who are, instead, offering a “hyperautomation” tool, which, based on what I can see will orchestrate and automate responses to security threats. The reality is that SOAR is still a standard tool, along with Security information and event management (SIEM), which some other companies claim is dead or inadequate, except for their SIEM tool. RSA has been pushing the idea that identity access and management (IAM) is also obsolete and we should focus on identity security instead… but how that is different other than the name escapes me. Meanwhile, some themes appear to be rising. Talked with people from Promon about mobile application security and there are several other companies waving that flag. It’s always been an issue, but with the EU forcing Apple to open it App Store to invalidated apps, it’s going to be a bigger problem. You may argue that what Apple charges developers and limits who gets in isn’t fair, but I always appreciated their work in making sure products were safe. Now we can’t be sure unless Apple decides to add a verification badge to apps in the store. Chatting with Ilya Dreytser from Quokka.io he pointed out that the delta between when an app is added to a store to removing it when it is discovered to be unsecured is increasing and will get even worse now. That sounds like it might be a good idea or a special issues next year. Another interesting subject is email and messaging security, which is a bigger problem than ransomware and nation-state hacking, which gets most of the headlines. And when I say bigger and mean overwhelmingling bigger. It’s also foundational to successful ransomware attacks. That’s why I’m going talk more with SonicWall and Abnormal Security. Be on the lookout for the podcasts. Heading back to the show floor now stopping by a few booths since I didn’t have time to meet one on one. Keep your eyes peeled for the guy in the brown trilby. Axur, Fortra, iboss, Ordr Inc., Tufin, OpenText

13

4 Comments

What are the SEC rules and what do they mean for the cybersecurity industry? As a reminder there are three rules: 8-K 105: Cyber incidents. Disclosures of material incidents must be made within four days of discovery. 10-K 106(b): Risk management. Explain your cyber risk management processes. 10-K 106(c): Governance. Share details of oversight from the board and management. As for any other material incident, read more detail in our whitepaper 👇 ==

1

For those looking for their first or next cybersecurity role, here is some interesting research from NICE's CyberSeek job study for you... There are many job openings in cyber, with approximately 15% (469,930) of cybersecurity jobs being unfilled (CyberSeek). The harsh reality of those open positions is that they are demanding more experience than the market can provide. The data in the CyberSeek study, a joint research effort led by the National Initiative for Cybersecurity Education (NICE), CompTIA, and Lightcast, provides job seekers and employers with insights about the number of qualified professionals (based on certification) in states and metropolitan areas around the U.S. Before proceeding I'll also acknowledge that certifications are not always the best measure of an individuals skill and certainly not their potential. However, certifications can often be the most efficient way to select a handful of candidates to interview from a pool of hundreds or thousands. The data for my locality, Richmond, Va., shows the following: - Richmond is slightly below the national average when it comes to filling jobs, with 17% of available roles being unfilled. - The shortage of cybersecurity professionals began around 2018, peaked around 2022 with 47% of the total available cyber roles in Richmond being unfilled, and has rebounded in the past two years to come near the national average with 17% of roles being unfilled. - Oversight and Compliance roles lead the way with the most openings, followed closely by Implementation and Operations, Design and Development, Protection and Defense, and falling off drastically with other types of roles. - There are approximately 1,332 CompTIA Security+, 566 CISSPs, 321 GIACs, and 89 CIPPs, and there are not enough CISAs or CISMs to be recorded. Meanwhile, there are currently 710 open roles for CISSPs, 505 for CISAs, 385 for CISMs, 376 for CompTIA Security+, 232 GIACs, and 61 CIPPs. Here is what the data says to me, much of which is no surprise: 1. There is a clear need for experienced professionals (CISSPs, CISAs, CISMs) 2. There are many entry-level professionals (CompTIA Security+), with 1,332 in the City and only 376 open roles looking for this certification. 3. Looking in an area outside of your immediate metropolitan zone may change your luck in the job hunt significantly. Many of the numbers I've cited for Richmond are flipped on their head if you look at Northern Virginia & D.C. statistics. 4. To break into cyber, you may have to be willing to work in a role that isn't your dream role in the immediate and long-game your path to your desired end-state. (This was me) I thought this was an interesting resource worth sharing for those currently interested in the market. You can check out the CyberSeek study results here: https://buff.ly/2J89dpf #cybersecurity #infosec #jobsearch #careers

23

3 Comments

I’m so excited to be available to small and medium businesses looking to implement #privacybydesign and #securitybydesign as one of many SMEs who can be leveraged through Zatik Security's fractional security model. But #SMBs won’t be able to shift the insecure tech landscape *all* of us are operating in on their own. As this year’s #DBIR (available at verizon.com/dbir) stated in its introduction of the #supplychain #interconnection metric on page 13, “calculated a supply chain interconnection influence in 15% of the breaches [they] saw... [representing a] 68% year-over-year growth.” Then on page 14, just as Cybersecurity and Infrastructure Security Agency, 👑 Kymberlee Price, Joshua Corman, and countless others, including myself, have said: “As much as we can argue that the software developers are also victims when vulnerabilities are disclosed in their software and sure, they are), the incentives might not be aligned properly for those developers to handle this seemingly interminable task [of remediating every vulnerability]. These quality control failures can disproportionately affect the customers who use this software... This metric ultimately represents a failure of community resilience and a recognition of how organizations depend on each other.” The writers go on to say, “We recommend that organizations start looking at ways of making better choices so as not to reward the weakest links in the chain... we believe the only way through is to find ways to hold repeat offenders accountable and reward resilient software and services with our business.” The fact of the matter is, the only organizations capable of doing this across the supply chain are the Big Players (with BIG contracts) in highly regulated industries—especially Finance and TeleCom—who can *both*  1) hire the talent required to really dig in to the evidence of their vendors’ security posture, and   2) then throw the weight of those BIG contracts around to incentivize substantive improvement. Demand to see vulnerability scans. Demand to see FULL #pentest and #BCDR results, not whatever watered down summary they’re going to offer you. You’re the only ones who can. I sat on one side of that table (I wrote those summaries), and I’d *love* to sit on the other. If your company is serious about #supplychainsecurity, #securesoftwaredevelopment, and exceeding the minimum that is “compliant,” let’s talk. I believe in building better I know how to architect, implement, and communicate systems deserving of trust (and how to evaluate and determine systems undeserving of trust). The only way we can turn the tables on bad actors is together, by shifting all three points of the Technology Ecosystem Triangle—Supply, Demand, and Regulation/Oversight-- together. So in the wise words of Bender, let's gooo alreaddayyyy. 😎

18

Exciting news to share! VikingCloud's 2024 Threat Landscape Report has been included in The Wall Street Journal's Morning Risk Report newsletter. Read the post below to find out more! #Cybersecurity #CyberRisk

1

Thrilled to share our new Rapid Response service! If you're tired of playing catch-up with cyber threats, this service is for you. It provides the advanced threat intelligence you need to stay steps ahead of potential security breaches. Dive into our press release to learn more about how Rapid Response can fortify your defenses and streamline your security operations.

2

The article "What If The Scathing UnitedHealth Cyber Rebuke Was Yours?" by Noah Barsky explores the implications of Senator Ron Wyden's stern warning to corporate boards and c-suites in response to a cyberattack on UnitedHealth Group. Wyden called to the Securities and Exchange Commission and the Federal Trade Commission to conduct an investigation into UnitedHealth Group's cybersecurity and technological problems. The purpose of this investigation is to ascertain whether any federal laws were breached and to ensure that senior officials are held responsible for their actions. This scenario highlights the increasing examination of business cybersecurity procedures and the possible legal and regulatory repercussions of inadequate cyber defenses. The article highlights the need of enhancing cybersecurity measures for all firms and ensuring that their leadership actively engages in protecting their digital infrastructure. This is crucial in order to prevent breaches and mitigate the risk of facing regulatory consequences. The provided link leads to the article titled "What if a scathing cyber rebuke from UnitedHealth was directed at you?" https://lnkd.in/erPNh4nS

2

1 Comment

Gain insights from our GuidePoint Research and Intelligent Team in our live talk on April 24 at 1pm ET as our analysts share #ransomware trends from Q1 '24 and offer strategies to bolster your organization's security posture. R.S.V.P. today. https://okt.to/Cdselb #RaaS #cybersecurity #threatintelligence

1

#RSAC Reporter’s notebook, Day 3: There seems to be a trend in cybersecurity marketing of claiming common terms are no longer functional concepts, but replacing them with similar tools they say are obsolete. For example, there are people walking around with yellow signs proclaiming SOAR (security orchestration, automation, and response) is “dead”. This comes from the people at Torq who are, instead, offering a “hyperautomation” tool, which, based on what I can see will orchestrate and automate responses to security threats. The reality is that SOAR is still a standard tool, along with Security information and event management (SIEM), which some other companies claim is dead or inadequate, except for their SIEM tool. RSA has been pushing the idea that identity access and management (IAM) is also obsolete and we should focus on identity security instead… but how that is different other than the name escapes me. Meanwhile, some themes appear to be rising. Talked with people from Promon about mobile application security and there are several other companies waving that flag. It’s always been an issue, but with the EU forcing Apple to open it App Store to invalidated apps, it’s going to be a bigger problem. You may argue that what Apple charges developers and limits who gets in isn’t fair, but I always appreciated their work in making sure products were safe. Now we can’t be sure unless Apple decides to add a verification badge to apps in the store. Chatting with Ilya Dreytser from Quokka.io he pointed out that the delta between when an app is added to a store to removing it when it is discovered to be unsecured is increasing and will get even worse now. That sounds like it might be a good idea or a special issues next year. Another interesting subject is email and messaging security, which is a bigger problem than ransomware and nation-state hacking, which gets most of the headlines. And when I say bigger and mean overwhelmingling bigger. It’s also foundational to successful ransomware attacks. That’s why I’m going talk more with SonicWall and Abnormal Security. Be on the lookout for the podcasts. Heading back to the show floor now stopping by a few booths since I didn’t have time to meet one on one. Keep your eyes peeled for the guy in the brown trilby. Axur, Fortra, iboss, Ordr Inc., Tufin, OpenText

2