For providers

Today, CISA, the National Security Agency (NSA), and partners released Securing the Software Supply Chain: Recommended Practices for Software Bill of Materials Consumption. Developed through the Enduring Security Framework (ESF), this guidance provides software developers and suppliers with industry best practices and principles, including managing open source software and software bills of materials (SBOM), to maintain and provide awareness about the security of software. Organizations can use this guide to assess and measure their security practices relative to the software lifecycle; the suggested practices may be applied across the acquisition, deployment, and operational phases of a software supply chain. CISA encourages cybersecurity defenders to review this guidance and to speak to their software vendors about implementing its recommendations.

Code injection techniques (T1055 from MITRE[1]) is a common technique these days. It&#x27s a nice way for an attacker to hide malicious code into a legit process. A deviation of this technique is called “Process Hollowing”[2] where code of the legit suspended process is wiped and replaced by malicious code. Code injection is performed by calling Microsoft API calls like: VirtualAllocEx(), NtUnmapViewOfSecrio(), WriteProcessMemory(), ... (they are many others available)

A premier Russian APT used living-off-the-land techniques in a major OT hit, raising tough questions about whether or not we can defend against the attack vector.

We need to develop our own talent, find ways to protect IP, and play the long game on AI against the Chinese and other tech adversaries – we can’t do it with EOs and more regulations.

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

If, like Mohit, you enjoy both software development and networking, then Cisco DevNet certifications has plenty to offer by integrating network infrastructure with software applications, automation, and programmability. Here are Mohit's top recommendations to help you get started on your own DevNet learning and certification journey.

Money Message is an insidious ransomware family known for resisting detection and remediation in various ways. We walk through a recent case.

The attacks are another manifestation of the concerning rise in information stealers for harvesting data and enabling persistent access to enterprise networks.

Meet "farnetwork," one of the most prolific RaaS operators around, who spilled too many details during an affiliate "job interview."

New Vanta report on trust offers strategies to automate the most tedious tasks and get security teams focused on their most strategic work.