Security
MI5 is off to the cloud; GCHQ is ramping up Computer Network Exploitation capabilities; MI6 needs cultural changes to get a new IT platform running smoothly...
The 2023 season was “the first season we travelled with our whole IT equipment without any server rack..."
"Enterprises are deploying a mix of technologies for secure remote access, including VPN, ZTNA, SD-WAN and SASE – on average respondents are using 2.3 different solutions, but..."
VPN appliances "all appear to have been constructed with the code equivalent of string, stamped with the word ‘secure’ and then just left to decay for 20 years..."
"In every insider threat case, there is a combination of network activity and employee behaviour. The malicious activity crosses both physical and electronic modalities..."
Attackers re-write JavaScript loaded by the VPN login page for the Appliance to capture credentials; also grabbed Veeam credentials, moved laterally for full SYSTEM control.
One vulnerability bears a striking resemblance to an 0day that was actively exploited in the wild in November 2023.
"The SEC has not approved the listing and trading of spot bitcoin exchange-traded products"
"Simulate and exercise breach readiness, especially abilities to reduce blast radius of a cyber attack. Involve top leadership, the board, and customers in separate cyber war games, as often as practical..."