Just like applications and firmware, people need to be kept up to date to protect against the latest malware threats. Implementing cybersecurity awareness training is a cost-effective and increasingly necessary solution. More and more oversight bodies require information security training as a part of compliance regulations. Additionally, consumers are demanding intensified cybersecurity. According to Arcserve, […]

Bipartisan bills before Congress targeting Big Tech What is it? Two bills attempting to reduce the power of Internet monopolies are currently being debated in the United States Congress: S. 2992, the American Innovation and Choice Online Act, and S. 2710, the Open App Markets Act.  Both bills are substantial and complex. One of the […]

This concept should be extended to all your applications as well. Software bills of materials (SBOM) promise many of the same benefits as physical BOMs. Much like their physical cousins, SBOMs list out each component of a piece of software. The process is more complex than it sounds at first because modern software is often […]

Information security focuses on three concepts, known colloquially as the CIA triad: Confidentiality. Stored data is safe from unauthorized access. Integrity. Data is reliable and accurate. Availability. Data is available on demand. Information privacy, on the other hand, involves: Collection of personal information. The authorized usage and disclosure of personal information. Data quality. Access to […]

Those are fun because it means: The vendor has to hustle to understand the vulnerability and develop both workarounds and a patch. There’s a chance this vulnerability has been in use by attackers for a while, but none of our security controls were able to detect it. It’s like finding a spy cam in your […]

Using a ZTN, your company can employ the same process of collecting information to ensure protection against cyberattacks. It can be challenging to know where to begin when looking to improve your company’s cybersecurity mechanisms. OnX Canada’s security services can equip your organization with the support you need to identify and manage threats across your […]

The MITRE ATT&CK framework has expanded since then to document more TTPs used against macOS, Linux, mobile operating systems, network infrastructure devices, cloud systems, and other enterprise IT technologies. By cataloging the tactics that cyber criminals use to gain unauthorized access, the ATT&CK framework helps cybersecurity teams detect and defend against potential threats. Here’s how […]

It’s easy to feel intimidated by the CSF from the National Institute for Standards and Technology (NIST). With 23 categories and 108 subcategories detailing key aspects of cybersecurity, the framework might seem as impossible (and as unappetizing) as eating an elephant. It’s hard to know where to begin. But like any valuable and effective undertaking, […]

So what should you do if you have been impacted by this criminal attack? I’ve had similar considerations in my time as a security leader—here’s my take. First, if you have cybersecurity insurance, hopefully you have called your insurance provider and you are working with them to obtain the necessary resources to get back up […]

Equipped with a thorough understanding of these security frameworks and the support of a dedicated security partner like OnX Canada, organizations can strengthen their defenses against cyber threats. A robust IT security program can give your company the ability to assess ever-changing risks and take measures to establish security policies, conduct ongoing testing and training, […]

1.Back up your Active Directory servers. Folks, the number of organizations that have to rebuild their AD after a ransomware incident is downright heartbreaking. Don’t assume that “someone’s doing it.” It is likely that your domain controller is one of the most critical machines in your environment. Know that just doing snapshots aren’t sufficient. Microsoft […]

We understand vulnerability remediation can be disruptive to your business. We’re working with F5 to ensure you can efficiently update your BIG-IP and BIG-IQ systems to the latest, most secure, and best-performing versions. There are resources available about the vulnerabilities and how to update or upgrade your BIG-IP and BIG-IQ systems on the F5 vulnerability response site: Security advisories […]

A growing problem Phishing remains the method of choice for the vast majority of cyberattacks. Using sophisticated social targeting, disguised links and attachments, cyber criminals can do in seconds what could take hours or days for an advanced piece of software to do: circumvent a security platform and gain access to sensitive data or critical […]

Penetration testing explained In the 50s, fleets of aircraft were in use all over the world, but facing a dangerous problem: running into birds in midair. This led to technical advances in building new windshields and new engines, but engineers needed to ensure that their designs would satisfy their requirements. So how do you make […]

Known issues: what attackers are already looking for The time is ripe for attackers to analyze different videoconferencing solutions for vulnerabilities, analyze them, and exploit them to run their code, gain unauthorized access to corporate infrastructure, and conduct additional malicious activity. So what can you do? How do you do it? The good kind of […]

Endpoint protection helps businesses keep critical systems, intellectual property, customer data, employees, and guests safe from ransomware, phishing, malware, and other zero-day cyber attacks.  Why businesses need endpoint protection: Criminals are constantly developing new ways to attack networks, take advantage of employee trust, and steal data. Smaller businesses may think they’re not a target, but […]

Security plays an additional role in a crisis like COVID-19 in protecting an organization’s ability to respond effectively, which sometimes means accepting more risk. Security has to be laser-focused on ensuring a physical or cyber crisis does not impede the organization’s response efforts. It also needs to be a part of the ongoing risk decision-making […]

The security team has a particular responsibility in helping to answer these questions. The mission of a security team is to protect a business from risk. The risk of a pandemic eliminating supplies, services, and customers, as well as forcing employees to stay home, etc., probably was not on the radar of most businesses. It […]

A recent example was provided by an attacker penetrating an IoT-based HVAC system that ultimately provided the attacker a nearly unrestricted path all the way to the victim corporation’s Point of Sale systems. Table of Contents: How Network Access Control works How NAC solves IoT device vulnerabilities A common misconception about modern NAC solutions NAC […]

Attackers are capitalizing on our fear Cybercriminals and malware authors always try to find the most effective way to trick users into making poor, risky choices. Fear is an extremely effective mechanism, so in the last weeks we’ve seen this happen with the pandemic. Phishing attacks that purport to carry news about quarantines and lockdowns, […]

Two items for home users and consumers: We will see more discovered vulnerabilities in, and attacks against, so-called “smart home” products, such as smart speakers, security systems, and cameras. Any time we see widespread deployment of technology that is, relatively speaking, in the early stages of maturity, we expect that attackers will pay attention and […]

Exploring offensive tools Learning the tools that hackers use to break into systems is essential for any IT Security technician. Not only does this knowledge help you learn what an attacker can and cannot do, but you will better be able to guard against threats and have the proper defenses in place to combat any […]

To achieve the Cisco Master of Security Certification, OnX team members had to show their exact understanding of individual Cisco security practices, as well as demonstrate a deep understanding of how those practices should function as a cohesive set of solutions. The OnX team also had to showcase current examples of successful projects in which […]

The Internet Security Threat Report (ISTR) published by Symantec in April of 2017, notes that the number of malware variants has risen to 357 million different strains. To put that in perspective, that’s roughly one malware strain per 21 people or roughly one strain for every person online. The real problem is one of scope; […]

This particular ransomware strain, although hitting numerous hospitals in the UK and many other organizations across the world had a kill switch. The ransomware would attempt to connect to a domain with a very long and complex name, if the domain was _not_ live, the ransomware proceeded to encrypt all files. If the domain _was_ […]

Intrusion Detection Is Not A Cure-All A ransomware attack in early 2016 dubbed “SamSam” was so severe — and, frankly, frightening — that the FBI sent out an alert to watch out for it. The problem was hackers discovered a huge security hole in a popular piece of open-source networking software and used it to […]

Understand the Key Web App Attack Vectors Start by familiarizing yourself with hackers’ favorite ways into apps, such as: SQL injections Cross-site scripting (XSS) Denial of service (DoS) attacks There are many more, of course, and new ones are being dreamed up every day. Make sure your security team stays abreast of all of these […]

These are things to think about before you get to the type of environment that has hundreds and hundreds of hosts, and thousands of guests, across multiple hypervisors.  Are you even in the ballpark when it comes to best practices, measuring performance and security? As a specific example, let’s talk about security. Most shops spend […]

Personal preferences for Apple IOS, Google Android, and Microsoft Windows-based devices are driving consumer devices into the corporate networks and create device management and data security concerns. Home offices, the desire to have the newest devices on the market, tablets, netbooks, and smartphone preferences all cause a need for organizations to create a “BYOD policy”. […]