Trending Articles
Trending Topics
Trending
Remember that distant time before the internet? Even before then, says Phil Robinson, Founder of Prism Infosec, he was “testing the security of systems and networks”. With an abiding love of tech, it should be no surprise that his career has focused on information security.
We’re particularly interested in Phil’s take on ethical hacking. He was involved in the formation of the Council for Registered Ethical Security Testers (CREST), and believes ethical hackers are a crucial – perhaps underappreciated – part of our cyber defences.
“Ethical hackers are driven by a passion for problem-solving and exploitation, but from an ethical perspective,” Phil explains in the full interview below. “To some, it is more a lifestyle than a job as they uncover vulnerabilities and disclose them responsibly to relevant stakeholders, whilst suggesting ways to fix the issue at hand.”
As a consultant and risk advisor, Phil has delivered cybersecurity advice and guidance to the UK government and agencies. He regularly speaks about penetration testing and e-crime to help promote cybersecurity awareness and industry best practices. And now, you can benefit from his 25 years of hard-earned wisdom too.
I’m Phil Robinson, Principal Security Consultant and Founder of Prism Infosec, a cybersecurity testing and consulting firm based in the UK and Belgium. I’ve had a passionate interest in IT and IT security since way before it was called cybersecurity. I was testing the security of systems and networks even before the internet existed.
I love all things tech and although I now look after a company of over 50 people, I still participate in security testing and consulting engagements for our clients. I’ve worked with organisations all over the world as well as advising the Government and defence on the security of their data, systems, applications and services.
Exploitation of remote work vulnerabilities. Ever since Covid-19 occurred, and remote working became more popular, new opportunities to exploit vulnerabilities in remote access technologies have increased. The deployment of remote access has expanded the attack surface. Things such as misconfigured or poorly secured RDP and VPN connections can provide an attacker with entry points into the corporate network.
Another is double extortion. Used by cybercriminals to maximise the leverage they have over their victims, this results in a payout being more successful. Traditionally, ransomware attacks involved encrypting the system’s files and demanding payment in exchange for a decryption key. But with double extortion attacks, not only is the data encrypted, but it is also exfiltrated from the network, with the threat of releasing the sensitive data unless the ransom is paid.
Ransomware-as-a-Service (RaaS) has also grown exponentially. Over the past few years, cybercrime has evolved with the introduction of RaaS. This has changed the way ransomware attacks are conducted, providing cybercriminals with a streamlined platform to carry out malicious activities. RaaS sees ransomware tools and infrastructure being provided to individuals or groups, known as affiliates, in exchange for a share of the profits. It’s like Software-as-a-Service (SaaS) but is leveraged for malicious software which can be purchased or rented through forums, the dark web, etc.
Collaboration among cybercriminals is also seeing the ransomware threat increase. This is helping them to enhance their capabilities, share resources, and coordinate attacks more effectively. It’s particularly effective when the groups specialise in different areas, such as producing malware, discovering vulnerabilities and insider knowledge, as, by pooling their resources together, it increases their chance of a successful ransomware attack.
Finally, supply chain attacks are a significant and increasingly frequent threat. Rather than exploiting the targeted organisation directly, these attacks exploit vulnerabilities in third-party suppliers/vendors or service providers, leveraging the trusted relationships between the two, and using them as a gateway to reach the intended target.
Worth a read: LockBit down but far from out
Ethical hackers serve as the frontline defence against cybercriminals. They help identify vulnerabilities within systems, networks and applications through pre-arranged engagements such as penetration testing and red teaming. In this way, they assess security measures, discovering weaknesses before malicious actors can exploit them. This proactive approach helps mitigate the risk of data breaches whilst also enabling organisations to patch vulnerabilities and strengthen their overall cybersecurity posture.
Ethical hackers contribute to cybersecurity practices through their pursuit of knowledge and their eagerness to not only see how things work but also attempt to exploit them. As technology is always evolving, so are cyber threats.
Ethical hackers are driven by a passion for problem-solving and exploitation, but from an ethical perspective. To some, it is more a lifestyle than a job as they uncover vulnerabilities and disclose them responsibly to relevant stakeholders, whilst suggesting ways to fix the issue at hand. Their research, experimentation, and collaboration with like-minded people drive the development of new security solutions, ensuring that defences are ever-evolving to keep up with the latest cyber threats.
Beyond their technical expertise, ethical hackers follow ethical principles that underpin the cybersecurity profession. Integrity, honesty and a commitment to ethical conduct distinguish them from malicious actors who exploit vulnerabilities for personal gain. By following this code of ethics and professional conduct, ethical hackers uphold the trust and credibility of the cybersecurity community, reinforcing the integrity of security practices and standards.
The employees of any business are still the weakest link in the organisation’s security posture. Phishing attacks remain the primary attack vector against organisations due to their effectiveness in exploiting human vulnerabilities as opposed to software vulnerabilities. Despite advancements in cybersecurity technologies and awareness efforts, phishing attacks persist as the top threat due as they prey on human psychology rather than technical vulnerabilities. As the industry continues to advance in artificial intelligence, we can anticipate a rise in the complexity of phishing attacks, making them increasingly challenging to detect and mitigate.
Employee training and awareness is still an effective method in preventing phishing attacks. These ensure that all members of staff are educated about the dangers of phishing and teach them how to recognise phishing attempts by performing regular training sessions, simulated phishing exercises and awareness campaigns to develop a more security-conscious mindset.
Conducting regular security assessments and having an established incident response procedure can go a long way in helping an organisation identify weaknesses in their defence. In the realm of cyber security, a proactive stance consistently proves more effective than a reactive one. Having a robust incident response procedure in place will help mitigate the impact of a successful phishing campaign.
Worth a read: What is AIOps?
Companies adept at accurately identifying and categorising their assets have historically demonstrated the greatest effectiveness in mitigating cyber-attacks. It’s imperative for a company to comprehend what their sensitive data/systems/applications are in order to best protect them.
Employing a risk-based security approach will allow the organisation to better understand what risks could occur, what the effects would be on users and employees and the ramifications for the business and its reputation should sensitive systems be targeted. Accurately mapping the company’s current security posture can go a long way in creating a roadmap that highlights potential weaknesses and areas that could be further improved.
In terms of what companies could be doing today to improve their security posture, there are a number of methods that have proven to be successful at preventing/mitigating attacks. Some worth highlighting are:
Previously, cybersecurity practices were predominantly reactive. Organisations typically concentrated on defending against known threats and addressing vulnerabilities as they occurred. Common issues like Cross-site scripting (XSS) and SQL injection (SQLi) in applications and unpatched software were frequently encountered in web applications.
However, nowadays, such occurrences are less common due to an improved awareness among developers, engineers and architects, regarding fundamental security principles. Additionally, having regular penetration engagements has notably reduced the frequency of these vulnerabilities being uncovered in production environments compared to ten years ago. The use of cloud services, particularly at a software or platform level, means that infrastructure/server-based vulnerabilities are much less prevalent.
The move towards being proactive about cybersecurity shows that people are realising how cyber threats are always changing. Instead of just waiting for something to happen and then trying to fix it, organisations are trying to find and fix problems before malicious actors can take advantage of them. This means stronger security measures are being put in place, regular checks for risks, and more advanced tools are being utilised to spot threats before they cause damage. It’s like trying to stop a break-in before it even happens, rather than waiting for the burglars to get inside and then trying to chase them away.
Along with this, there has been a big change in how companies handle security during the creation of software. With the rise of DevSecOps practices, security is now a big part of every step in the development process. From the beginning of designing and writing code to testing it and finally putting it into use, security is always on the agenda. This approach means that security isn’t just an afterthought. Instead, it’s built into the whole process right from the start.
This shift isn’t just about making software safer, it’s also about bringing development and security teams together. By working more closely, they can spot and fix potential security issues earlier, making the whole process smoother and more efficient.
Cybersecurity is an incredibly rewarding and forever-changing industry, it requires constant learning and adaption to ever-evolving threats.
My initial advice would be to first identify where you are going to operate within the security landscape, understand the difference between red team, blue team, purple teaming etc and try and identify where you would fit in best. Try to get as much exposure as possible in order to identify your niche, and once you find that niche run with it, study up and really specialise.
All information is readily available, it just depends on how determined you are to find it. Websites such as HackTheBox and TryHackMe provide a fantastic playground environment allowing users to practice their attacking/defending skills with many free and paid challenges specifically designed to improve your cybersecurity skills.
Endeavour to get as much hands-on experience as possible, there is only a certain amount you are going to learn from reading books. Gaining practical experience through internships, personal projects and training is invaluable for applying theoretical knowledge in real-world scenarios. Remember there is no such thing as a silly question, learn from your mistakes, stay curious and maintain a growth mindset to continue evolving and advancing in your career.
