Yousef Alkarnawi’s Post

Dear All We are pleased to announce the publication of our newly generated dataset for malicious network traffic, entitled "Large-Scale Network Cyberattacks Multiclass Dataset 2024 (LSNM2024)". To the best of our knowledge, this is the most comprehensive multiclass dataset for network intrusion detection and classification, comprised of 15 different attacks covering different networking layers in addition to the normal traffic class. Download and utilize our dataset: https://lnkd.in/dw48NqXu More information about the dataset will be published soon in our accepted and registered paper. (Please cite our conference paper should you use this dataset): Q. Abu Al-Haija, Z. Masoud, A. Yasin, K. Alesawi, Y. Alkarnawi, "Revolutionizing Threat Hunting in Communication Networks: Introducing a Cutting-Edge Large-Scale Multiclass Dataset", 15th International Conference on Information and Communication Systems (ICICS 2024), IEEE, Aug. 2024.

Discover the dynamic insights unfolding from the Trellix Advanced Research Center's latest CyberThreat Reports. Explore the evolving APT landscape and gain valuable comparisons with previous editions. Dive into their latest findings here!

Given that more of our #publicsector customers are looking at #MDR services to support their #cybersecurity staffing constraints. Wanted to share that Palo Alto Networks Unit 42 provides this as an option for our customers, as well as the recent results of the MITRE ATT&CK report on the Managed Detection and Response report. To quote the blog: "Unit 42 Managed Detection and Response (MDR) helps you by sharing the most important and actionable information, not by sending an avalanche of emails. With Unit 42 MDR, you won't find yourself wading through hundreds of emails or be left wondering what to do next. Our team of experts extends your capabilities, so you can confidently detect and respond to cyberthreats 24/7/365, backed by industry-leading Cortex XDR."

Hrrrrrrmmmmm, CrowdStrike said they did the best at 4 minutes to detect with the highest efficacy at 98%, Palo Alto said they did the best at 100% (at 20+ minutes to detect* reported by CrowdStrike). According to Secureworks a ransomware attack has an average dwell time of 6 minutes now. Frankly I’m inclined to believe CrowdStrike at Halcyon we track the efficacy in real time of the leading EDR vendors, and since we launched CrowdStrike has always been the most effective (followed by Microsoft). I will add this, these are contrived attacks that as an industry have always shown better efficacy than the real world (how many times did we see McAfee at 100% over the last 15 years). If the best in the industry is only stopping 98% maybe it makes sense to have another layer focused on minimizing the impact of ransomware, maybe even a product that makes sure if a ransomware attack runs, you already have the keys to the files, and then automatically decrypts the files for you, without having to call your cyber insurer, or let the attackers know their attack was successful. Paying ransomware keeps them coming back and enables their growth, by taking away the leverage they have over a company to pay, you break the ransomware game. Oh and did I mention Gallagher, one of the largest insurers is giving a blanket 10-20% discount to any of their customers that deploy Halcyon. Why are they doing this? In the last two years Halcyon has prevented thousands of ransomware attacks across our customers, and never once failed to protect our customers from some of the most advanced attacks to ever hit the internet.

The “MITRE Engenuity ATT&CK Evaluations for Managed Services” assess managed detection and response (MDR) vendors’ ability to detect and analyze threats and document adversary behavior. This year’s evaluation, a rigorous five-day test, emulated the methods of modern adversaries menuPass and ALPHV/BlackCat. For the second consecutive year, Palo Alto Networks Unit 42 MDR experts accurately identified the adversaries and delivered a precise threat report with actionable recommendations, demonstrating how we equip customers with the critical information needed for effective incident response. In this year's detailed threat analysis, you'll see how Palo Alto Networks Unit 42 experts quickly answered the most critical questions facing an organization under attack: *How important is this threat? *Who is the adversary and what is their intent? *How was the attack executed (TTPs)? *What is the impact? Download the full threat report now to get insights into how our elite team delivers unparalleled Threat Detection and Incident Response.

Looks like Palo Alto Networks Unit 42's got this down to a science! 🧪 For the second year running, Unit 42 completed the MITRE Engenuity ATT&CK Evaluations for Managed Services, nailing those sneaky adversaries and their techniques. This year's challenge? menuPass + ALPHV BlackCat. But no worries, our Unit 42 MDR team, armed with Cortex by Palo Alto Networks XDR, high-fidelity threat intelligence, and AI-powered analytics, pinpointed these threats with surgical precision. Curious how we did it? Dive into the report for details. https://bit.ly/3KRAF8p

🌐 Deterrence and Accountability in Cyberspace 🌐    As digital threats become increasingly prevalent, states are adapting their strategies for accountability and deterrence in cyberspace. To effectively prevent malicious behaviour, we must embrace a multifaceted approach that combines three primary methods:    1️⃣ 𝐒𝐡𝐚𝐩𝐞 𝐭𝐡𝐞 𝐧𝐨𝐫𝐦𝐚𝐭𝐢𝐯𝐞 𝐞𝐧𝐯𝐢𝐫𝐨𝐧𝐦𝐞𝐧𝐭: Establish clear norms and frameworks that define responsible behaviour in cyberspace.   2️⃣ 𝐏𝐮𝐧𝐢𝐬𝐡 𝐛𝐚𝐝 𝐛𝐞𝐡𝐚𝐯𝐢𝐨𝐮𝐫: Articulate clear response mechanisms to potential adversaries. If actors understand the costs associated with launching specific types of cyberattacks, they may be more likely to reconsider their actions.   3️⃣ 𝐃𝐞𝐧𝐲 𝐛𝐚𝐝 𝐛𝐞𝐡𝐚𝐯𝐢𝐨𝐮𝐫: Pursue an active defensive approach focused on denying malicious activity before it even has the chance to arise.   Learn more in our latest research paper by Taylor Grossman here 👉 https://lnkd.in/djV72Y8p in cooperation with The Stimson Center.

The video of the 19 February 2024 NITheCS Colloquium: 'DIRISA: A National Infrastructure for Data Democracy' by Dr Anwar Vahed of the Data Intensive Research Initiative of South Africa is now available online. ABSTRACT Research data is used and generated by players in the research and innovation ecosystem, and has to be managed to harness its value in the National System of Innovation (NSI). The Data Intensive Research Initiative of South Africa (DIRISA) is a relatively recent addition to the National Integrated Cyber Infrastructure System (NICIS). In line with the mandate of NICIS, DIRISA focuses on value adding complementary offerings by differentiating itself through a portfolio of cloud-based services for research data management and data intensive research. The main objective of DIRISA is the provision of a national research data infrastructure together with these services.

Ready to up your defense game against #DDoS attackers? Check out this "Cat and Mouse with DDoS" research note written by Grant Lenahan, Appledore Research. In this research note, published in June 2024, Grant Lenahan explores the DDoS landscape and examines the Nokia Deepfield anti-DDoS solution in more detail. https://nokia.ly/3Sve3i5

🚨 Think MFA is foolproof? Think again. In our latest Threat Bulletin, Adlumin’s Director of Threat Research, Kevin O'Connor, details how cybercriminals bypass MFA and how you can strengthen your defenses. You’ll learn: - Pitfalls of over-reliance on MFA - What MFA implementation looks like - Common MFA bypass techniques - Recommendations from Adlumin’s Threat Research Team Read now: https://hubs.li/Q02Mf5Hr0