About jforsythe

  It’s that time of year again! The most festive period of the year is just around the corner, and people everywhere are going crazy for last-minute bargains.   Online shoppers get ready for Thanksgiving, Black Friday, Cyber Monday, Christmas, and New Year's sales. Now is the time to find those perfect end-of-the-year deals and discounts in the stores and online. It's going to be chaos at the stores, and many people will prefer to do their shopping from the tranquility of their homes.   Many cybercriminals try to take advantage of this increased online activity and prepare scams like social engineering, phishing emails, or spoofed and malicious websites to trick unsuspecting shoppers all over the world.   It's important to stay alert and spot the red flags that could indicate scammers at work. Below, you'll find some tips that can help you be smart and shop safely during the holidays. Safe Shopping Best Practices   Make sure that the software you're using is up-to-date. I'm talking about the OS, browsers, and all the applications you might be using on your end host. This is not limited to your desktop, of course! Since mobile shopping has become more popular, make sure your mobile devices have the latest patches and app versions installed. In doing so, you'll greatly reduce the risk of running into known vulnerabilities and getting infected by malware. Don't use free public wifi for shopping. Using MITM (Man in the Middle) methods, attackers might be listening in on your communication and intercept the traffic. It is best to use a trusted wifi connection like the one at your home. If you aren't at home, then I'd recommend that you turn your smartphone into a hotspot to connect your laptop to the internet. Make sure that your connection is secure. Identify the padlock icon next to the URL.   If it's there, that means that the communication between the client and the server is encrypted. A word of caution: The padlock guarantees privacy between client and server, but it does NOT guarantee that you can trust the website! It might very well be a phishing website designed to trick you into thinking that you are on an "official" website. With that said, make sure that the URL makes sense and isn't some weird wordplay of well known websites. Criminals tend to use fake websites with URLs that are very similar to well known websites. Use credit cards with online transactions, not debit cards. Debit cards aren’t covered by fraud insurance policies and provide direct access to the bank accounts they’re linked to. Credit card companies give insurance to buyers if the product isn’t delivered. Be alert of the information being collected. Make sure you are aware of the kind of information that's being collected when you make an online purchase. If you're being asked for personal data, like Social Security numbers or password information, then that's a definite red flag!  Be wary about pop-ups and ads in general.  While some of them might seem legit, they are often a way for scammers to trick over-enthusiastic online shoppers into clicking them, and then they can redirect you to malicious websites. Be wary of ads that seem too good to be true and just close them or block them out with an ad-blocker. Don't trust every email you get. Phishing emails are used to trick shoppers to go to malicious websites and enter their CC information and/or install all sorts of nasty malware in the process. If you receive a suspicious email from an address you never heard of, with a link to an unknown website, don't open attachments and don't go to the website because it can be malicious. By opening the attachment, you could be installing malware on your device. This is a very popular way that criminals try to steal your information or infect your devices. As in the previous tip, if the deal is too good to be true, then just delete the email.   Avoid unknown websites and only shop on websites that you trust. That new gaming console might look very interesting when it's being offered for $200 cheaper than on other websites. But, at the same time, that shadywebsite.com will be stealing your CC information when you order something from them! Avoid using the same password over and over again.  If one of the websites gets compromised then all of your other accounts are at risk as well. Ideally, use a passphrase. They tend to be easier to remember and are nearly impossible to hack! Still having trouble managing different passwords? Then I'd recommend using a password manager tool to help you with maintaining your passwords. There are many available options out there (e.g., Keepass, LastPass, etc.). Watch out for fake or compromised social media accounts! Fake or compromised social media accounts post links and too-good-to-be-true ads. Just because it's on Facebook or Instagram doesn't mean you can trust it. Do some research and check for reviews! If you are buying on a new website, check for existing reviews. Scammers usually don't have reviews. Look to see if there are other customers that post their experiences with the website. Your movements can be tracked if you have Bluetooth or Wifi enabled.  While you are within range, malicious users can track your location and could possibly verify your shopping habits and send you targeted advertisements. I would advise to disable wifi and bluetooth when you're not using it.   NOTE: This list isn't limited to what I've mentioned above. I'm sure many of you can think of other tips and tricks that could help online shoppers get a much safer online experience!   Don't be shy! Please add your advice in the comments section below.   ... View more

  By Bar Katzir, Product Manager for Cortex, and Sasha Sokolovich,  Security Architect for Cortex   Enhancing your security automation and response capabilities across multiple platforms while tending to large amounts of threat investigations is anything but easy. But not doing so requires dependency on many manual processes, increasing incident investigation time and overall risk of malware infections. To prepare for the next inevitable attack, SOC teams must continuously look for ways to improve their post-incident activity processes.   Figure 1: NIST Incident Lifecycle process     You don’t need to do it yourself. Let automation help.   Streamline and automate the malware investigation process with Cortex XSOAR’s Malware Investigation and Response pack.   Released   in June 2022, the Malware Investigation & Response pack accelerates the investigation process for endpoint malware incidents and alerts by collecting evidence of malicious behaviors, searching telemetry data available through EDRs, and processing malware analysis reports through sandboxes. Incident layouts also include buttons to quickly trigger containment activities. Customers like you have found immense value in the   Malware Investigation and Response Pack, alongside the   Deployment Wizard, since its release.   To quote an EMEA Financial Services customer:   “The Malware Investigation and Response pack is by far the easiest use case to deploy.”   Key New Features of the Malware Investigation and Response Content Pack   After working with customers across various sectors and regions on their deployment of the pack, we incorporated their feedback into a new version of the pack to provide more value without compromising investigation speed or scale.   For the new Malware Investigation and Response pack, we focused on the following capabilities:   Account Enrichment   Incorporating the capability to retrieve information about the active user on the endpoint will give the analyst context about the endpoint and possible risks to the organization.   For example, providing insight into the active user’s department— whether they are in finance or engineering— enables the analyst to disable the user's account in the corresponding IDP as needed.   Figure 2: Account Information details in incident view   Firewall Enrichment & Validation (with Threat Hunting Generic playbook)   SIEM and newly added Network Security tools give more context to the threats in your organization. This provides valuable context regarding the severity of the  threat and how wide it has spread within your organization.   Joe Security Sandbox coverage   The new integration with Joe Security sandbox allows analysts to retrieve submitted file information or automatically detonate files that are detected by the deployed EDR. The retrieved information allows the analyst to gain more insights on the alert by using the Sandbox analysis full report or even a quick view of the extracted IOCs, such as MITRE ATT&CK information, from the layout itself.   Figure 3: Joe Security Sandbox Report available to analyst for incident investigation       Figure 4: Joe Security Sandbox Report providing rich analysis and MITRE ATT&CK mapping   Addition of Service Level Agreements (SLAs)   Security investigations are time-sensitive. The longer before the threat is contained, the greater the risk of exposure to the organization. With this enhancement of the pack, you can easily track and monitor Triage, Remediation, and Containment SLAs.     Figure 5: SLAs section within the incident   An SLA Dashboard also allows you to quickly filter your Incident Types based on Severity so you can properly diagnose your SLAs.     Figure 6: SLA Dashboard Microsoft Defender for Endpoint Rate limit handling   Some advanced hunting queries have   limitations. However, the Cortex XSOAR Malware Investigation and Response v2 content pack includes a baked-in rate-limiting support mechanism, which will re-run your queries in the playbooks if you have reached your Incidents API or Advanced Hunting API   quota. This ensures your investigation goes unhindered.   Microsoft Defender for Endpoint Advanced Hunting Batch Queries   As the XSOAR R&D team keeps evolving and maintaining current playbooks, it is essential to have flexibility when it comes to customization. This feature allows the customer to add a batch of pre-defined queries as a playbook input. This way, there is no need to detach the playbook for adding your custom Microsoft Defender Advanced Hunting queries.   Assign Analyst to an Incident   Assigning an analyst to an incident based on the less busy user is now available. Moreover, you may define if you would like to assign an on-call analyst using the playbook inputs.   Continuous Innovation in Automation   The Malware Investigation and Response pack accelerates the investigation process for cybersecurity analysts and makes containment activities push-button simple. Although the latest additions add a ton of value for our customers, we are already thinking about what’s next.     For more information on the   Malware Investigation and Response Pack   and other XSOAR packs and playbooks, visit our   Cortex XSOAR Developer Docs   reference page.   Don’t have Cortex XSOAR?   Download our free   Community Edition   today   to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC.   ... View more

October 2022 LIVEcommunity Rewind   Welcome to our October 2022 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month!   In October, we recap new episodes of PANCast, a Palo Alto Networks podcast; Cortex XSIAM, Palo Alto Networks’ new autonomous platform powering the modern SOC; new webinars and more! Read on to learn about LIVEcommunity’s October 2022 highlights.   XSIAM Has Arrived to Revolutionize the SOC     We believe that the only way a SOC platform can operate at today’s scale is to completely rebuild from the ground up. So we’ve done exactly that with XSIAM, the autonomous security operations platform designed to enable all customers to achieve the outcomes Palo Alto Networks does in our own SOC. How? It all comes down to data that drives analytics, automation and proactivity. Read more about it in the blog from Lee Klarich, Palo Alto Networks Chief Product Officer, “ XSIAM Has Arrived to Revolutionize the SOC .”   Register now for the The Modern SOC, Reimagined, a virtual event happening November 2, 2022.   New Episodes of PANCast, a Palo Alto Networks Podcast     Have you listened to PANCast yet? This new Palo Alto Networks podcast provides actionable insights from cybersecurity experts to customers; episodes will cover a range of Palo Alto Networks products, offering valuable tips and key information for a successful adoption journey. Check out the newest episodes from @jarena:    PANCast Episode 2: How Does GlobalProtect Split Tunneling Work? PANCast Episode 3: URL Filtering — Allowing and Blocking the Right Traffic   Playbook of the Week: Teaching XSOAR a Few New Tricks with Slack Blocks   In most cases, SlackAsk does not provide enough information suitable for analyst investigations, as it focuses mainly on binary “yes/no” questions. It has become fairly common for SOC engineers to use the SlackV3 content pack purely as a notification utility, but you shouldn’t have to be a Slack power user to utilize all that Slack blocks are capable of providing.    The Slack V3 content pack allows you to interact with the Slack API by collecting logs and sending messages and notifications to your Slack team. It integrates with Slack's services to investigate failed login events and execute, create, read, update, and delete operations for employee lifecycle processes.   New AIOps Feature: On-Demand BPA   You can now run a best practice assessment (BPA) directly in AIOps for NGFW by uploading a Tech Support File (TSF). Now, you can generate an on-demand BPA report for devices that are not sending telemetry data or are not onboarded to AIOps (e.g. PAN-OS 9.1 devices), as well as devices that are onboarded to AIOps for NGFW with telemetry enabled.   Cortex XDR How-to Videos Learn about a common use case for Endpoint Administration Cleanup, how Cortex XDR can ingest Windows DHCP logs to discover additional network devices; and how to use object data from Active Directory to create endpoint groups which can be used for policy targeting in the latest Cortex XDR how-to videos!   Cortex XDR How-To Video: Endpoint Group Cortex XDR How-To Video: Configure Cloud Identity Agent Cortex XDR How-To Video: Windows DHCP Log Ingestion   What's New: IoT Security, October '22 Update   In the October what’s in IoT Security update, we learned about a new third-party integration with BlueCat IPAM — which expands visibility into the structure and organization of the IP address—improvements to appearance and behavior, and a new report from RHISAC on the latest cyber threats from the retail, hospitality, and travel sectors.    Two New Posts Written By Cyber Elite Expert @Nikoolayy1   Cyber Elite Expert @ Nikoolayy1 wrote two super-helpful posts for LIVEcommunity this month! Check ‘em out:   OCR for Enterprise DLP and SaaS Security API  Optical Character Recognition or Optical Character reader (OCR), which is the electronic or mechanical conversion of images of typed, handwritten or printed text into machine-encoded text. This new feature is configured in Enterprise DLP cloud portal and functions for Prisma Access or on-prem firewalls with the Panorama Plug-in.    XDR Isolation Exceptions and Exclusions Use Case When you isolate an endpoint, you halt all endpoint network access — except for traffic to #Cortex XDR . This can prevent a compromised endpoint from communicating with other endpoints, which reduces an attacker’s mobility. But traffic to Cortex XDR can be halted while still ensuring communication to Cortex XDR is always allowed.   Tips & Tricks: How to Get Updates From the Internet Without Internet Access       Did you know that you can avoid messy work-arounds for not having internet access with Service Routes. This cool feature makes certain services use a dataplane interface (instead of the management interface). Special shoutout to Cyber Elite @reaper for his contribution to this blog!    October 2022 LIVEcommunity Member Spotlight: @LAYER_8   For the October 2022 Member Spotlight, we’d like to applaud one of our community members,   @LAYER_8, for their participation and engagement in the LIVEcommunity!    Since joining the community in July 2014, they have written  293 posts , received  79 likes , and authored  32 solutions  (and counting). Thank you for your contribution and participation in the community @LAYER_8!   VM-Series Virtual Firewalls Integrate with Azure Gateway Load Balancer   Palo Alto Networks is pleased to announce the General Availability of integration of VM-Series virtual firewalls with Microsoft Azure Gateway Load Balancer . This integration has been designed to efficiently augment native Microsoft Azure network security capabilities with next-generation threat protection — so customers can more easily attain greater performance and scalability.    Tips & Tricks: Block High-Risk Apps with Application Filters   Often overlooked, Application Filter objects can be a useful tool for administrators to streamline the security policy rulebase. An Application Filter is a dynamic object that can be created based on administrator-defined application attributes, including category, subcategory, risk factor, tags, and characteristics. Read more in this blog by @JayGolf — again with help from Cyber Elite expert @reaper ! 🎉   Prisma Cloud Code Security and Drift Detection   Drift Detection is a feature that is included with Prisma Cloud Code Security that helps detect unwanted changes to your project’s source code. A few lines of code can turn your project upside down by creating easy entry points for hackers to use in order to leak data or turn your repository into malware.   If you already have a Prisma Cloud Code Security subscription, you can learn how to set up Drift Detection for your repositories now. Otherwise, read this blog on Prisma Cloud and Drift Detection to learn about how Drift Detection can help you maintain your security posture.   URL Filtering: Assigning Multiple Categories to URLs   Did you know that Palo Alto Networks URL filtering can assign multiple categories to URLs that classify a website’s content, purpose, and safety? Every URL can have up to four categories, including a security-focused URL category (or "risk category" for short) that indicates how likely it is that the site will expose you to threats.   These risk categories enable you to implement simple security and decryption policies based on website safety, without requiring you to research and individually assess the sites that are likely to expose you to web-based threats.   This Month’s Nominated Discussions With Accepted Solutions   Nominated Discussions help LIVEcommunity Solutions Engineers highlight a discussion post that has an Accepted Solution , and turn it into an article with additional helpful information, documentation, and clarity. Here are the Nominated Discussions we published this past month:   Multiple ISPs with Path Monitoring URL Filtering Profile Set to Allow Ransomware Global Protect Authentication Happened Two Time While Using RADIUS   You're now fully briefed on LIVEcommunity's October 2022 highlights!   If this was helpful, be sure to give this blog a thumbs up. See you next month!   ... View more