Andrew Brown

Home|Andrew Brown CTO, Elasticito

About Andrew Brown CTO, Elasticito

This author has not yet filled in any details.
So far Andrew Brown CTO, Elasticito has created 6 blog entries.

How to Protect Your Customers and Your Brand from Stolen Credential Misuse

How to Protect Your Customers and Your Brand from Stolen Credential Misuse During 2020 a number of Online Retailers have made headline news due to the media erroneously reporting that their customer Portals had been breached. These include Tesco Clubcard Members (https://www.techradar.com/uk/news/tesco-clubcard-holders-warned-of-major-security-issue) and most recently, Wiggle (https://cyclingindustry.news/security-breach-reported-on-wiggles-customer-accounts). In both these instances there was no exploitation of a cyber vulnerability. Threat Actors in all likelihood gained access to these Portals Accounts using a database of credentials stolen from other platforms or possibly via a Spear Phishing campaign.    The obvious questions here are: How was this possible? and How can this be prevented in the future? I prefer a shared responsibility model so let’s answer the above questions with this in mind:   How was this possible? Many subscribers have the same username (email address) and password for all online portals and web applications. Therefore, if one Portal account is compromised,

By |2020-06-18T11:14:26+00:00June 17th, 2020|Blog|0 Comments

Regularly Validating Security Controls with Breach and Attack Simulation

Regularly Validating Security Controls with Breach and Attack Simulation   Validating Security Controls is of vital importance for all organisations and is mandated by Cyber Security Frameworks like National Institute of Standards and Technology (N.I.S.T.) who offer a simple high-level way to do this using 5 steps:   IDENTIFY (CROWN JEWELS) PROTECT DETECT RESPOND RECOVER   To emphasise the importance of validating Security Control on a regular basis think of pilots doing a pre-flight check and inspection of their aircraft. Not performing these checks and inspections could lead to a loss of license for the pilots and the airline as it is mandatory and so should validating your organisation’s Security Controls. Simplistically you start by Identifying a Crown Jewel which could be an Endpoint, A Domain Controller or a Business Application. The next step is to detail and understand the attack vectors, which could be infiltration via email or a

By |2020-05-18T13:22:53+00:00May 18th, 2020|Blog|0 Comments

Breach and Attack Simulation vs Penetration Testing

Breach and Attack Simulation vs Penetration Testing Cyber attacks have evolved dramatically in the past decades. The capabilities, scope, fallout and number of targets of these attacks have greatly increased. This has resulted in damages from cybercrimes reaching all time, worldwide highs which are only set to increase. As a result, organisations are finding it necessary to test their organisation’s cyber security posture on the regular. Elasticito can help you navigate this process to find a solution suitable to your organisation. MITRE-ATT&CK-APT3+APT29 | Elasticito A Common Question! A common question people evaluating cyber security testing options for their organisations ask us is: “how does Breach & Attack Simulation differ from penetration testing”? The simple and shortest answer to this question is that both have their own part to play in making enterprise cyber defences more effective. Breach & Attack Simulation (BAS) are tools that allow businesses to simulate

By |2020-05-11T13:26:50+00:00May 11th, 2020|Blog|0 Comments

You Should Adopt a Cyber Security Framework – Here’s Why

You Should Adopt a Cyber Security Framework – Here’s Why Today, cyber attacks and cyber security breaches are constantly happening around the world. These attacks are also continuously evolving, becoming more sophisticated and unforeseen. This makes it difficult for organisations to proactively prevent phising, malware and ransomware attacks. So what can your organisation do to become resilient to cyber threats? A suitable cyber security framework and cyber security policies and procedures can reinforce your organisation’s IT security.       Cyber Security Framework A growing number of organisations are coming to the realisation that their extensive investment in cyber security technologies has not provided the resilience to cyber attacks that they were expecting and are looking for answers as to why they are still susceptible to phishing, ransomware and malware. The answer to this susceptibility conundrum lies in the understanding and adoption of a Cyber Security Framework (CSF). This doesn't mean that blindly adopting

By |2020-04-29T13:42:34+00:00April 29th, 2020|Blog|0 Comments

Webinar – Automated Breach & Attack Simulation vs Penetration Testing to validate security controls

Webinar - Automated Breach & Attack Simulation vs Penetration Testing to validate security controls Register now   Over 1,000 exploits and vulnerabilities are publicised every month. It is no longer effective to solely rely on point-in-time manual penetration tests to test your defences. In this webinar, you will learn how a new generation of automated Breach & Attack Simulation solutions are transforming the way that offensive security testing is conducted across the whole network, safely and continuously, to provide evidence-based data on the effectiveness of security controls. Who should attend? - CISOs - Security Architects and Strategists - Offensive Security specialists - Security Operations professionals When? Thursday 2 April 2020 at 10:00 GMT Register now  

By |2020-03-09T12:06:30+00:00March 2nd, 2020|Events|0 Comments

Why use the FAIR Model to quantify Cyber Risk for 3rd parties?

Why use the FAIR Model to quantify Cyber Risk for 3rd parties? Historically, questionnaires and or risk scoring have been the traditional tools used to evaluate the risk a 3rd party poses to an organisation. The Findings from questionnaires and risk scoring are often incredibly technical and complicated and are generally presented in heatmap style – red, orange, yellow, green – accompanied by a score and or letter grade, which aren't very useful in quantifying Risk to the business. To understand what the FAIR Model has to offer, let us first look at what we need to articulate to the Board or C-Level. In simplistic terms let’s begin by considering what Risk a 3rd Party could pose to an organisation if they were to share 2,000 data records with them. The Board or C-Level wants to know in financial terms what the cost to business will be if the 3rd Party is breached

By |2020-03-04T09:33:11+00:00January 28th, 2020|Blog|Comments Off on Why use the FAIR Model to quantify Cyber Risk for 3rd parties?