Blog

HomepageBlog
CategoriesCompany insights

SecureIT x Kandji

Days
Hours
Minutes
Seconds

Thursday, 7th of December at 1:00 PM (UTC +0)

SecureIT x Kandji Webinar

Managing and securing Apple devices shouldn’t be hard. Join us for this webinar to discover how Kandji, a modern Apple device management and security platform, streamlines the administration of Apple devices, making it straightforward for IT professionals.

Kandji empowers companies to manage and secure Apple devices in the enterprise and at scale. By centrally managing and securing your Mac, iPhone, iPad, and Apple TV devices, IT and InfoSec teams can save countless hours of manual, repetitive work with features like one-click compliance templates and more than 150 pre-built automations, apps, and workflows.

Panelists

Main Topics

  • An introduction to Kandji
  • Zero-touch deployment
  • Automated and elegant device setup
  • Single sign-on login experience
  • One-click compliance templates
  • Automated app and OS updates
  • Endpoint detection and response
Registration
CategoriesPartner insights

Mazebolt Webinar: DDoS protection

Mazebolt Webinar: Maximize your DDoS protection

In light of the recent high-profile successful DDoS attacks on Canada, Singapore, and other countries, Mazebolt decided to share some critical best practices to maximize the effectiveness of DDoS protection services and devices.

Discover how to map out DDoS security solutions, learn about common DDoS misconfigurations, and the best practices for DDoS security –  and of course – how to eliminate DDoS vulnerabilities. 

Key takaways

  • Mapping various DDoS security solutions and services available today
  • Common misconfigurations in DDoS security implementations, and their damaging outcomes
  • Best practices and tips using proactive DDoS security to reduce risk

November 28th at 5 PM (UTC +0)

Register Now
CategoriesCompany insights

TIBER Webinar

SecureIT and Exploit Labs hosted a TIBER-EU webinar on October 16th where the main topics were:

  • How the Icelandic Central Bank (Seðlabanki Íslands) plans to integrate TIBER into the Icelandic market
  • The key benefits of the TIBER framework
  • Steps to integrate the TIBER approach and methodologies into your security program
  • How the TIBER framework can be applied to organizations outside of the target domain (finance)
Please register below to request a recording and slides from the webinar.

Panelists

Moderator

SecureIT logo
CategoriesCompany insights

Exploit Labs x SecureIT Webinar

Merki Sans

Exploit Labs x SecureIT

Days
Hours
Minutes
Seconds

Monday, 16th of October at 1:00 PM (UTC +0)

Cybersecurity matters. With threats and attacks becoming more common, protecting your organization’s most vulnerable assets is crucial. Though TIBER-EU – a red team framework developed by the European Central Bank – organizations can put their resilience against sophisticated attacks to the test. While developed for countries regulated by the European Central Bank, its methods are useful for any business, anywhere.

Join our interactive 60-minute webinar, which promises to illuminate the intricacies of TIBER-EU in an easily digestible format. Not only will you uncover the ‘how’ and ‘why’ TIBER-EU can refine your cybersecurity, but you’ll also explore its potential as a benchmark and catalyst for fortified cyber resilience in various sectors!


Panelists

Moderator

Key Takeaways

  • How the Icelandic Central Bank (Seðlabanki Íslands) plans to integrate TIBER into the Icelandic market
  • The key benefits of the TIBER framework
  • Steps to integrate the TIBER approach and methodologies into your security program
  • How the TIBER framework can be applied to organizations outside of the target domain (finance)

Speakers

Tinna Þuríður Sigurðardóttir

The Central Bank of Iceland has adopted the TIBER-EU framework and published guidelines for the adaptation of TIBER-IS, and has a dedicated TIBER cyber team (TCT) that operates under financial stability. I will give a short introduction to TIBER-IS as the TIBER-IS test manager, explain what participation in TIBER-IS entails and explain the role of the TCT in this process.

Kevin Ott

As premier provider for red teaming and TIBER tests in Germany and beyond, Exploit Labs has partnered with SecureIT to make red teaming and TIBER more accessible to the Icelandic market. During the webinar I will go into detail about the TIBER framework, going the steps involved in conduction such an exercise. The emphasis will lie on the red team part of the framework, briefly touching on the overall process and the threat intelligence part of the exercise.

CategoriesCompany insights

A warm welcome to new employees at SecureIT

SecureIT is growing and welcomes new people aboard

SecureIT is proud to present two new people who have joined the team at its headquarters in Reykjavík, Iceland. Our newest team members are Marín G. Jacobsen and S. Bylgja Sigurjónsdóttir.

Marín studies Computer Science at Reykjavik University. During her studies she has focused on security in programming and how software vulnerabilities can be exploited.
Marín is primarily working within our offensive security team as an entry-level ethical hacker as well as learning the ins and outs of information security and compliance.

Bylgja is SecureITs brand new Partnership Lead. This is a new role designed to meet the growing needs of an increasing customer base and newly forged and exciting partnerships. Bylgja’s role will be to strengthen relations with and between customers and partners, ensuring our support and consulting remains relevant, adequate and future-focussed for our customers built on satisfaction and ever present pursuit of true and trusted partnerships with our customers.

Bylgja is an entrepreneur and experienced project manager and has worked with relational management in many different venues and roles throughout her career. She is enthusiastic about information security in particular, seeking a deeper understanding of systems and security and how they relate to people and corporate cultures. With a bachelor’s degree in PPE (philosophy, politics and economics), and a master’s degree in Human Ecology (emphasis on culture, power and sustainability), Bylgja is equipped with a multi-disciplinary education and outlook on life.

We look forward to working with Marín and Bylgja and include them in our team.

Click here to see SecureIT complete Services

CategoriesPartner insights

SecureIT joins forces with Wib to accelerate API Security

SecureIT joins forces with Wib to accelerate API security

SecureIT is happy to announce their strategic partnership with Wib, to bring API security into the Nordics. Wib is pioneering the API security market with their industry first holistic API security platform and we are excited to show our customers its capabilities. To learn more about Wibs services feel free to send us an email at 

Wib, the fast-growth cybersecurity startup pioneering a new era in API security, today announced a strategic partnership with SecureIT to accelerate its go-to-market momentum across the Nordics region. Based in Iceland, SecureIT is a leading provider of cybersecurity compliance, consulting and managed services to international financial institutions, airlines, large retailers, utility, biotech and healthcare, as well as multiple entities in the critical infrastructure and the government.

In the wake of its recent launch and $16 million funding, Wib is actively investing in building out an international channel ecosystem of specialist cybersecurity partners to expand its reach, drive growth and leverage growing market demand for API security. The partnership with SecureIT gives access to Wib’s industry-first holistic API security platform and recently launched API PenTesting-as-a-Service (PTaaS) capabilities, helping organisations across the region identify API vulnerabilities, defend against the growing tide of API based attacks and meet increasingly API centric regulatory compliance standards such as PCI DSS.

“Building out our channel ecosystem is a strategic priority for Wib as we look to scale our go-to-market presence across key international territories,” commented Ran Ohayon, CRO at Wib. “SecureIT has a trusted brand and strong reputation across the Nordics region with a dynamic team of qualified and experienced security and compliance professionals. Its consultative-led approach, strong compliance expertise and managed services capabilities made them the ideal partner for us and we’re looking forward to a mutually beneficial relationship.”

“The Nordic countries are synonymous with innovation and entrepreneurship, with an early-adopter mentality and pioneering spirit when it comes to new technologies,” explained Magnús Birgisson, CEO at SecureIT. “However, where innovation leads insecurity tends to follow. APIs are critical in driving the modern applications and innovative new web services many organisations use today, but many are undetected, unmanaged and unprotected, creating vulnerability and risk. Our mission is to deliver cyber resilience to our customers across the region and our partnership with Wib is a great addition to our portfolio and will help us achieve this mission.”

Wib’s holistic API security platform provides complete visibility across the entire API landscape, from code to production. By delivering rigorous real-time inspection, management, and control at every stage of the API lifecycle, Wib can automate inventory and API change management; identify rogue, zombie and shadow APIs and analyse business risk and impact, helping organisations to reduce and harden their API attack surface. Wib’s new PTaaS solution combined with its API security platform, is the only offering that provides complete visibility, automatic inventory, auto-generated API documentation, and simulated attacks against test and/or production systems.

About SecureIT
SecureIT is a leader in cyber security consultation, compliance and managed security services. Founded in early 2017, SecureIT has worked with multiple international financial institutions, airlines, large retailers, utility, biotech and healthcare, as well as multiple entities in the critical infrastructure and the government.

SecureIT focuses on providing exceptional quality services, and to help the customer reach and maintain the desired and necessary security posture. SecureIT offers tailored consultation, assessments and audits, security testing and verification services, risk management and cyber threat intelligence services, along with extensive 24/7 monitoring, detection and response services, managed endpoint protection, API security and DDoS mitigation assessments and simulations. Meeting compliance, contractual and regulatory requirements is critical in today’s business environment.

Get more information at our Linkedin page

About Wib
Wib is pioneering a new era in API security with its industry first holistic API security platform. Providing continuous and complete visibility and control across the entire API ecosystem, Wib enables developers to code with confidence and security teams to secure with surety.

Wib’s elite team of developers, attackers, defenders and seasoned cybersecurity professionals draw on real-world experience and expertise to help define and develop innovative technology solutions that enable customers with the identity, inventory and integrity of every API, wherever it may be within the development lifecycle, without compromising development or stifling innovation.

Wib is Headquartered in Tel Aviv, Israel with international presence in Houston, USA and London, UK. It was founded in August 2021 by serial entrepreneur Gil Don (CEO), Ran Ohayon (CRO) and Tal Steinherz who previously served as the CTO of Israel’s national cyber directorate.

Mynd af tölvuskjá með SANS CTF hugbúnaðinum
CategoriesCompany insights, Partner insights

Icelandic Capture The Flag competition

SANS and SecureIT partner for Iceland’s Capture the Flag competition in October 2022

SecureIT is excited to host a Capture The Flag (CTF) event on October 6th-7th 2022 in collaboration with the information security cooperative SANS Institute. The competition consists of multiple small challenges in network- and computer security, ranging from easy to challenging. Basic knowledge in either web programming or networking is sufficient to have fun and learn new skills.

So why try out a hacking ctf?

  • Well, there is the puzzle-solving aspect, so if you like solving those, you should try it out.
  • If you are making websites using frameworks or some other technology, it’s a great way to better understand how those systems work and it might lead you to some cool superpower of that technology that you didn’t know was possible to do.
  • If you like mathematics, solving cryptography challenges is something that can be very challenging but it’s also rewarding.
  • If you want to learn new things it is a great resource for that too, the challenges are often very direct and to the point, however some rely on arcane knowledge about a specific system or language that really just “clicks” with experience.
  • Of course, if you just enjoy breaking things and trying out weird stuff to see what happens that works too.

Still not convinced?

SecureIT’s Cyber Security Developer and the winner of the 2021 October competition, Sigurður Baldvin writes:

“When I first tried a CTF my mind was blown away. It was a blend of doing all of the computer things I loved to fiddle with, mixed with a puzzle that is difficult to solve.”

Sigurður Baldvin goes on to say:
“As a part of learning to create something, I think it is important to be curious about the potential side effects your product could be producing, be that storing the database credentials insecurely or using the behaviour of something to do unexpected things.
It is a puzzle that can potentially be solved with different tactics or methods and it achieves different results.”

Click here for more information

Mynd úr gagnaveri - ís­lensk fjár­mála­fyr­ir­tæki urðu fyr­ir nokkuð um­fangs­mik­illi netárás
CategoriesRisk and vulnerability alert

Security Incidents in the past week

Security Incidents in the past week

On the 24th and 25th of August, two security incidents were disclosed by
Plex and LastPass respectively.

Plex

Security Incidents in the past week. On 24th of August this year, Plex disclosed through email, a data breach that affected most users using the platform. Around 20 million password hashes and email addresses were leaked due to this breach and it’s recommended that every Plex user change their password as soon as possible and as an extra security measure. 

We encourage double checking devices logged in or to sign out of every device after the password change.

LastPass

On the 25th of August, LastPass disclosed a partial leak of the platform’s source code and technical implementations through a breached developer account. LastPass states that no user information or data was leaked and the breach has not affected their services at all.

LastPass also mentioned that no user action is required, however we highly recommend enabling Multi-factor authentication if you have not done so already. Read more about statement from LastPass here.

It is important to always use Multi-factor authentication when available,
and these incidents serve as a cold reminder of this fact

Although data breaches continue to be a risk and something we never hope to seldom encounter, it is an unfortunate reality we must live with. As users of online services we can minimize the impact of data breaches by using password managers and unique passwords for each service, both personally and professionally. We have to keep our personal and professional information separate so that in case of a more severe breach, we and our organizations are as protected as we can be.

Image of a laptop and a computer screen with code
CategoriesExperience

How to code like a team – SPOFing in coding alone

By Sigurður Baldvin Friðriksson

 

In my professional career, I’ve been a team member, a manager and had a variety of responsibilities for assignments and projects. My team experiences have been outside of the tech industry, ranging from a stint at a pizza place to a local computer hardware reseller. It has been informal for the most part and very collaborative and had a flat hierarchy. Here are a few words about how to code like a team.

Often experience took lead over role.

In software development the process has been “We have an idea, let’s make it happen!”. 

This freedom can be nice to have as one can decide on how to build, however it comes with drawbacks, such as running into weird issues or not understanding something. Then having to do a bit of googling and try different things until it works. This can be time-consuming and frustrating.

How to code like a team

I dream of a world, where I can bounce ideas off of colleagues and they can help me with the answer. 

However, that has not been my experience which brings me to the title of this post “How to code like a team”, am I a seasoned expert in team management? No. Caveat: The below is a survival story and is best avoided in the long term. 

 

The daily routine

Try your best to brain dump what you do every day – tasks should live outside of your head!

This is good advice for anyone, regardless of how large your team is. Popular project management tools allow you to put comments and thoughts into tasks and this provides a timeline for task progress and helps you follow up.

“Hot-fixes” tend to be more common than we care to admit and they tend to become “cold-fixes” as more tasks are completed to advance development. Since you are the sole proprietor of the advancement of the project, any backtracking, refactoring or documentation feels like stopping a fully seated bus during rush hour to clean the dashboard properly. It’s not that you shouldn’t do that every now and then, however, the timing tends to feel wrong. It’s always rush hour for people that are paying you to finish the project, so take the time to fix the issue. Most projects underestimate the time allocated in the scope anyway, so add more time to your estimations and remember, set time aside for refactoring and backtracks.

 

“Doing agile development is the king of the development process” – I don’t disagree. However, it also takes enormous discipline to maintain one-person teams for weeks on end. What helps with maintenance is doing stand-ups 1 or 2 times a week just to make sure you are on track. This may seem silly but it works – although your progress may vary.

You might have realized that since you are the only one working on the projects, you have to do everything. The upside of doing everything yourself is that you learn a lot of different things. Who would have thought setting server permissions could be such a thrilling experience after implementing your very rough, paper prototype (granted you didn’t just skip a step during the agile process)? Congratulations, you are now the fullest stack developer!

The single point…of everything

Now, imagine this. You find yourself sitting in a lawn chair, drinking a cold beverage at around noon, the sun is shining and you are enjoying your vacation, when suddenly *buzz*…*buzz*  “System A isn’t working and we can’t do the thing, can you fix it”. You begrudgingly open your personal laptop because “Work should only happen at work, you don’t need a work laptop” but you knew better. A new hot-fix or server restart later, you reply “fixed” and carry on with your vacation. This is the single point of failure aspect of this post. 

Some of these texts can wait and often they do. But it can drain you. You think about work for a couple of minutes or hours, thinking about what went wrong or imagining a solution to the problem, remembering that temporary “hot-fix” you made. 

Bugs and issues can become very personal, since – well – you know that there isn’t anyone else that contributed to it. My solution to this problem is very simple but hard to execute. The “it’s nothing personal, kid” mindset. Bugs, weird issues, and interactions are a part of software development, no matter how experienced you get or how strict your testing process, something will inevitably slip through and cause issues. This happens at any team and company size. You just have to document the issue, provide a fix, and re-deploy.  

 

Expectation management

You are a singular person with the same amount of time in their day as the next person, set realistic expectations to all stakeholders, and remind them if they don’t have the budget for additional people (or simply don’t want to add more people) that the project will likely take more time than with added resources. With these words I hope you have gained some insights into how to code like a team.

Sideview of a laptop screen closing down on the keyboard
CategoriesExperience, Guide

Being up to date managing your security program

Guidance for a successful security program

This article is aimed at providing guidance for a successful security program and insight into the differences and challenges between compliance operations and security operations.

Evolving compliance

Compliance is no check mark sport – it is a constant gardening exercise. Here are some of the essential points for keeping your compliance in good shape, Guidance for a successful security program:

  • Keeping up to date with standards, regulatory requirements, and future changes can be a good way of staying ahead. Be knowledgeable about many different standards and security best practices, while ensuring that you are going beyond just meeting compliance. Why? Standards are not updated fast enough to correlate with the ever evolving threat landscape and security best practices.
  • In the case of the organization not have to meet information security standards or issue reports such as ISO 27001, SOC 2, NIST, PCI DSS or others, it is still a good idea to follow the frameworks such as ISO 27001 or NIST as they provide good guidance and a foundation on security best practices for your ISMS.
  • Continually monitoring the effectiveness of your controls and implementing security measures that not only meet standard or regulatory requirements, however going beyond to increase the security posture of your organization is a great way to ensure your ISMS is up to date and the controls are actually helpful for you and your business units. If the organization has multiple frameworks that it needs to be certified against, evaluate whether the policies, processes, and controls can be used to meet the objectives of multiple standards at once. This cross-reference can save you valuable time.

Compliance is only a small part of the security function and being compliant or certified must be taken with a grain of salt as compliance to standards does not mean you are completely secure or that your vendors are secure as the scope and quality of controls can significantly differ.

Current threat landscape

The ever evolving landscape of corporate business is a:

  • Modern threat agents are becoming more and more sophisticated and the threat landscape is continually evolving. Following news on security, recent attacks, and vulnerabilities is paramount to being up to date with the current threat landscape.

  • It is recommended to conduct threat intelligence, implement continuous monitoring and alerting, and use continuous risk management for new threats that are arising at each time. If budget allows for it, consider implementing technical solutions that allow for continuous monitoring of thresholds and vulnerabilities through agents, and implementing solutions that offer threat intelligence of your company and supply chain.

Guidance for a successful security program

Keeping current within your own company

  • It can be common that some business leaders may view the security function as a barrier or blocker for the business. It is important to understand the business goals and create a culture of security as an enabler where business units are freely willing to share information and concerns and seek help from the security team. This is why it is critical to be visible, knowledgeable about where your company is headed, what the business requirements are, and how security best practices can be implemented at each phase and within all business units.
  • Creating a culture and mindset where the company sees security as an enabler for the business instead of a restriction, will lead to better collaboration between the companies departments and increased information sharing to ensure the security team is up to date with new developments, systems or strategies. In addition, ensuring your colleagues and stakeholders such as the BoD are informed through a Security Council, regular reporting and awareness training to ensure the success and visibility of the security function and increased security awareness within your organization. Stand-ups or regular meetings with relevant teams, especially development and IT should be held in order to follow current changes and issues with the IT environment.
  • Ensure you have a good overview of your assets and vendors through dedicated asset management and vendor management programs. As the attack vectors are increasingly becoming more and more sophisticated, keeping current with your enterprise infrastructure, assets, and supply chain will enable your organization to have a deeper understanding of your attack vectors.

Being involved within the industry and security sector

  • Join security communities if they are available through professional industry specific platforms or social media platforms as they may often provide good intel on current challenges and threats.
  • Evolving cyberthreats create a continual need to educate the security team, and all relevant team members on how to protect against data breaches and threats. Being involved in discussions, events, and gathering intel from trusted media will help in being current with the industry.
  • Offering to achieve professional certifications for your security team additionally gives a good foundation for the career success and continued learning of your security team.