Cybersecurity – Pedro Fernandes

I started working at the National Cybersecurity Centre of Portugal!

I’m happy to report I started working at the National Cybersecurity Centre of Portugal (Centro Nacional de Cibersegurança), part of the National Security Cabinet of Portugal (Gabinete Nacional de Segurança), in Lisbon, Portugal!

This has been one my my goals for several years, and it is something I finally achieved!

I just completed the course: eID (Electronic Identification) and Electronic Certification

I’m happy to report I just completed the course eID and Electronic Certification, from the National Institute of Administration of Portugal (Instituto Nacional de Administração), in partnership with the National Security Cabinet of Portugal (Gabinete Nacional de Segurança).

Course outline

Module 1 – The digital world
Module 2 – Security and Reliability
Module 3 – Electronic Identification (eID)
Module 4 – Trust Services
Module 5 – National cases
Module 6 – Before and after eIDAS

Certificate

I just completed the course: CSIRT in a Box: Initial Training for Incident Response Teams!

I’m happy to report I just completed the course CSIRT in a Box: Initial Training for Incident Response Teams

CSIRT = Computer Security Incident Response Team

Course outline

Module 1 – My CSIRT
Module 2 – Incident Response
Module 3 – Coordination and Collaboration
Module 4 – Tools
Module 5 – Training
Module 6 – Audit and Forensic Analysis

Certificate

I completed my initial training at Microsoft!

I’m happy to report I have completed the intensive internal training at Microsoft, related to Microsoft Defender for Endpoint (MDE), of about 70 hours!

This means that soon I will start taking real cases from customers!

Wish me luck!

Certificate of the 1 hour assessment I just passed.

The full course outline is below:

MDE – Foundational Training – General

Foundational Training – Getting started
Internal Tools and Customer Communication
Initial Scoping

MDE Lab Creation

Create Your Azure Labs
Local Virtual Machines
Creating local VM’s – Hyper-V

Basic Portal overviews / General cross platform features

M365 Converged Portal
MDE – Threat and Vulnerability Management (TVM)
MDE Alerting
MDE – Tagging and Grouping
Defender Antivirus – Network Protection
MDE – Microsoft Threat Experts
MDE – Response Actions
MDE – Indicators
Microsoft Defender Endpoint licensing requirements & offering plans
Defender for Cloud Integration, Onboarding and Offboarding
Action Center
Device inventory and Timeline
Basic Connectivity Information
Defender AV (Compatibility with 3rd party AV)
Malware Submissions WDSI
Microsoft Defender for Office Integration
Live Response
Intune Integration
Advanced Hunting
Region Reset
Azure Permissions + MDE RBAC
Suppression Rules
Tenant Attach
Device Discovery
Contain Device
EDR Network Device Discovery
Device Health and Compliance Report
False Positives
MDE – Troubleshooting Mode

Windows – MDE Foundational

Microsoft Defender Antivirus
Microsoft Defender Antivirus
Antimalware Extension (IAAS)
MDE – Run Client Analyzer
MDE – Machine Isolation
MDE – Offboarding Machines
MDE – Client Analyzer II
MDE – Onboarding Machines
MDE – Indicators
Defender Antivirus – Exploit Protection
SCCM / SCEM Enrolment, Onboarding and Offboarding
Defender AV Updates
Defender AV – Log Collection
MDE – API Offboarding
Modern Unified Solution for 2012R2 / 2016
System Center Endpoint Protection logs
Troubleshooting SmartScreen
MDE – Web Content Filtering (WCF)
MSRT – Microsoft Safety Removal Tool
Defender Antivirus – Attack Surface Reduction (ASR)
Potentially Unwanted Applications (PUA)
MDE Security Configuration Management
Safety Scanner
Foundational – Controlled Folder Access (CFA)
MDE Troubleshooting Device Control for Windows
Troubleshooting Device Control for Windows
Automated Investigation and Response (AIR)
Host Firewall Reporting
Device Groups and Tags
EDR in Block Mode
Azure ARC (windows)
On / Offboarding with Group Policy

MDE Log Collection Methods

MDE Client Analyzer Logs
Defender Log Collection
ASR Log Collection
Linux and macOS Log Collection
Android and iOS Log Collection

Linux – MDE Foundational

MDE – Linux onboarding
MDE – Client Analyzer for Linux Servers / macOS
Configuring AV Exclusions on Linux
TVM on Linux
Running AV Scans on Linux
Cloud Protection – Linux
Managing Updates
Configuring AuditD Exclusions on Linux
Licensing – Linux
Configuring Network Protection on Linux
Deploying Defender for Linux

Mac – MDE Foundational

Internal Mac Test Machines
MDE – macOS Onboarding

Android / iOS – MDE Foundational

MDE for Android – Hands on lab
MDE for iOS – Hands on lab
Android / iOS Network Protection
Android / iOS Network Protection

Endpoint Protection Foundational assessment

The final exam

Major IT disruptions wordwide caused by faulty CrowdStrike update

Todays we are seeing major disruptions to IT infrastructure worldwide, afecting Airlines, Banks, Hospitals, Emergency services, Telecom companies, Media outlets, Payments processing, among others. [1] [2]

The root cause seems to be a faulty update released by CrowdStrike, a Cybersecurity company, for Falcon Sensor, their Endpoint Protection solution, which caused computer to lock-up and not turn-on properly, showing a Blue-screen error.

In an unrelated event, Microsoft Azure Cloud services also had major issues around the time of the “CrowdStrike problem” a Central US Azure outage (Tracking Id: 1K80-N_8) – those issues with Azure seem to be already mostly resolved. [3]

Solution for IT admins

As the affected computers and not running properly, unfortunately it seems they will need to be fixed one-by-one.

The solution seems to be:

1. Boot into Safe mode or the Windows Recovery Environment
2. Run the command:
 del "C:\Windows\System32\drivers\CrowdStrike\C-00000291*.sys"
3. Reboot

Key takeaways

Software and Hardware Vendors have a high responsibility and should extensively test their products – both with automated tools and manually
Vendors should do gradual releases of software updates, with live monitoring for issues and clients reported issues
You don’t release significant updates on a Friday!
Vendors should provide easy options or tools to control updates: delay updates for X amount of days, completely disable updates should always be available for IT admins
For companies at large, they should have mechanisms to delay or manually approve updates for their entire IT infrastrucutre – unfortunately this is not always easy and is largely dependant of options provided (or not provided) by Vendors

Remember the 3 basic principles of Cybersecurity are Confidentiality, Integrity and Availability, in the quest to secure the systems we should pay attention to issues like this, which end-up causing as much disruptions as a major CyberAttack.

We should also be aware that Cybersecurity is, in large part, a risk-management and a balancing act between those 3 pillars.

Statement from CrowdStrike

Advice from Microsoft to solve this issue

Cybersecurity Book Bundle, by Humble Bundle!

UPDATE: This bundle is no longer available!

In this book bundle from Humble Bundle, you will get 18 books related to Cybersecurity, published by Pearson, ranging from topics like CompTIA Security+, Network Security, Zero Trust Architecture, Microsoft Sentinel and Microsoft Defender for Cloud.

Full list of books: