Software

The NSA makes Ghidra, a powerful cybersecurity tool, open source

By Korede Ola March 7, 2019

THE NATIONAL SECURITY Agency develops advanced hacking tools in-house for both offense and defense—which you could probably guess even if some notable examples hadn’t leaked in recent years. But on Tuesday at the RSA security conference in San Francisco, the agency demonstrated Ghidra, a refined internal tool that it has chosen to open source. And while NSA cybersecurity adviser Rob Joyce called the tool a “contribution to the nation’s cybersecurity community” in announcing it at RSA, it will no doubt be used far beyond the United States.

You can’t use Ghidra to hack devices; it’s instead a reverse-engineering platform used to take “compiled,” deployed software and “decompile” it. In other words, it transforms the ones and zeros that computers understand back into a human-readable structure, logic, and set of commands that reveal what the software you churn through it does. Reverse engineering is a crucial process for malware analysts and threat intelligence researchers, because it allows them to work backward from software they discover in the wild—like malware being used to carry out attacks—to understand how it works, what its capabilities are, and who wrote it or where it came from. Reverse engineering is also an important way for defenders to check their own code for weaknesses and confirm that it works as intended.

“If you’ve done software reverse engineering, what you’ve found out is it’s both art and science; there’s not a hard path from the beginning to the end,” Joyce said. “Ghidra is a software reverse-engineering tool built for our internal use at NSA. We’re not claiming that this is the one that’s going to be replacing everything out there—it’s not. But it helped us address some things in our workflow.”

“There’s really no downside.”

FORMER NSA HACKER DAVE AITEL

Similar reverse-engineering products exist on the market, including a popular disassembler and debugger called IDA. But Joyce emphasized that the NSA has been developing Ghidra for years, with its own real-world priorities and needs in mind, which makes it a powerful and particularly usable tool. Products like IDA also cost money, whereas making Ghidra open source marks the first time that a tool of its caliber will be available for free—a major contribution in training the next generation of cybersecurity defenders. (Like other open source code, though, expect it to have some bugs.) Joyce also noted that the NSA views the release of Ghidra as a sort of recruiting strategy, making it easier for new hires to enter the NSA at a higher level or for cleared contractors to lend their expertise without needing to first come up to speed on the tool.

The NSA announced Joyce’s RSA talk, and Ghidra’s imminent release, in early January. But knowledge of the tool was already public thanks to WikiLeaks’ March 2017 “Vault 7” disclosure, which discussed a number of hacking tools used by the CIA and repeatedly referenced Ghidra as a reverse-engineering tool created by the NSA. The actual code hadn’t seen the light of day, though, until Tuesday—all 1.2 million lines of it. Ghidra runs on Windows, MacOS, and Linux and has all the components security researchers would expect. But Joyce emphasized the tool’s customizability. It is also designed to facilitate collaborative work among multiple people on the same reversing project—a concept that isn’t as much of a priority in other platforms.

Ghidra also has user-interface touches and features meant to make reversing as easy as possible, given how tedious and generally challenging it can be. Joyce’s personal favorite? An undo/redo mechanism that allows users to try out theories about how the code they are analyzing may work, with an easy way to go back a few steps if the idea doesn’t pan out.

The NSA has made other code open source over the years, like its Security-Enhanced Linux and Security-Enhanced Android initiatives. But Ghidra seems to speak more directly to the discourse and tension at the heart of cybersecurity right now. By being free and readily available, it will likely proliferate and could inform both defense and offense in unforeseen ways. If it seems like releasing the tool could give malicious hackers an advantage in figuring out how to evade the NSA, though Dave Aitel, a former NSA researcher who is now chief security technology officer at the secure infrastructure firm Cyxtera, said that that isn’t a concern.

“Malware authors already know how to make it annoying to reverse their code,” Aitel said. “There’s really no downside” to releasing Ghidra.

No matter what comes next for the NSA’s powerful reversing tool, Joyce emphasized on Tuesday that it is an earnest contribution to the community of cybersecurity defenders—and that conspiracy theorists can rest easy. “There’s no backdoor in Ghidra,” he said. “Come on, no backdoor. On the record. Scout’s honor.”

Software

Alphabeth’s Chronicle Releases Backstory. Bye to Splunk, Et al.

By Korede Ola March 5, 2019

Google spinoff Alphabet rolls out a new cloud-based security data platform that ultimately could displace some security tools in organizations.

RSA CONFERENCE 2019 – San Francisco – Chronicle, the division that spun out of Alphabet’s X, rocked the cybersecurity industry today with a new security data platform that ultimately could whittle down the number of security tools organizations run today to monitor and manage incidents.

The new Backstory cloud-based service works with Chronicle’s VirusTotal malware intelligence platform, and lets organizations view previous security data over time and more quickly spot and pinpoint details on malicious activity. “It gives security teams insight into what’s happening in the enterprise right now, with the same level of visibility into what happened yesterday, a month ago, even a year ago,” for example, Stephen Gillett, Chronicle CEO and co-founder said today in a media event for the rollout.

What makes Backstory unique from other security offerings, not surprisingly, is its Google-esque approach to drilling down into activity on the network and devices and its ability to store, index, and search mass amounts of data. Most enterprises are constrained by the amount of data they can store and manage over a long period of time.

Backstory, however, could prompt some housecleaning for security teams and security operations centers that for years have been amassing multiple, and sometimes redundant security tools and threat intelligence feeds. The platform is Chronicle’s first commercially developed product.

Rick Caccia, chief marketing officer at Chronicle, told Dark Reading that among the tools that Backstory ultimately could replace or streamline are network monitoring, network traffic analysis, log monitoring, security information event management (SIEM) tools, and even threat intelligence feeds. Tool overload has become a chronic problem for organizations: the average company runs dozens of security tools and often doesn’t have the people power to properly employ or even stay on top of the tools and the data they generate.

Several companies already are using Backstory, including manufacturing firm Paccar, Quanta Services, and Oscar Health, and several security vendors today announced partnerships to integrate with Backstory — Carbon Black, Avast, CriticalSTART, and others.

Chuck Markarian, CISO at Paccar, which builds trucks, said his company expects Backstory to replace anywhere from three- to six of its existing security tools in the next year.

“In general, managing our costs is huge, [and] managing our spend in security, and figuring out how we can use less feeds,” he said during a customer panel during the media event. Managing multiple security tools is challenging, he said, so whittling down the number of tools is key.

“I can’t find the people to manage it and I keep going back to our board and saying ‘I need another tool, I need another tool,'” Markarian said. “I want to get that number [of tools] dramatically down.”

Backstory initially provides a tool for threat hunting and security investigations, said Jon Oltsik, senior principle analyst for Enterprise Security Group. “In its current iteration, I think Chronicle [Backstory] assumes a role for threat hunting and security investigations. Its pricing, data capacity, and query speed are built for this,” he said.

Oltsik also predicts Backstory will streamline and also eliminate the need for some point security tools.

“In the future, I could see Chronicle becoming an aggregation hub for other security analytics tools [such as endpoint detection & response, network traffic analysis, and threat intelligence, for example] and then subsuming some of these standalone technologies over time,” depending on Chronicle’s roadmap for the platform, he told Dark Reading.

Many large companies already have multiple security products for the same function, Chronicle’s Caccia said. “They have three network monitoring tools and multiple SIEMs,” for example, he said. Chronicle is pricing Backstory by customer, he said, hoping to target the pricing below its potential competitors. Some companies already spend a half-million dollars per year on tools, including subscribing to cloud-based capacity for storage and computing power for cloud services like that of Amazon, he said

Operation Aurora’ Roots

Backstory grew out of the Google’s firsthand experience in 2009 when the company was hacked by Chinese nation-state actors, during the so-called Operation Aurora. Former Google security engineers who used big data analytics to build internal security tools for the search engine giant in the wake of the attacks. That work influenced Chronicle’s development of Backstory, led by former Google engineers and Chronicle co-founders Gillett and Mike Wiaceck, CSO at Chronicle.

During a demonstration of Backstory at the media event today, Wiaceck said the more data you add to Backstory, the more detailed a picture and story it provides of a threat or attack. “Attackers can’t hide” in Backstory, he said.

Meanwhile, ICS/SCADA vendor Siemens, plans to offer Backstory as part of its managed security service for ICS customers, according to Leo Simonovich, global head of industrial cyber and digital security at Siemens, which partnered with Chronicle on Backstory.

“For us, it’s providing our customers the understanding of what’s happening in their enviornment,” Simonovich said in an interview. “We’re hoping one day it [Backstory] will become the backgone of [our] managed security service.”

Source: Dark Reading

Technology

Meet the First Hacker Millionaire on HackerOne

By Korede Ola March 3, 2019

At 19, Santiago Lopez is already counting earnings totaling over USD 1 million from reporting security vulnerabilities through vulnerability coordination and bug bounty program HackerOne. He’s the first to make this kind of money on the platform.

In 2015 when he was 16-years old, Lopez started to learn about hacking. He is self-taught, his hacker school being the internet, where he watched and read tutorials on how to bypass or defeat security protections.

Two years to get to $1M in bounties

The rewards came a year later when he got a $50 payout for a cross-site request forgery (CSRF) vulnerability. His largest bounty was $9,000, for a server-side request forgery (SSRF).

He spent his first bug bounty money on a new computer, and as he accumulated more in rewards, he moved to cars.

At the moment, he has a record of 1676 distinct vulnerabilities submitted for online assets belonging to big-name companies like Verizon, Automattic, Twitter, HackerOne, private companies, and even to the US government. Lopez ranks second on HackerOne.

A hacker’s work week, tools and experience

In 2018, the researchers on HackerOne earned over $19 million in bounties; the amount is a big jump from the more than $24 million paid in the previous five years. However, the goal of the program is to reach $100 million by the end of 2020.

The recent report from the platform shows that there are over 300,000 registered hackers that submitted more than 100,000 valid vulnerabilities.

Most of the hackers (35.7%) spend up to 10 hours on average per week looking for bugs. A quarter of them works between 10 and 20 hours every week.

According to the survey, the researchers with plenty of experience in cybersecurity, over 21 years, represent the smallest percentage. The majority of the hackers, 72.3% have between one and five years of the experience.

Over 72% of the hackers surveyed by HackerOne for the report look into website security and 6.8% research APIs and technology that holds its own data. The favorite tool of the trade is Burp Suite for testing web apps.

Making money, leaning the ropes, being challenged and having fun are the top reasons for the work of the researchers submitting bugs via HackerOne, while bragging rights fall in the last place.

HackerOne’s 2019 report also shows that cross-site scripting (XSS) is the preferred attack method, followed by SQL injection. The full report is available here.

Source: Bleeping Computer

Technology

What is Credential Stufffing?

By Korede Ola February 18, 2019

You may have noticed this happening more and more lately: Online accounts get taken over in droves, but the companies insist that their systems haven’t been compromised. It’s maddening, but in many cases, technically they’re right. The real culprit is a hacker technique known as “credential stuffing.”

The strategy is pretty straightforward. Attackers take a massive trove of usernames and passwords (often from a corporate megabreach) and try to “stuff” those credentials into the login page of other digital services. Because people often reuse the same username and password across multiple sites, attackers can often use one piece of credential info to unlock multiple accounts. In the last few weeks alone, Nest, Dunkin’ Donuts, OkCupid, and the video platform DailyMotion have all seen their users fall victim to credential stuffing.

“With all of the massive credential dumps that have happened over the past few years, credential stuffing has become a serious threat to online services,” says Crane Hassold, a threat intelligence manager at the digital fraud defense firm Agari. “Most people don’t change their passwords regularly, so even older credential dumps can be used with relative success. And since password reuse is rampant, cybercriminals will generally test a set of credentials against numerous different websites.”

Credential Craze

Credential stuffing has been a problem for years now, as troves of credentials from seminal breaches like LinkedIn and Dropbox in 2012 and Myspace in 2013 have been used—to great effect!—in countless credential stuffing campaigns. But one trend in particular has fueled a recent rise in successful campaigns.

Recently hackers have posted more gigantic, aggregated credential collections that comprise multiple data breaches. One of the most wild recent examples is known as Collection #1-5, a “breach of breaches” that totaled 2.2 billion unique username and password combinations, all available to download in plaintext—for free.

“With Collections 1 through 5 we have actually seen spikes in credential stuffing recently, immediately after that news came out,” says Shuman Ghosemajumder, chief technical officer at the corporate digital fraud defense firm Shape Security. “In fact, we saw some of the largest credential stuffing attacks across several customers in just that week. And that makes sense because you’ve got all these plaintext usernames and passwords available through a torrent. It democratizes credential stuffing.”

The Collection credentials are mostly a few years old, meaning many were already in broad circulation and not worth much. But over the last week, another outlandish trove has provided exactly the type of fresh, high-quality credentials hackers cherish. Posted on the Dream Market dark web marketplace, the collection includes a total of roughly 841 million records, released in three batches, from 32 web services, including MyFitnessPal, MyHeritage, Whitepages, and the file-sharing platform Ge.tt. The first part of the dump costs about $20,000 in bitcoin, the second about $14,500, and the third roughly $9,350. A few of the breaches don’t include passwords, and some that do are protected by cryptographic scrambling that buyers will need to decode, but overall these are top-shelf troves ripe for use in credential stuffing.

Hot Stuff

As you’ve probably guessed, credential stuffing relies on automation; hackers aren’t literally typing in hundreds of millions of credential pairs across hundreds of sites by hand. Credential stuffing attacks also can’t try massive numbers of logins on a site with all the tries coming from the same IP address, because web services have basic rate-limiting protections in place to block floods of activity that could be destabilizing.

So hackers use credential stuffing tools, available on malicious platforms, to incorporate “proxy lists” to bounce the requests around the web and make them look like they’re coming from all different IP addresses. They can also manipulate properties of the login requests to make it look like they come from a diverse array of browsers, because most websites will flag large amounts of traffic all coming from the same type of browser as suspicious. Credential stuffing tools will even offer integrations with platforms built to defeat Captchas.

Credential stuffing campaigns ultimately try to get the malicious requests to blend into the noise of all the legitimate logins happening on a service at any given time, or “simulate the activity of a large population of humans,” as Shape Security’s Ghosemajumder puts it.

It also requires patience; Shape estimates that typically attackers find matches between their test credentials and an account on the platform they are attacking 0.1 to 2 percent of the time. This is why attackers need hundreds of thousands or millions of credential pairs to make credential stuffing attacks worth it. And once they’ve gotten into some accounts, attackers still need a way to monetize what they find there—either by stealing more personal data, money, gift card balances, credit card numbers, and so on—to make the whole thing worthwhile.

Stuff It

Th best way to protect against credential stuffing attacks is to use unique passwords for each of your digital accounts—ideally by using a password manager—and turn on two-factor authentication when it’s available. But it’s not entirely on you. Companies, too, are increasingly attempting to detect and block credential stuffing attempts. And some like Google (which also owns Nest) have started initiatives to proactively check whether users’ account credentials have been compromised in breaches and trigger password resets if they discover a match. But the trick is to do all of this without blocking or hindering legitimate activity.

One strategy companies can deploy is to track logins that ultimately result in fraud, then blacklist the associated IP address. Over time, this can erode the effectiveness of the proxy lists attackers rely on to mask their mass login attempts. This doesn’t completely stop credential stuffing, but does make it more difficult and potentially costly for hackers to carry out the attacks. Services whose users are mainly in specific geographic regions can also establish geofences, blocking proxy traffic that comes in from elsewhere in the world. Once again, though, attackers can ultimately adapt to this restriction as well by switching to using proxy IPs within those areas.

A recent credential stuffing attack against the productivity and project management service Basecamp helps illustrate the problem. The company reported recently that it had faced 30,000 malicious login attempts from a diverse set of IP addresses in a single hour. The company began blocking the IPs as quickly as possible, but needed to implement a Captcha to ultimately end the attack. When the barrage died down, Basecamp found that the attackers had only succeeded in penetrating 124 accounts; the company quickly reset those account passwords to revoke the attackers’ access.

Many companies aren’t as prepared to handle the scale of the credential stuffing threat. Shape Security’s Ghosemajumder says that it’s pretty typical at this point for corporate clients to see 90 percent of their logins come from malicious attacks. He has even worked with customers who deal with credential stuffing in 99.9 percent of login attempts to their service. And while credential dumps from leaks and breaches are the primary fuel for these attacks, criminals can also diversify their approach by using credential pairs gathered from phishing attacks.

“Most credential stuffing uses information obtained from the major data breaches,” Agari’s Hassold says. “But over the past few years there has been a shift in the credential phishing landscape to target generic account credentials that are then ‘stuffed’ into a number of different websites.”

Though it is frustrating when companies insist that they haven’t been breached and deny responsibility for protecting their users from credential stuffing attacks, the truth is that service providers don’t have a foolproof way of defending against this threat. As Basecamp’s CTO and co-founder David Heinemeier Hansson put it after the service’s recent incident, “Our ops team will continue to monitor and fight any future attacks. … But if someone has your username and password, and you don’t have 2FA protection, there are limits to how effective this protection can be.”

For such a simple technique, credential stuffing is frustratingly difficult to quash. So keep your passwords as diverse as possible and use two-factor whenever you can. And complain loudly on social media about any web service that isn’t offering it.

Source: Wired

Cybersecurity

Iphone Bug Lets Callers Snoop On You Without Permission

By Korede Ola January 29, 2019

A serious Apple iOS bug has been discovered that allows FaceTime users to access the microphone and front facing camera of who they are calling even if the person does not answer the call.

To use this bug, a caller would FaceTime another person who has an iOS device and before the recipient answers, add themselves as an additional contact to Group FaceTime. This will cause the microphone of the person you are calling to turn on and allow the caller to listen to what is happening in the room. Even worse, if the person that is being called presses the power button to mute the FaceTime call, the front facing caSecuritymera would turn on as well.

What this means, is if someone is calling you on FaceTime, they could be listening and seeing what you are doing without you even knowing.

BleepingComputer has tested and confirmed that this bug works in iOS 12.1.2 and we were able to hear and see the person. When testing it against an Apple Watch, though, we were not able to get the audio portion of the bug to work.

While it is not known who first discovered this bug, numerous people have been posting about it on social media and making video demonstrations as shown below.

When 9to5Mac first reported on the bug, they were only able to get the microphone snooping working. Later, BuzzFeed reported that they could also access the front facing camera and that Apple stated that they are “aware of this issue and we have identified a fix that will be released in a software update later this week.

Natalie Silvanovich, a Google Project Zero security researcher who has discovered numerous FaceTime issues in the past, has a theory as to how this could be happening.

For those who are rightfully concerned about this bug, my suggestion is that you disable FaceTime immediately until Apple releases a patch. Otherwise, people can not only listen in on what you are doing, but in some cases also see what you are doing. This could allow people to take compromising videos and audio without your knowledge.

To disable FaceTime you can follow these steps:

Go into Settings
Tap FaceTime
Now toggle the FaceTime switch so that it is disabled and your screens looks like the following.

Now that FaceTime is disabled, callers will be unable to utilize this bug to listen and watch you without your permission through FaceTime.

Source: Bleeping Computer

Cheat Sheet

IT certification path – Cheatsheet

By Korede Ola January 25, 2019

Trending

U.S. Gov Issues Urgent Warning of DNS Hijacking Attacks

By Korede Ola January 23, 2019

An emergency directive from the Department of Homeland Security provides “required actions” for U.S. government agencies to prevent widespread DNS hijacking attacks.

The Department of Homeland Security is ordering all federal agencies to urgently audit Domain Name System (DNS) security for their domains in the next 10 business days.

The department’s rare “emergency directive,” issued Tuesday, warned that multiple government domains have been targeted by DNS hijacking attacks, allowing attackers to redirect and intercept web and mail traffic.

“[The Cybersecurity and Infrastructure Security Agency] (CISA) is aware of multiple executive branch agency domains that were impacted by the tampering campaign and has notified the agencies that maintain them,” said the alert.

The warning comes on the heels of a Jan. 10 FireEye report which detailed a wave of DNS hijacking attacks targeting victims in North America, Europe, Middle East and North Africa.

The Attacks

DNS hijacking is a type of malicious attack in which an individual redirects queries to a domain name server via overriding a computer’s transmission control protocol/internet protocol (TCP/IP) settings – generally by modifying a server’s settings.

The DHS, for its part, said that the attacker begins by logging into the DNS provider’s administration panel using previously-compromised credentials.

The attacker then alters DNS records – including the address mail exchanger or name server records – and replaces the legitimate address of a service with their own address controls, thus redirecting traffic. Attackers can also alter and tamper with the traffic flows.

Credit: PureVPN

“This enables them to direct user traffic to their own infrastructure for manipulation or inspection before passing it on to the legitimate service, should they choose,” said the DHS in its advisory. “This creates a risk that persists beyond the period of traffic redirection.”

Since the attackers can set record values for the domain name systems, they can obtain valid encryption certificates for an organization’s domain names; this allows browsers to establish a connection without any certificate errors as the certificate can be trusted, FireEye researchers said. In the most recent campaigns, the attackers have used certificates from the Let’s Encrypt open certificate authority.

That valid certificate then enables the redirected traffic to be decrypted and exposes any user-submitted data.

Government Response

The emergency directive issued by the DHS provides “required actions” that government agencies must fulfill in the next 10 business days.

“To address the significant and imminent risks to agency information and information systems presented by this activity, this emergency directive requires… near-term actions to mitigate risks from undiscovered tampering, enable agencies to prevent illegitimate DNS activity for their domains and detect unauthorized certificates,” said the report.

First, the DHS said all .gov domain admins must audit their DNS records over the next 10 days to verify if any traffic is being redirected.

The department also urged agencies to update their passwords for all accounts on systems that can make changes to agency DNS records, and to implement multi-factor authentication for accounts on DNS admin systems. Finally, agencies are being directed to monitor certificate transparency logs.

The warning comes as the U.S. government enters its 33rd day of a shutdown (as of Wednesday), a longstanding incident which has sparked concerns about its impact across the board when it comes to security.

Iran Attribution

Researchers assess “with moderate confidence” that the recent DNS hijacking activity is conducted by a group or groups in Iran, and that the activity aligns with Iranian government interests.

The attacks have been observed in clusters between January 2017 to January 2019, the researchers said in an analysis of the attacks.

Alister Shepherd, MEA director of Mandiant at FireEye, told Threatpost that the campaign is ongoing – but that there is no indication of how many credentials have been harvested thus far. However, researcher do state that the attackers had “a high degree of success” harvesting targets’ credentials.

This most recent DNS hijacking campaign “showcases the continuing evolution in tactics from Iran-based actors,” FireEye researchers stressed. “This is an overview of one set of TTPs that we recently observed affecting multiple entities.”

Source: Threatpost

Certifications

CompTIA vs Cisco certifications – Explained

By Korede Ola January 22, 2019

An Introduction to CompTIA and Cisco

When looking to break into the field of networking or aspiring to obtain a networking certification, the two most popular entry-level certifications are Cisco CCENT and CompTIA Network+.

What is CISCO?

CISCO is a company based in San Jose, California in the USA involved in the manufacturing, designing, and selling of Network Equipment. It has grown from its inception in 1984 to become the most significant networking company in existence. CISCO was added to the NASDAQ stock exchange in 1990 after going public, and in by the year, 2000 became the world’s most marketable company, showing a market capitalization of over $500 billion.

Cisco Logo

The certifications attainable from CISCO include:

• CCENT
• CCT
• CCNA Routing and Switching
• CCDA
• CCNA Cloud
• CCNA Collaboration
• CCNA Data Center
• CCNA Security
• CCNA Service Provider
• CCNP Routing and Switching
• CCDP
• CCNP Collaboration
• CCNP Data Center
• CCNP Security
• CCNP Service Provider
• CCNP Wireless
• CCIE Routing and Switching
• CCDE
• CCIE Collaboration
• CCIE Data Center
• CCIE Security
• CCIE Service Provider
• CCIE Wireless
• CCIE Routing and Switching
• CCDE
• CCIE Collaboration
• CCIE Data Center
• CCIE Security
• CCIE Service Provider
• CCIE Wireless

What is CompTIA?

CompTIA (Computing Technology Industry Association) is a non-profit trade association that was formed in 1982. The organization is vendor-neutral and provides certifications in the IT industry. It was at first known as the Association of Better Computer Dealers, but the name was later changed to better imply the company’s ever-changing role in the computer industry.

CompTIA Logo

The organization’s increase saw them eventually include subjects such as networking, imaging, mobile computing, UNIX. In 2010, CompTIA launched the “Creating IT Futures” ambition which sees them offering IT training to individuals with a lower income and veterans returning from their military duties.

Their certifications currently available from CompTIA include:

• A+
• Network+
• Security+
• CASP
• Server+
• CTT+
• Linux+
• Project+
• Cloud+

Understanding Cisco CCENT

CISCO CCENT is the first of two exams that can be passed for the student to earn their CCNA (Cisco Certified Networking Associate) certification. The review relating to CISCO CCENT is called ICND1 (Interconnecting Cisco Networking Devices Part 1).

This exam will consist of the following topics:

Explain the operation of data networks:
The student will be required to identify the functions of different network devices and to select the correct components to meet the network’s specifications. Use the protocols of TCP/IP to explain the flow of network data, explain what common web applications and networking applications are.

Implement a small switched network:
Use the correct equipment to network devices, interconnect switches, network devices, and hosts and describe media access control and technology for Ethernet types. Describe what network segmentation is, describe the operation of CISCO switches and their necessary operation, perform initial switch operations and save, and verify them. Work through hardware failures on switched networks.

Implement an IP addressing scheme and IP services to meet network requirements for a small branch office:
Create and execute an addressing scheme to a network, assign and verify IP addresses for hosts, networking devices and servers on a Local Area Network. Describe what DNS operations are and validate them, configure, test and troubleshoot DHCP and DNS on a router and identify and remedy IP address problems.

Implement a small routed network:
Describe what the basic concepts of routing are, explain the basic operation of CISCO routers, interconnect routers with networking devices using the correct equipment, connect, configure, and verify device interface operational status. Verify the device configuration using commands and utilities and ascertain the state of the network and router operation.

Explain and select the appropriate administrative tasks required for a Wireless LAN (WLAN):
Define the standards of wireless media, describe the various components of a small wireless network, specify the parameters and configuration needed for devices to connect to the right areas on a wireless network and identify common issues with wireless networks.

Identify security threats to a network and describe general methods to mitigate those threats:
Describe common network security threats and how the correct security policy helps defend against them. Describe what the best security practices to follow in securing network devices.

Implement and verify WAN links:
Describe what the different methods are to connect to a Wide Area Network, configure an essential WAN serial connection and check that network.

Understanding CompTIA Network+

CompTIA Network+ has a much broader view of networking than CISCO does, but takes a lighter approach in their topics. The topics that are included in the CompTIA Network+ course include the following:

Network Technologies:
services including TCP/IP suite, Networking protocols default TCP, and UDP port numbers, addressing formats for IPv4, IPv6, and MAC addressing, discussing addressing technologies (subnetting, CIDR, supernetting, NAT, and PAT), a discussion on routing, and a reviewing wireless communication standards, authentication, and encryption.

Network Media and Topologies:
Standard cable types and their properties including transmission speeds, distances, duplexing, noise immunity, and frequencies; cable connector types and common physical network topologies (star, mesh, bus, ring). Various wiring standards, LAN and WAN technology types, and properties plus wiring distribution systems and components.

Network Devices:
Includes the range of networking equipment like hubs, network interfaces, modems and media converters, switches, wireless access points, routers, firewalls, etc. Functions of specialized networking devices. There is a broader focus on switch details such as virtual LANs and port mirroring.

Network Management:
An explanation of management at the seven layers of the OSI model, configuration management and it’s documentation, describing how to use literature to verify a network. Monitoring network performance and connectivity, methods for optimizing a system, methods of network troubleshooting and common problem-solving issues.

Network Tools:
Different types of software and diagnostic tools used to identify and troubleshoot networking issues. Essential command-line IP tools, different network scanners. Discovering different types of diagnostic hardware such as cable testers, protocol analyzers and TDRs, electrical tools like VOMs, temperature monitors, and various other devices.

Network Security:
An overview of security device functions and features then digs into firewall features and functions, Methods of network access security and user authentication. Device security problems including physical access and logical, secure vs. insecure network access methods and common security threats and security justification techniques.

Cisco CCENT vs. CompTIA Network+

The choice between CISCO CCENT and CompTIA N+ relies on how sincerely you want to delve into the world of networking. CompTIA N+ has a much broader, yet less involved scope towards the subject while CISCO takes a more in-depth approach to networking while having a smaller extent as far as topics covered is concerned.

Both the CISCO CCENT and CompTIA certifications have recognised the world over as good entry level certifications and, whichever of the two you end up choosing, it is sure to set you well on your way to a career in networking or to add that much sought-after certification to your name.

Source: Medium

Certifications

Choosing the best IT certification in 2019

By Korede Ola January 21, 2019

IT certifications can open many doors throughout your career, especially when you’re searching for your next challenge. Recruiters and hiring managers tend to look at the Certifications section of a tech resume before anything else. Why? They want candidates with up-to-date knowledge, and IT certifications quickly show them a person’s mastery of a particular technology or practice.

These are some of the most valuable IT certifications today, according to the 2019 Robert Half Technology Salary Guide:

Certified Scrum Master (CSM)
AWS Certified Solutions Architect
Certified Ethical Hacker (CEH)
Certified Information Systems Security Professional (CISSP)
Cisco Certified Network Associate (CCNA)
Cisco Certified Network Professional (CCNP)
CompTIA A+
Global Information Assurance Certification (GIAC)
ITIL
Microsoft Certified Solutions Expert: Cloud Platform and Infrastructure
Project Management Professional (PMP)

You can earn an IT certification in a wide range of practices, from help desk basics to mastery of complex cloud environments. So whether you’re a recent graduate or seasoned tech specialist, preparing for and attaining a certification is a great way to expand your skill set, impress prospective employers and stand out from the crowd. Here’s a roundup of some of the most valuable IT certifications today.

Best entry-level and intermediate IT certifications

Just starting out in the IT field? Or perhaps you’re ready to specialize? The following are some of the best introductory and mid-level certifications today:

CompTIA certifications

CompTIA issues certifications for a variety of technologies and platforms, but one stands above the rest in terms of value to IT pros:

CompTIA A+: Get started in IT with this foundational certificate. It’s all about hardware, technical support and troubleshooting. It also covers best practices in security, networking, operational procedures, mobile devices and various operating systems.

Microsoft Certified Professional (MCP) certifications

The most valuable certifications from this tech giant include:

Microsoft Office Specialist: The MOS, MOS Expert and MOS Master certifications show your competence level in Word, Excel, Outlook, PowerPoint, Access, SharePoint, OneNote and Exchange. They’re not just for administrative professionals — these certifications are also helpful for IT workers in cloud computing and general tech support.
Microsoft Certified Solutions Expert: MCSE certifications come in several specializations and show that you have the skills to manage servers, data systems, storage, private clouds, networking and more, depending on which ones you successfully complete.
Microsoft Certified Solution Developer: Getting the MCSD certification shows that you have what it takes to design and create apps across a wide range of Windows products.

Cisco certifications

As Cisco is a leading provider of infrastructure products, a certificate from this company confirms that the holder is prepared for the latest developments and best practices in networking. The most essential are:

Cisco Certified Network Associate: A step up from Cisco’s entry-level certification, CCNAs can specialize in one of the following areas: cloud, collaboration, cyber operations, data center, industrial/IoT, routing and switching, security, service provider, and wireless.
Cisco Certified Network Professional: A step up from the associate level, the CCNP is a more advanced IT certificate in one of the above specialty areas.

Best IT certifications for security

Hacking and cyber attacks are hot topics today, and many jobs in security and risk management are going unfilled. The following are some of the most valuable IT certifications in this booming field.

ISACA certifications

A professional organization devoted to IT security and governance, ISACA manages five global certification programs, including:

Certified Information Systems Auditor: According to the ISACA, the CISA is its cornerstone certification. As the name indicates, this exam is aimed at information systems (IS) professionals who monitor, control and assess a company’s IT or business systems. This certificate requires five years of professional experience in the field.
Certified Information Security Manager: The leading credential for information security managers, the CISM certification is designed for people who design, build and manage information security programs. To qualify, you must have at least five years of IS experience and three years as a security manager.
Certified in Risk and Information Systems Control: The CRISC (pronounced SEE-risk) accredits professionals and project managers responsible for information security and its overall impact on the enterprise. It covers risk identification, risk assessment, risk response and mitigation, and risk control monitoring and reporting.
Certified in the Governance of Enterprise IT: The CGEIT demonstrates your understanding of enterprise IT governance principles and practices. It is one of the most sought-after certifications in IT, commanding some of the highest salaries.
Cybersecurity Nexus: In a time of constantly evolving cybersecurity threats, the CSX certification demonstrates that you are up-to-date on the most current security standards and risks.

Other valuable IT certifications for security include:

Certified Ethical Hacker: EC-Council offers several certification programs, and one of the most popular ones is the CEH. Holders of this specialize in penetration testing, which is why this IT certificate is often a prerequisite for positions like cyber forensics analyst, cybersecurity engineer and applications developer.
Certified Information Systems Security Professional: This is one of the most sought-after certifications in cybersecurity. Designed for experienced IT professionals, CISSP holders understand vulnerabilities in networked systems and create policies to safeguard systems and minimize risk.
Global Information Assurance Certifications: All about information security, the GIACs come in several categories: cyber defense; penetration testing; incident response and forensics; cybersecurity management, audit and legal proficiencies; developer; and industrial control systems. The highest level is the GIAC Security Expert (GSE).

Best certifications for cloud computing

As cloud computing becomes the new normal in IT, more cloud credentials are available. Many of them are specific to individual vendors, including Microsoft, VMware and Amazon. There are also a few certifications that focus on more general practices across this fast-growing area. Top certifications include:

CompTIA Cloud Essentials and CompTIA Cloud+: The CompTIA Cloud Essentials certification covers both cloud computing and virtualization skills. Cloud+ represents the next step up from the Essentials certification.
MCSE: Cloud Platform and Infrastructure: Passing this exam testifies to your skills across a wide set of Microsoft’s cloud technologies, including storage, networking, virtualization, and systems and identity management.
VMware Certified Professional 6 – Data Center Virtualization: Virtualization is the foundation of cloud computing, and VMware offers the VCP6-DCV certification in managing data center virtualization via VMware’s vSphere 6.0 and vRealize within cloud environments.
AWS Certified Solutions Architect – Professional: Amazon is the largest provider of cloud computing services, and this certification affirms your ability to design and deploy cloud environments using Amazon Web Services.

Best management certifications

Project management is indispensable to IT operations. Even if you’re tech-focused, it can be a very valuable soft skill to acquire. And because project management involves planning, scheduling, budgeting and execution, certification can be a key steppingstone to managerial positions.

Certified Associate in Project Management: Offered by the highly respected Project Management Institute (PMI), the CAPM is an ideal entry-level credential.
Project Management Professional: Also offered by PMI, the PMP credential is among the most prestigious in the profession. A number of subspecialty certifications are also available.
Certified Scrum Master: The entry-level CSM certification is offered by the Scrum Alliance. It is an excellent way to show your knowledge of Scrum and Agile management practices.

Best help desk certifications

Many IT professionals begin their careers in technical support and help desk roles. And to give students a leg up, schools are increasingly offering courses that specifically prepare students to gain help desk certifications.

You can gain certification in either help desk functions as a whole, or you can concentrate on a specific vendor’s platforms and products.

HDI certifications: Formerly called the Help Desk Institute, HDI offers certifications that range from the entry-level HDI Desktop Support Technician to the HDI Support Center Director. The HDI Technical Support Professional certification is particularly popular with hiring managers. They also offer credentials for support center analysts, team leaders and customer service representatives.
ITIL: The UK organization AXELOS is charged with promoting best practices for IT service management (ITSM). ITIL, formerly an acronym for Information Technology Infrastructure Library, is the registered name for a widely accepted framework for managing IT service delivery. There are five ITIL certifications, ranging from Foundation to Master.
Apple Certified Support Professional: You can demonstrate your expertise with macOS with this the ACSP certification from Apple.

Best certifications in database, analytics and other data technologies

Database technologies remain foundational to IT operations, while growth in big data and analytics initiatives is driving new career opportunities. Certifications tend to be built around a single provider’s platform, including:

Oracle Certified Professional: Oracle, the world’s leading database provider, offers certification in a range of database professions, from database administration and database application development to analytics, data warehousing and big data.
SAP Certified Technology Associate – SAP HANA 2.0: This certification demonstrates your ability to install, manage, monitor, migrate and troubleshoot SAP’s database technology.
Microsoft SQL Server certifications: Like Oracle, Microsoft offers a range of certifications, including database administration, business intelligence, and data management and analytics.
CCIE Data Center: This Cisco certification demonstrates expert-level skills required to plan, prepare, operate, monitor and troubleshoot complex data center networks.

According to the Robert Half Technology Salary Guide, employers prefer to hire certified professionals, especially those who also have college degrees and real-world experience to go along with them. Those who put in the effort to obtain credentials can expect larger salaries and quicker movement up the career ladder, not to mention a healthy shot of self-confidence.

Source: Robert Half

Cybersecurity

How To Find Out If Your Password Has Been Stolen

By Korede Ola January 17, 2019

What just happened?

Yesterday, it emerged that more than a billion unique email address and password combinations had been posted to a hacking forum for anyone to see in a mega-breach dubbed Collection #1.

The breach was revealed by security researcher Troy Hunt, who runs the service allowing users to see if they’ve been hacked called Have I been Pwned. He has now loaded the unique email addresses totalling 772,904,991 onto the site.

The data includes more than a billion unique email and password combinations – which hackers can use over a range of sites to compromise your services. They will do so by utilizing so-called credential stuffing attacks, seeing bots automatically testing millions of email and password combinations on a whole range of website login pages.

The data originally appeared briefly on cloud service MEGA and was later posted to a popular hacking forum. The Collection #1 folder is comprised of more than 12,000 files weighing in at 87 gigabytes.

Most concerningly, the protective hashing of the stolen passwords had been cracked. This means they are easy to use because they are available in plain text rather than being cryptographically hashed as they often are when sites are breached.

Should I be worried?

In a word: Yes. It’s a massive concern, not least because scale of this breach is huge: Yahoo’s breaches saw 1 billion and 3 billion users affected but the stolen data hasn’t actually resurfaced yet.

And unlike other huge hacks such as Yahoo and Equifax, this breach cannot be tied down to one site. Instead it appears to comprise multiple breaches across a number of services including 2,000 databases.

Hunt says there are many legitimate breaches in the directory listing, but he cannot yet verify this further. “This number makes it the single largest breach ever to be loaded into HIBP,” he adds in a blog.

What’s more, his own personal data is in there “and it’s accurate”, he says. “Right email address and a password I used many years ago. Like many of you reading this, I’ve been in multiple data breaches before which have resulted in my email addresses and yes, my passwords, circulating in public.”

Finding out if you’re affected

If you are one of the 2.2 million people that already use the Have I Been Pwned site, you should have received a notification: Nearly half of the site’s users – or 768,000 – are caught up in this breach.

If you aren’t already a member, you need to visit Have I Been Pwned now. Once on the site, you simply need to type in your email address and search, then scroll down to the bottom of the page. The site will let you know if your email address is affected by this breach – and while you are there, you can see if your details were stolen in any others too.

To find out if your password has been compromised, you separately need to check Pwned Passwords– a feature built into the site recently. This feature also helps you to use strong passwords: if yours is on there, it’s safe to assume others are using it and your accounts could be easily breached.

What if my details are there?

Hunt says in his blog: “Whilst I can’t tell you precisely what password was against your own record in the breach, I can tell you if any password you’re interested in has appeared in previous breaches Pwned Passwords has indexed. If one of yours shows up there, you really want to stop using it on any service you care about.”

If you have a bunch of passwords, checking all of them could be time-consuming. In this case, Hunt suggests 1Password’s Watchtower feature which can take all your stored passwords and check them against Pwned Passwords in one go.

Most importantly, if your password is on the list, do not ignore it as it can be used in credential stuffing attacks mentioned earlier. Hunt says: “People take lists like these that contain our email addresses and passwords then they attempt to see where else they work. The success of this approach is predicated on the fact that people reuse the same credentials on multiple services.”

More generally, as the number of breaches and their sheer scale increases, it’s time to clean up your password practices. In addition to using two-factor authentication, passwords should be complex – such as a phrase from a favourite book or a line from a song. At the same time, security experts don’t rule out analogue books containing your password – as long as these are not stored on your device or with it.

If you take these measures into account you should be able to avoid using the same password across multiple sites. Ideally, start using a password manager to ensure you can remember these.

Source: Forbes