-- Promote use of strong, unique passwords and MFA to protect accounts -- Emphasize the importance of keeping system and software up to date to address vulnerabilities -- Prioritize ongoing security awareness training to educate employees about recognizing and responding to threats like phishing. -- Limit data access to authorized individuals and classify sensitive data for appropriate security measures. -- Stress the need of monitoring and periodic internal and external security audits to detect and address weakness. -- Regular data backups for effective mitigations and recovery in the event of security breach.

"I have identified a series of strategic actions that can be effectively employed across diverse incident scenarios after attack or while investigating attack." Auditing all AD accounts, especially any Administrative or Domain admin accounts, check for new additions, remove any unrecognized accounts or stale accounts. (Specifically check things like scanning accounts or any other service accounts https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns) Checking for startup items, registries, scheduled tasks or WMI objects that may be added to achieve persistence. Checking for the path "‎\Device\HarddiskVolume*\Windows\System32\" and delete anything suspicious. Reseting the account for all the AD users and also reset the Kerberos account - Krbtgt Make sure to reset it twice. https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-resetting-the-krbtgt-password Auditing all firewalls and ensure there are no rules allowing RDP (3389 default) or Remote Access externally facing from the internet. Checking firewalls as well for non-standard remote access ports being allowed and ensure these are disabled from being internet facing if at all possible. Auditing accounts with administrative permissions, and ensure they are limited based on least privilege needed to perform required functionality. Requesting clients to the autoruns tool from Microsoft and verify there is nothing suspicious in the startup items, scheduled tasks, or WMI objects: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns Verifying integrity of OS files using command "sfc /scannow" Akash Patel

A topic that frequently surfaces is the comparison between Endpoint Detection and Response (EDR) and Security Information and Event Management (SIEM) solutions. While people mostly say that SIEM is better than EDR. For me, the two serve different, yet complementary, functions within the security landscape. EDR: EDR solutions are the guardians of endpoints. The most important benefits I can think of are: Threat Detection: As it uses AI and behaviour and multiple engines. It becomes very effective to detect threats and malicious activities on endpoints. Incident Response: Very best benefit, EDR provide enabling quick actions to contain and mitigate security incidents. (for example Sentinel One is its ability to capture snapshots at regular intervals, such as every four hours, as a proactive measure against threats like ransomware. These snapshots serve as crucial checkpoints in the event of a security incident, allowing for a potential rollback action to restore the endpoint to a previous, uncompromised state) On other hand SIEM: SIEM, on the other hand, acts as the central intelligence hub for network-wide security. It collects and analyzes data from diverse sources, including network devices, applications, and systems. The most important benefits I can think of are: Centralized Data Analysis It correlates data from multiple sources, helping organizations understand the full context of the threat. Now for me where Defense-in-Depth Approach comes into place: In truth, EDR and SIEM are not adversaries; they play complementary roles in your cybersecurity strategy. EDR acts as the frontline protector of endpoints, ensuring real-time monitoring and incident response. SIEM serves as the network-wide guardian, offering comprehensive incident management, compliance adherence, and historical data analysis. In Conclusion: (I have seen multiple hiring Companies neglect experience in EDR, I still don't understand why) For me EDR plays an indispensable role in cybersecurity. Neglecting EDR in favor of SIEM can leave an organization vulnerable to endpoint-focused threats.

Ransomware attacks have become increasingly prevalent in recent years, posing a significant threat to individuals and organizations alike. In this blog, we'll delve into My view and steps follow by me while working on ransomware. Understanding Ransomware Before dive into the strategies to combat ransomware, it's essential to understand what ransomware is. Ransomware is malicious software that encrypts your files and demands a ransom for the decryption key. Once infected, victims face the agonizing choice of paying the ransom or losing their data forever. The Role of an IT Professional As an IT professional, I had the opportunity to assist a client who fell victim to a ransomware attack. In this blog, I'll share my experience and the steps taken to help the client recover their data and prevent future attacks. Step 1: Initial Investigation Detection and Assessment: The journey begins with detecting a ransomware incident. Identifying the attack's origin, affected systems, and the ransom note is crucial. Blocking IOCs (Indicators of Compromise): In the initial response phase, I quickly identified and blocked any known IOCs, including IP addresses, URLs, and file hashes. This limits the ransomware's ability to communicate with its command and control servers. Step 2: Isolation Network Segmentation: To prevent further spread of the ransomware, I isolated the affected systems and segments of the network, containing the threat. User Education: I communicated with the client's employees to raise awareness about the ransomware incident, advising them to report any suspicious activities. Step 3: Comprehensive Analysis Scheduled Task Examination: I thoroughly examined the affected systems' scheduled tasks to identify any rogue tasks set by the ransomware. Removing these tasks prevents the ransomware from reinfecting the system. Registry Analysis: A deep dive into the Windows Registry helped me identify and clean any malicious entries added by the ransomware. Event Log Inspection: Reviewing event logs provided insights into the ransomware's activities and the scope of the compromise..........and more Step 4: Recommendations Security Audit: I conducted a comprehensive security audit to identify vulnerabilities that allowed the ransomware to infiltrate the network. These vulnerabilities were then addressed. Policy and Procedure Enhancements: I recommended policy changes and security procedure enhancements to prevent future incidents, including stricter access controls, email filtering, and regular security training for employees. Step 5: Client Remediation Data Restoration: Working closely with the client, we initiated a data restoration process from clean backups. This was a crucial step in ensuring that no data loss occurred, without resorting to paying the ransom. Rollback Strategy: We developed a detailed rollback strategy to ensure that the client's systems were returned to their pre-infection state, including necessary updates and patches. Conclusion In the face of a ransomware attack, a swift and coordinated response is essential. This experience highlights the significance of preparedness, including robust backups, employee training, and proactive security measures. Remember, prevention and preparation are your best defense against ransomware.

In the hustle and bustle of our daily lives, it's crucial to find those moments of reprieve, those little escapes that transport us far away from deadlines, responsibilities, and the never-ending to-do lists. For many, including myself, one of the most cherished ways to blow off steam and rejuvenate the soul. There's something incredibly therapeutic about sinking into your favorite spot, wrapping yourself in a cozy blanket, and queuing up the next episode of a gripping series. It's like a mini-vacation for the mind, a mental massage, if you will. As you surrender yourself to storytelling, the weight of the world gradually lifts from your shoulders. The worries of the day begin to fade into the background, and you find yourself immersed in a captivating alternate reality. It's an escape that doesn't require packing a suitcase or booking a flight. All you need is a screen and a bit of time to spare. ISo, the next time you find yourself in need of some well-deserved downtime, don't hesitate to turn on your favorite series, unwind, and let the outside world slip away. After all, it's your passport to relaxation, and it's always just a click away.

Have you ever felt a burning desire to explore the world, immerse yourself in different cultures, and kickstart a career on foreign soil? Well, that's exactly where I found myself not too long ago. Armed with dreams of working abroad, I embarked on a journey that would test my determination and resilience. My first significant step in this journey was taking the IELTS exam, a widely recognized English language proficiency test. I put in the effort, committed to hours of practice, and took the test with hopes of securing a score that would open doors to international opportunities. When the results arrived, I had achieved a respectable score of 7 bands. It was a great start, but I knew that my aspirations required more. With the determination to raise my prospects, I decided to take the plunge and prepare for the IELTS exam once again. Why the relentless pursuit of improvement, you ask? The answer is simple: the world is full of opportunities, and I refuse to let language proficiency be a barrier. I aspire to work in diverse environments, interact with people from different corners of the globe, and contribute to projects that have a global impact. So, my journey continues. I'm preparing for the IELTS exam once more, with a commitment to enhancing my English language skills until they shine brightly on my scorecard. This journey is not just about achieving a higher score; it's about pursuing a future filled with new experiences, personal growth, and professional success. Embark on your journey with determination and let the world be your oyster. Best of luck

Job hunting is never an easy task, but when you decide to take your career to an international level, the challenges can become even more daunting

"India stops processing visas for Canadian citizens" If Canada does the same, than it will be trouble for lot of people. India has long been a significant source of immigrants to Canada, with thousands of individuals seeking opportunities for education, work, and permanent residency. The Indian community in Canada has grown to over one million strong, and many have close ties to their homeland, where relatives and loved ones still reside. 1. Impact on Current Applications: Individuals who have already applied for visas to Canada, whether for study or permanent residency, may face delays and uncertainties. The processing halt could have a profound impact on their plans and aspirations. 2. Families Separated: The Indian diaspora in Canada is extensive, and many have family members back in India. Any disruption in visa processing could lead to prolonged separations, causing emotional and logistical challenges. 3. Human Stories: Behind every visa application is a human story—a dream, a pursuit of education, a search for better opportunities, or a desire to reunite with family. These stories are now intertwined with uncertainty. Lets hope everything will get sorted out untill than....................lets wait

On 15 September. A women asked me a question As you are working in Cyber security "Do college students need to have a career plan while they are in college? Do you had a career plan when you were in college?" Well, Question was interesting and the answer I gave was. In my perspective, life can be highly unpredictable. During my college years, I did have certain plans in mind. However, unforeseen events occurred that disrupted those plans. Therefore, creating an exhaustive career plan during college years may not always be feasible. Instead, students can aspire towards particular goals and objectives. For instance, I aimed to transition into the IT sector, and I successfully achieved that goal. While it's essential to have aspirations and a general direction in mind, the ever-changing nature of life often necessitates adaptability rather than rigid planning.

I am thrilled to share that I have been promoted to the position of Cyber Security Analyst L2, all thanks to the incredible opportunities provided by ConnectWise. This achievement marks a significant milestone in my professional journey, reflecting my dedication and passion for the field of cybersecurity. Throughout my time at ConnectWise, I have had the privilege of contributing to the dynamic world of cybersecurity, honing my skills and expertise in safeguarding digital landscapes. I am truly grateful for the support of my colleagues, mentors, and the innovative environment that ConnectWise fosters. While this accomplishment is an individual milestone, I firmly believe that success is a result of collaborative efforts. I look forward to continuing my journey in the cybersecurity realm, learning, growing, and contributing to the ever-evolving landscape of digital protection.

It was a great opportunity to talk with Steve and Curtis about culture and how Mastercard fosters learning and helps others. It was truly pleasure to be a part of the discussion and learn from them. I am grateful for their insights they shared on personal growth and progression. Their journey, hard work, perseverance, and a constant hunger and how they climbed the ladder of success. Starting from a modest background, they steadily advanced in their chosen field, leaving an indelible mark on the hearts of colleagues. Their passion and dedication to their craft shone brightly, earning them accolades and recognition along the way. Today, they stand as a true inspiration to all those around them. Their journey from where they began to where they are now. Their success story is a beacon of hope and motivation for everyone. Thank you Steve and Curtis (It was a great speaking to you guys)