Fortuna Cysec helps Extended Care Facility increase its security and privacy posture
Increased Social Engineering attacks targeting the IT Helpdesk
Increased Social Engineering attacks targeting the IT Helpdesk
As per the latest sector alert published by The U.S. Health and Human Services, in coordination with its Health Sector Cybersecurity Coordination Center, advises on having user awareness training, as well as policies and procedures for increased security for identity verification with help desk requests. The threat actors continue to evolve their tactics, techniques, and procedures (TTPs) to achieve their goal which is to gain initial access to target organizations.
Tactics, Techniques, and Procedures used by threat actors
As per the HC3 April 3rd alert social engineering is being used across the Healthcare and Public Health (HPH) sector to gain unauthorized access to systems. Threat actors are employing sophisticated social engineering techniques to target an organization’s IT help desk with phone calls from an area code local to the target organization, claiming to be an employee in a financial role (specifically in revenue cycle or administrator roles).
The threat actor can provide the required sensitive information for identity verification, including the last four digits of the target employee’s social security number (SSN) and corporate ID number, along with other demographic details. These details were likely obtained from professional networking sites and other publicly available information sources, such as previous data breaches.
The threat actor claimed that their phone was broken, and therefore could not log in or receive MFA tokens. The threat actor then successfully convinced the IT help desk to enroll a new device in multi-factor authentication (MFA) to gain access to corporate resources.
After gaining access, the threat actor specifically targeted login information related to payer websites, where they then submitted a form to make ACH changes for payer accounts. Once access has been gained to employee email accounts, they sent instructions to payment processors to divert legitimate payments to attacker-controlled U.S. bank accounts.
The funds were then transferred to overseas accounts. During the malicious campaign, the threat actor also registered a domain with a single-letter variation of the target organization and created an account impersonating the target organization’s Chief Financial Officer (CFO).
Rise in Spearphishing voice
What is Spearphishing?
Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary.
Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (impersonation) and/or creating a sense of urgency or alarm for the recipient.
Scattered Spider is a cybercriminal group that has been active since at least 2022 targeting customer relationship management and business-process outsourcing (BPO) firms as well as telecommunications and technology companies. During campaigns, Scattered Spider has leveraged targeted social-engineering techniques and attempted to bypass popular endpoint security tools
They have used several techniques to exploit such as Account Discovery: Cloud Account, Account Discovery: Email Account, Account Manipulation: Additional Cloud Roles, Account Manipulation: Device Registration, Account Manipulation: Additional Cloud Credentials, Data from Cloud Storage, Data from Information Repositories: Sharepoint, Exploit Public-Facing Application, External Remote Services, Gather Victim Identity Information: Credentials, Impersonation, Ingress Tool Transfer, Modify Cloud Compute Infrastructure: Create Cloud Instance, Multi-Factor Authentication Request Generation, Network Service Discovery, Obtain Capabilities: Tool, OS Credential Dumping: DCSync, Permission Groups Discovery: Cloud Groups, Phishing: Spearphishing Voice, Phishing for Information: Spearphishing Voice, Phishing for Information: Spearphishing Service, Protocol Tunneling, Proxy, Remote Access Software, Remote Services: Cloud Services, Valid Accounts: Cloud Accounts, Web Service, Windows Management Instrumentation
How can organizations protect against Spearphishing Voice?
Healthcare organizations and service providers need to implement various detection methods, policies, and procedures to validate the users requesting a password reset or mobile device enrollment.
Helpdesk agents need to employ atmost judgement as the adversary will employ manipulation techniques to bypass the call-back authentication or verification process in place.
Monitor call logs from corporate devices to identify patterns of potential voice phishing, such as calls to/from known malicious phone numbers. Correlate these records with system events.
- Enable logging of events, messaging, and other artifacts provided by third-party services ( ex: metrics, errors, and/or alerts )
- Monitor the events and alerts 24X7X365 using Security Operation Center (SOC)
- Ensure to use of security systems that can tag events from NDR, EDR, SIEM to MITRE ATT&CK framework and are able to predict the later movement quickly
Users can be trained to identify and report social engineering techniques and spearphishing attempts, while also being suspicious of and verifying the identity of callers.
- Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.
- Periodic security awareness training and tabletop exercises can help users understand the impact and mitigation procedures.
- Reviewing process and having escalation procedures for confirming incoming requests through an independent platform like a phone call or in-person, to reduce risk.
Benefits of an MSSP
Benefits of an MSSP
Managed Security Services (MSS) are crucial in today's digital landscape to help organizations protect their sensitive information, critical systems, and overall digital assets from an ever-evolving landscape of cyber threats. Cyberattacks are increasing in complexity and sophistication. Here are some reasons why organizations need Managed Security Services:
Expertise and Specialization:
Cybersecurity is a complex and rapidly evolving field. Managed Security Service Providers (MSSPs) are dedicated to staying up to date with the latest threats, vulnerabilities, and defense strategies. They employ a team of skilled cybersecurity professionals with specialized knowledge and experience in handling various security challenges.
24/7 Monitoring and Response:
Cyber threats can occur at any time, day or night. MSSPs offer continuous monitoring of an organization's networks and systems. This 24/7 monitoring ensures that potential threats are identified and addressed in real-time, reducing the risk of data breaches and minimizing downtime.
Advanced Tools and Technologies:
MSSPs utilize advanced security tools, technologies, and threat intelligence platforms that might be cost-prohibitive for individual organizations to implement and manage on their own. This allows organizations to benefit from cutting-edge security solutions without the need for significant upfront investments.
Scalability:
As organizations grow, their security needs also evolve. MSSPs offer scalability, allowing organizations to easily adjust the level of security services based on their changing requirements without having to invest in new infrastructure or hire additional personnel.
Cost Efficiency:
Building an in-house cybersecurity team and infrastructure can be expensive. It requires recruiting, training, and retaining skilled cybersecurity professionals, as well as investing in hardware, software, and ongoing maintenance. MSSPs offer a more cost-effective solution, as organizations pay for the services they need without the overhead of managing an internal security team.
Focus on Core Business Activities:
Managing cybersecurity internally can be resource-intensive and distract organizations from their core business objectives. By outsourcing security to MSSPs, organizations can free up their internal resources to focus on strategic initiatives that drive growth and innovation.
Compliance and Regulations:
Many industries are subject to strict regulatory requirements regarding data protection and cybersecurity. MSSPs have experience in navigating these compliance frameworks and can help organizations ensure that they meet the necessary standards.
Rapid Incident Response:
In the event of a security incident or breach, MSSPs have established incident response protocols and teams ready to mitigate the damage and guide the organization through the recovery process.
Risk Management:
MSSPs provide organizations with a comprehensive understanding of their security posture and vulnerabilities. This enables organizations to make informed decisions about risk mitigation strategies and allocate resources effectively.
Threat Intelligence:
MSSPs gather threat intelligence from a wide range of sources, allowing them to identify emerging threats and trends. This proactive approach helps organizations stay ahead of potential attacks and adapt their security measures accordingly.
In summary, Managed Security Services offer organizations the advantage of specialized expertise, round-the-clock protection, advanced tools, scalability, cost savings, and the ability to focus on core business activities. As cyber threats become more sophisticated and prevalent, many organizations find that partnering with MSSPs is a strategic way to enhance their overall cybersecurity posture.
Monthly Cybersecurity Vulnerability Bulletin May 2023
Monthly Cybersecurity Vulnerability Bulletin
In May 2023, the vulnerabilities list released includes the monthly Patch Tuesday
vulnerabilities released by several vendors on the second Tuesday of each month,
along with mitigation steps and patches. Vulnerabilities for May are from Microsoft,
Google/Android, Apple, Mozilla, SAP, Cisco, Fortinet, VMWare, and MOVEit.
A vulnerability is given the classification as a zero-day if it is actively exploited with
no fix available or is publicly disclosed. Fortuna Cysec and all security agencies
strongly recommends patching all vulnerabilities, with special consideration to the
risk management posture of the organization.
MOVEit Transfer Critical Vulnerability
A critical vulnerability was discovered in Progress/IPswitch’s MOVEit Transfer
software. MOVEit is a managed file transfer software that encrypts files and uses
secure File Transfer Protocols to transfer data with automation, analytics and
failover options. Tracked as CVE-2023-34362, this vulnerability could lead to
escalated privileges and potential unauthorized access to the environment. It is
recommended that all MOVEit Transfer software users protect their MOVEit Transfer
environment by taking immediate action following Progress’ remediation guidance,
which can be viewed by clicking here.
Department Of Homeland Security/Cybersecurity & Infrastructure Security
Agency
The Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure
Security Agency (CISA) added a total of 19 vulnerabilities in May to their Known
Exploited Vulnerabilities Catalog.
This effort is driven by Binding Operational Directive (BOD) 22-01: Reducing the
Significant Risk of Known Exploited Vulnerabilities, which established the Known
Exploited Vulnerabilities Catalog as a living list of known CVEs that carry significant
risk to the U.S. federal enterprise.
Vulnerabilities that are entered into this catalog are required to be patched by their
associated deadline by all U.S. executive agencies. While these requirements do not
extend to the private sector, It is recommended that all entities review
vulnerabilities in this catalog and consider prioritizing them as part of their risk
mitigation plan. The full database can be found here.
Microsoft
Microsoft issued security updates to fix 38 vulnerabilities and two actively exploited
zero-day vulnerabilities in May. Six of these vulnerabilities have been classified as
'Critical,' which is one of the most severe types of vulnerabilities, as they allow
remote code execution. The number of bugs in each vulnerability category is listed
as follows:
• 8 Elevation of Privilege Vulnerabilities
• 4 Security Feature Bypass Vulnerabilities
• 12 Remote Code Execution Vulnerabilities
• 8 Information Disclosure Vulnerabilities
• 5 Denial of Service Vulnerabilities
• 1 Spoofing Vulnerability
May’s Patch Tuesday had the lowest number of resolved vulnerabilities for Microsoft,
with only thirty-eight vulnerabilities fixed; this is not including eleven Microsoft Edge
vulnerabilities fixed on May 5th.
May’s Patch Tuesday addressed three zero-day vulnerabilities, with two exploited in
attacks and one publicly disclosed. Additional information on the two actively
exploited zero-day vulnerabilities is as follows:
• CVE-2023-29336 – This is a Win32k Elevation of Privilege vulnerability with a CVSS
score of 7.8. Microsoft has fixed this privilege elevation vulnerability in the Win32k
Kernel driver that elevates privileges to SYSTEM, which is Windows' highest user
privilege level. A threat actor who successfully exploits this vulnerability could gain
SYSTEM privileges.
• CVE-2023-24932 – This is a Secure Boot Security Feature Bypass vulnerability with
a CVSS score of 6.2. Microsoft has fixed this Secure Boot bypass that is weaponized
by the BlackLotus UEFI bootkit to exploit CVE-2022-21894 (aka Baton Drop), which
was resolved in January 2022.
Microsoft also released an update for one publicly disclosed zero-day that was not
actively exploited. This is tracked as CVE-2023-29325 and is a Windows OLE Remote
Code Execution vulnerability. According to Microsoft, “In an email attack scenario,
an attacker could exploit the vulnerability by sending the specially crafted email to
the victim.”
For a complete list of Microsoft vulnerabilities released in May and their rating, click
here, and for all security updates, click here. It is recommended that all users follow
Microsoft’s guidance, which is to refer to Microsoft's Security Response Center and
apply the necessary updates and patches immediately, as these vulnerabilities can
adversely impact the entities
Google/Android
Google released security updates in May for Android devices with fixes for over 47
vulnerabilities. While there were no critical flaws addressed, there were high and
moderate severity flaws, with the worst vulnerability potentially leading to privilege
escalation if a threat actor is able to gain physical access to a target’s device. Every
month, security updates are released in two parts. The first part of the update
arrived as the 2023-05-01 security patch level, and 16 vulnerabilities were resolved
in the Android System and Framework. The second part of Android’s security update
arrived on devices as the 2023-05-05 security patch level. This security update
included fixes for 29 vendor-specific vulnerabilities, and two Pixel-specific flaws were
addressed as well. One of Android’s most notable security updates released this
month was a patch for a high-severity vulnerability exploited as a zero-day to install
commercial spyware on compromised devices. Tracked as CVE-2023-0266, this flaw
is a use-after-free weakness in the Linux Kernel sound subsystem that may result in
privilege escalation without requiring user interaction. Google also released Chrome
version 101.0.4951.64 for Windows, Linux, and Mac. This version addresses
vulnerabilities that a threat actor could exploit to take control of a compromised
system. It is recommended all users follow CISA’s guidance to review the Chrome
Release Note and apply the necessary update. It is also recommended users refer to
the Android and Google service mitigations section for a summary of the mitigations
provided by Android security platform and Google Play Protect, which improve the
security of the Android platform. It is imperative that health sector employees keep
their devices updated and apply patches immediately, and those who use older
devices follow previous guidance to prevent their devices from being compromised.
All Android and Google service mitigations along with security information on
vulnerabilities affecting Android devices can be viewed by clicking here.
Apple
This month, CISA ordered federal agencies to address three recently patched zero-
day flaws affecting Apple’s iPhones, Macs, and iPads based on evidence of active
exploitation. The vulnerabilities found in the WebKit browser engine are tracked as
CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373. If successful with
exploitation, threat actors have the ability to escape the browser sandbox, access
sensitive information on a compromised device, and achieve arbitrary code
execution.
According to CISA: “These types of vulnerabilities are frequent attack vectors for
malicious cyber actors and pose significant risks to the federal enterprise.” It is
recommended all users and administrators follow CISA’s guidance which
“encourages users and administrators to review the following advisories and apply
the necessary updates”:
• Apple Multiple Products WebKit Sandbox Escape Vulnerability (CVE-2023-32409)
• Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability (CVE-2023-
28204)
• Apple Multiple Products WebKit Use-After-Free Vulnerability (CVE-2023-32373)
For the first time ever, Apple released a Rapid Security Response to owners of the
devices running iOS 16.4.1 or later, iPadOS 16.4.1 or later, or macOS Ventura 13.3.1
or later. Apple Rapid Security Response was released about a year ago, and is a
security-focused feature that makes user devices automatically install security
patches as they are made available. For a complete list of the latest Apple security
and software updates, click here. It is recommended all users install updates and
apply patches immediately. It is worth noting that after a software update is
installed for iOS, iPadOS, tvOS, and watchOS, it cannot be downgraded to the
previous version.
Mozilla
Mozilla released security advisories for vulnerabilities affecting multiple Mozilla
products, including in Thunderbird, Firefox, and Firefox ESR. If successful, a threat
actor could exploit these vulnerabilities and take control of a compromised device or
system. Best Practices encourages all users to follow CISA’s guidance, which
encourages all users to review the following advisories and apply the necessary
updates:
• Firefox 113 Mozilla Foundation Security Advisory 2023-16
• Firefox ESR 102.11 Mozilla Foundation Security Advisory 2023-17
• Thunderbird 102.11 Mozilla Foundation Security Advisory 2023-18
A complete list of Mozilla’s updates, including lower severity vulnerabilities, are
available on the Mozilla Foundation Security Advisories page. It is recommended
applying the necessary updates and patches immediately and following Mozilla’s
guidance for additional support.
SAP
SAP released 18 new security notes and six updates to previously issued security
notes, to address vulnerabilities affecting multiple products. If successful with
launching an attack, a threat actor could exploit these vulnerabilities and take
control of a compromised device or system. This month, there were two
vulnerabilities with a severity rating of “Hot News,” which is the most severe rating.
There were also nine flaws rated as “High, 10 “Medium,” and three “Low” in
severity. A breakdown of some security notes for vulnerabilities with “Hot News”
severity rating are as follows:
• Security Note #3328495 - (CVE-2021-44151, CVE-2021-44152, CVE-2021-44153,
CVE-2021-44154, CVE-2021-44155) has a 9.8 CVSS score and ‘Hot News’ severity
rating. Multiple vulnerabilities associated with Reprise License Manager 14.2
component used with SAP 3D Visual Enterprise License Manager. Product(s)
impacted: SAP 3D Visual Enterprise License Manager, Version–15.
• Security Note #3307833 - (CVE-2023-28762) has a 9.1 CVSS score and a ‘Hot
News’ severity rating. Information Disclosure vulnerabilities in SAP BusinessObjects
Intelligence Platform.
Product(s) impacted: SAP BusinessObjects Intelligence Platform, Versions–420,430.
For a complete list of SAP’s security notes and updates for vulnerabilities released in
May, click here. It is recommended patching immediately and following SAP’s
guidance for additional support. To fix vulnerabilities discovered in SAP products,
SAP recommends customers visit the Support Portal and apply patches to protect
their SAP landscape.
Cisco
Cisco released security advisories for vulnerabilities affecting multiple Cisco
products. Two advisories were rated “Critical,” two as “High,” and 12 as “Medium.”
Additional information on the “Critical” security advisories are as follows:
• Cisco Small Business Series Switches Buffer Overflow Vulnerabilities has a CVSS
score of 9.8. A remote threat actor could exploit these vulnerabilities to cause a
denial-of-service condition or execute arbitrary code with root privileges on an
affected device. Vulnerabilities for this advisory are: CVE-2023-20024, CVE-2023-
20156, CVE-2023-20157, CVE-2023-20158, CVE-2023-20159, CVE-2023-20160,
CVE-2023-20161, CVE-2023-20162, and CVE-2023-20189.
• Cisco SPA112 2-Port Phone Adapters Remote Command Execution Vulnerability
(CVE-2023-20126) has a CVSS score of 9.8. This is a vulnerability in the web-based
management interface of Cisco SPA112 2-Port Phone Adapters that could allow an
unauthenticated, remote threat actor to execute arbitrary code on an affected
device. This is caused by a missing authentication process within the firmware
upgrade function. If successful, a remote threat actor could exploit this vulnerability
by upgrading an affected device to a crafted version of firmware and execute
arbitrary code on the affected device with full privileges.
Currently there are no workarounds to address these vulnerabilities. For a complete
list of Cisco security advisories released in May, visit the Cisco Security Advisories
page by clicking here. Cisco also provides free software updates that address critical
and high-severity vulnerabilities listed in their security advisory.
Fortinet
Fortinet’s May vulnerability advisory addressed two “High, four “Medium,” and three
“Low” rated vulnerabilities across different Fortinet products, including FortiADC,
FortiNAC, FortiOS and FortiProxy. Additional information on the “High” rated
vulnerabilities for this month are as follows:
• FG-IR-22-297(CVE-2023-27999) has a CVSSv3 score of 7.6. This is an improper
neutralization of special elements used in an OS command vulnerability [CWE-78] in
FortiADC that could allow an authenticated threat actor to execute unauthorized
commands through specifically crafted arguments to existing commands.
• FG-IR-22-475 (CVE-2023-22640) has a CVSSv3 score of 7.1. This is an out-of-
bounds write vulnerability [CWE-787] in sslvpnd of FortiOS and FortiProxy that could
allow an authenticated threat actor to achieve arbitrary code execution through
specifically crafted requests.
It is recommended users follow CISA’s guidance, which encourages users and
administrators to review Fortinet’s May 2023 Vulnerability Advisories page for
additional information, and apply all recommended updates and patches
immediately. For a complete list of vulnerabilities addressed in May, click here to
view FortiGuard Labs’ Vulnerability Advisories page.
VMWare
VMWare released three security advisories; one rated “Important” (VMSA-2023-
0009) and two rated “Moderate”(VMSA-2023-0010, VMSA-2023-0011). If successful,
a threat actor could exploit these vulnerabilities and take control of a compromised
device or system. Additional information is as follows:
• VMSA-2023-0009 - This security advisory has a maximum CVSSv3 score of 8.8 and
impacts VMware Aria Operations (formerly vRealize Operations). This update
addresses multiple Local Privilege Escalations and a Deserialization issue (CVE-
2023-20877, CVE-2023-20878, CVE-2023-20879, CVE-2023-20880).
• VMSA-2023-0010 - This security advisory has a maximum CVSSv3 score of 4.3 and
impacts NSX-T. This update addresses a cross-site scripting vulnerability (CVE-2023-
20868).
• VMSA-2023-0011 - This security advisory has a maximum CVSSv3 score of 6.1 and
impacts VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM),
and VMware Cloud Foundation (Cloud Foundation). This update addresses an
Insecure Redirect Vulnerability (CVE-2023-20884).
For a complete list of VMWare’s security advisories, click here. It is recommended
users follow VMWare’s guidance for each, and immediately apply patches listed in
the 'Fixed Version' column of the 'Response Matrix' that can be accessed by clicking
directly on the security advisory.
References
Android Security Bulletins
https://source.android.com/security/bulletin
Android’s May security update is rolling out now to Google Pixel phones
https://www.androidpolice.com/android-may-2023-security-google-pixel/
Android Security Bulletin—May 2023
https://source.android.com/docs/security/bulletin/2023-05-01
Apple Security Updates
https://support.apple.com/en-us/HT201222
CISA Adds Three Known Exploited Vulnerabilities to Catalog
https://www.cisa.gov/news-events/alerts/2023/05/22/cisa-adds-three-known-
exploited-vulnerabilities-catalog
Cisco phone adapters vulnerable to RCE attacks, no fix available
https://www.bleepingcomputer.com/news/security/cisco-phone-adapters-vulnerable-
to-rce-attacks-no-fix-available/
Cisco Security Advisories
https://tools.cisco.com/security/center/publicationListing.x
Cisco Security Advisories
https://sec.cloudapps.cisco.com/security/center/publicationListing.x
FortiGuard Labs PSIRT Advisories
https://www.fortiguard.com/psirt
FortiGuard Labs May 2023 Vulnerability Advisories
https://www.fortiguard.com/psirt-monthly-advisory/may-2023-vulnerability-
advisories
Google Chrome Releases: Stable Channel Update for Desktop
https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-
desktop_10.html
Microsoft May 2023 Patch Tuesday
https://isc.sans.edu/diary/rss/29826
Microsoft May 2023 Patch Tuesday fixes 3 zero-days, 38 flaws
https://www.bleepingcomputer.com/news/microsoft/microsoft-may-2023-patch-
tuesday-fixes-3-zero-days-38-flaws/
Microsoft's May Patch Tuesday Fixes 38 Flaws, Including 2 Exploited Zero-Day Bugs
https://thehackernews.com/2023/05/microsofts-may-patch-tuesday-fixes-38.html
Microsoft Security Response Center May 2023
https://msrc.microsoft.com/blog/2023/05/
Microsoft Security Update Guide
https://msrc.microsoft.com/update-guide
Microsoft's Security Response Center (May 2023)
https://msrc.microsoft.com/blog/2023/05/
Microsoft Patch Tuesday by Morphus Labs
https://patchtuesdaydashboard.com/
Microsoft Patch Tuesday, May 2023 Edition
https://krebsonsecurity.com/2023/05/microsoft-patch-tuesday-may-2023-edition/
MOVEit Transfer Critical Vulnerability (May 2023) (CVE-2023-34362)
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-
31May2023
Mozilla Foundation Security Advisories
https://www.mozilla.org/en-US/security/advisories/
New Android updates fix kernel bug exploited in spyware attacks
https://www.bleepingcomputer.com/news/security/new-android-updates-fix-kernel-
bug-exploited-in-spyware-attacks/
SANS Microsoft May 2023 Patch Tuesday
https://isc.sans.edu/diary/Microsoft+May+2023+Patch+Tuesday/29826/
SAP Security Patch Day – May 2023
https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10
SAP Security Notes
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
VMware Security Advisories
https://www.vmware.com/security/advisories.html
Fortuna Cysec Named to CRN’s 2025 Security 100 List
Fortuna Cysec a global cybersecurity company, today announced that CRN®, a brand of The Channel Company, has recognized Fortuna Cysec on its Managed Service Provider (MSP) 500 list in the Security 100 category for 2025.
Atlanta, GA, February 13th, 2025 – Fortuna Cysec a global cybersecurity company, today announced that CRN®, a brand of The Channel Company, has recognized Fortuna Cysec on its Managed Service Provider (MSP) 500 list in the Security 100 category for 2025.
This honor acknowledges Fortuna Cysec’s commitment to providing innovative, comprehensive cybersecurity solutions that empower Healthcare, Finance, Insurance, Manufacturing, other regulated industries, Non-Profits, Local Governments, Managed Service Providers, and organizations looking to enhance their security posture to safeguard their critical data and ensure regulatory compliance.
CRN’s annual MSP 500 list is a comprehensive guide to the leading managed service providers in North America, recognizing companies that drive growth and innovation while delivering exceptional managed services. Security 100 category, spotlighting service providers with cloud-based security services expertise.
Fortuna Cysec’s flagship solution, thefense, provides a modular ecosystem integrating Advanced Threat Intelligence, Real-time Monitoring, and Managed Detection and Response (MDR) to fortify security, ensure compliance, and drive business resilience.
“Fortuna Cysec’s inclusion on the 2025 MSP 500 list is a testament to our relentless commitment to innovation and operational excellence,” said Navin Balakrishnaraja, CEO at Fortuna Cysec. “Our thefense platform transforms how organizations manage cybersecurity—reducing complexity, enhancing compliance, and delivering measurable cost savings. We empower our customers to focus on their core business while we safeguard their critical assets against evolving cyber threats.”
About Fortuna Cysec
Fortuna Cysec delivers an intelligent security ecosystem that integrates AI-driven threat defense, risk mitigation, and compliance to safeguard assets, ensure resilience, and drive growth across diverse environments. For more information, visit www.fortunacysec.com
About The Channel Company
The Channel Company (TCC) is the global leader in channel growth for the world’s top technology brands. We accelerate success across strategic channels for tech vendors, solution providers, and end users with premier media brands, integrated marketing and event services, strategic consulting, and exclusive market and audience insights. TCC is a portfolio company of investment funds managed by EagleTree Capital, a New York City-based private equity firm. For more information, visit www.thechannelco.com
The Evolution of SIEM: From Perimeter Defense to Unified Threat Prediction, Prevention, and Protection
Over the past 15 years, I have watched how Security Information and Event Management (SIEM) solutions have transformed from a promising concept—the single pane of glass for IT visibility—to a technology that faced limitations in a traditional, hardware-based security era. With the advent of cloud computing, IoT, remote work, and a shift toward application-based security, the need for a modern, unified platform has become critical. This research paper explores the evolution of SIEM, the key technological shifts that have reshaped the security landscape, and how Fortuna Cysec’s the Fense platform represents the ultimate evolution of SIEM by integrating XDR, SIEM, SOAR, and compliance into a single managed solution.
Executive Summary
Over the past 15 years, I have watched how Security Information and Event Management (SIEM) solutions have transformed from a promising concept—the single pane of glass for IT visibility—to a technology that faced limitations in a traditional, hardware-based security era. With the advent of cloud computing, IoT, remote work, and a shift toward application-based security, the need for a modern, unified platform has become critical. This research paper explores the evolution of SIEM, the key technological shifts that have reshaped the security landscape, and how Fortuna Cysec’s thefense platform represents the ultimate evolution of SIEM by integrating XDR, SIEM, SOAR, and compliance into a single managed solution.
Introduction
SIEM emerged as a transformative technology designed to offer a single pane of glass—centralized visibility across an organization’s IT environment. Back then, the typical enterprise network was bounded by a firewall and gate way devices, and SIEM was seen as a way to correlate logs and provide actionable intelligence. However, the promise of SIEM was largely unmet due to the static nature of network perimeters and the limitations of early technologies.
Today, the cybersecurity landscape is far more complex. Distributed networks, cloud-based workloads, IoT devices, and a shift toward zero trust architectures have dramatically altered how organizations must approach security. Modern solutions must not only detect and alert but also predict, prevent, and rapidly respond to threats across a heterogeneous IT environment. Fortuna Cysec’s thefense platform is engineered to meet these demands, providing a unified solution that bridges the gap between traditional SIEM and the advanced capabilities required in today’s digital world.
The Early Promise of SIEM and the Single Pane of Glass
The Origins of SIEM
In the early 2000s, organizations recognized the need to centralize security monitoring to reduce complexity. SIEM systems were introduced as a means to consolidate log data from disparate security tools into a single dashboard, aiming to provide:
- Centralized Visibility
A single view to monitor events across the network. - Log Management
Collection, normalization, and analysis of logs from various sources. - Incident Correlation
The ability to correlate events and trigger alerts when anomalies were detected.
At this time, most organizations relied on a perimeter-based defense, with firewalls and intrusion detection systems (IDS/IPS) safeguarding a well-defined network boundary.
Early Challenges
Despite the promise of a unified view, early SIEM implementations faced significant challenges:
- Data Overload and False Positives
The massive volume of logs often resulted in alert fatigue, making it difficult to distinguish between true threats and noise. - Manual Correlation
Many SIEM systems required extensive manual intervention to correlate data, leading to delays in threat detection and response. - High Operational Costs
The costs associated with implementing and maintaining SIEM solutions were high, particularly for organizations with sprawling IT infrastructures.
These limitations caused many organizations to scale back on SIEM investments during the subsequent decade.
Technological Shifts and the Changing Threat Landscape (2015–Present)
The Rise of Cloud and Distributed Networks
Over the last decade, a series of key shifts have fundamentally transformed IT environments:
- Cloud Adoption
The widespread move to cloud-based services shattered the traditional network perimeter. Enterprises began to operate in multi-cloud and hybrid environments, necessitating new approaches to security. - Remote Work and COVID-19
The COVID-19 pandemic accelerated the shift to remote work, further dispersing the traditional network and increasing the attack surface. - Internet of Things (IoT)
The proliferation of IoT devices introduced many unsecured endpoints that were not part of the traditional IT inventory.
The Emergence of Zero Trust and Advanced Endpoint Solutions
In response to these changes:
- Zero Trust Architectures have become the gold standard, requiring continuous verification of users and devices regardless of location.
- Endpoint Detection and Response (EDR) and Managed Detection and Response (MDR) solutions emerged to protect against increasingly sophisticated threats targeting endpoints.
- Extended Detection and Response (XDR) platforms integrated multiple security functions to provide a more cohesive threat detection and response capability.
The Return of the Single Pane of Glass
The need for comprehensive visibility has reemerged, but today’s requirements extend far beyond what early SIEM tools offered:
- Integration of On-Prem and Cloud Assets
Modern organizations demand 100% visibility into both on-premises and cloud-based assets. - Automated Correlation and Rapid Response
Advanced analytics and machine learning now enable rapid correlation of security events, reducing Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) by up to 75%. - Cost Efficiency
New platforms aim to reduce the cost of security operations by consolidating disparate tools and vendor sprawl, often achieving significant cost reductions in both tool and operational expenses.
Real-World Case Studies: Lessons in the Evolution of Security
Case Study: The Capital One Data Breach (2019)
In 2019, Capital One suffered one of the largest data breaches in U.S. financial history due to a misconfigured firewall in their cloud environment. The attacker exploited a vulnerability that traditional SIEM tools, with their reliance on perimeter defenses, were ill-equipped to detect quickly.
How thefense Could Have Helped
- Unified Visibility
With complete visibility across on-prem and cloud assets, thefense could have identified the misconfiguration more rapidly. - Predictive Analytics
AI-driven threat intelligence would have flagged unusual access patterns, triggering an automated response before data exfiltration occurred. - Integrated Response
The combined SIEM, XDR, and SOAR capabilities would have enabled a faster, more coordinated incident response, significantly reducing both MTTD and MTTR.
Case Study: The Robinhood Data Breach (2022)
The Robinhood breach, driven by compromised vendor credentials and exploited access controls, highlighted the vulnerabilities in remote work and distributed network architectures.
How thefense Could Have Helped
- Enhanced Access Control
Continuous monitoring and advanced identity and access management would have prevented unauthorized access. - Automated Alert Correlation
The platform’s ability to correlate alerts across distributed endpoints would have reduced alert fatigue and improved threat prioritization. - Cost Reduction
By unifying security tools into one managed platform, organizations could have reduced both operational and tool-related costs, making comprehensive security more economically viable.
Fortuna Cysec’s thefense: The Ultimate Unified Security Platform
Key Features and Benefits
Fortuna Cysec’s thefense is designed to address the shortcomings of legacy SIEM systems by integrating next-generation capabilities:
- 100% Visibility
Real-time monitoring of both on-premises and cloud assets. - Advanced Detection & Rapid Response
Achieves up to 75% reduction in MTTD & MTTR, ensuring 95% accurate threat detection. - Cost Efficiency
Reduces security tool costs by 50%, operational expenses by 72%, and data retention costs by 55%. - Unified Management
One managed platform that consolidates XDR, SIEM, SOAR, and compliance, eliminating tool and vendor sprawl. - Automation and Standardization
Enhances alert correlation and prioritization, streamlines reporting, and improves operational efficiency. - Predictive Security
Uses AI/ML to predict attack chains, enabling proactive threat prevention. - Enhanced Compliance
Simplifies adherence to regulatory frameworks such as NIST, HIPAA, and CIS Controls, leading to lower cyber insurance premiums.
Technical Deep Dive
- Integration of SIEM and XDR
Thefense’s architecture leverages both SIEM and XDR to provide a comprehensive view of security events. SIEM aggregates and analyzes log data, while XDR extends detection capabilities across endpoints, networks, and cloud environments. - Security Orchestration, Automation, and Response (SOAR)
By automating repetitive tasks and correlating alerts from multiple sources, thefense reduces the burden on security teams, improves response times, and minimizes human error. - AI-Driven Threat Intelligence
Advanced machine learning algorithms analyze vast amounts of data to identify anomalies, predict attack vectors, and provide actionable insights, ensuring a proactive rather than reactive approach to security. - Compliance and Reporting
Thefense includes built-in compliance modules that standardize processes and generate automated reports, reducing manual efforts and helping organizations meet regulatory requirements with ease.
Conclusion
The evolution of SIEM over the past 15 years—from a promising but limited concept to a comprehensive, unified security platform—is a testament to the rapidly changing cybersecurity landscape. Legacy SIEM systems struggled to keep pace with distributed networks, cloud environments, and the proliferation of IoT devices. Today, organizations require a platform that not only detects and alerts but also predicts and prevents threats in real time.
Fortuna Cysec’s thefense embodies this evolution. By integrating SIEM, XDR,SOAR, and compliance into a single, unified solution, thefense delivers unparalleled visibility, efficiency, and protection. For organizations looking to reduce operational costs, streamline their security operations, and enhance their overall cybersecurity posture, thefense represents the future of security—a future where predictive, automated defense mechanisms safeguard every asset, both on-premises and in the cloud.
As cyber threats continue to evolve, adopting a unified security platform is no longer a luxury but a necessity. Embrace the future of cybersecurity with thefense, and transform your security operations into a resilient, cost-effective, and comprehensive defense.
References
- Deloitte. (2023). Global Cybersecurity Trends Report. Retrieved from Deloitte Insights.
- Gartner. (2022). Magic Quadrant for SIEM. Retrieved from Gartner.
- Forrester. (2021). The Evolution of SIEM to XDR. Retrieved from Forrester Research.
- FFIEC. (2020). Cybersecurity Assessment Tool. Retrieved from FFIEC.gov.
- Reuters. (2019). Capital One Data Breach Overview. Retrieved from Reuters.
- Additional industry data and case studies sourced from cybersecurity publications and white papers.
NOC vs. SOC: Understanding the Key Differences in Cybersecurity Operations
In today's evolving threat landscape, organizations must ensure both network performance and cybersecurity resilience. This is where the Network Operations Center (NOC) and the Security Operations Center (SOC) come into play. While both play critical roles in IT infrastructure, they serve distinct purposes. Understanding the difference between NOC and SOC is essential for organizations looking to enhance their managed security services and cyber threat response.
In today's evolving threat landscape, organizations must ensure both network performance and cybersecurity resilience. This is where the Network Operations Center (NOC) and the Security Operations Center (SOC) come into play. While both play critical roles in IT infrastructure, they serve distinct purposes. Understanding the difference between NOC and SOC is essential for organizations looking to enhance their managed security services and cyber threat response.
What is a NOC? (Network Operations Center)
A NOC (Network Operations Center) is responsible for maintaining an organization’s network health, uptime, and performance. It ensures continuous monitoring, troubleshooting, and maintenance of IT systems, reducing downtime and improving efficiency.
Key Functions of a NOC
- Network Monitoring & Performance Management
Ensures optimal operation of IT infrastructure, including routers, firewalls, and cloud systems. - Incident Detection & Response
Identifies system failures, latency issues, and network bottlenecks. - Helpdesk & Support
Provides IT support and troubleshooting services. - Patch & Update Management
Ensures all systems are up to date with security patches and software updates. - Backup & Disaster Recovery
Maintains backup systems to prevent data loss and enable swift recovery.
A well-managed NOC minimizes disruptions by proactively detecting and resolving network issues before they impact business operations.
What is a SOC? (Security Operations Center)
A SOC (Security Operations Center) is dedicated to cybersecurity threat detection, response, and prevention. It continuously monitors an organization’s IT environment for potential security threats, vulnerabilities, and incidents.
Key Functions of a SOC
- Threat Detection & Intelligence
Uses Network Detection and Response (NDR), Endpoint Detection and Response (EDR), and Intrusion Prevention Systems (IPS) to identify cyber threats. - Incident Response & Remediation
Investigates security alerts, performs forensic analysis, and mitigates attacks. - Security Risk Assessments & Compliance
Ensures alignment with NIST, HIPAA, and CIS Controls to maintain regulatory compliance. - Vulnerability Management & Penetration Testing
Identifies and mitigates security gaps through proactive testing. - SIEM (Security Information and Event Management) & Log Management
Analyzes logs and security events for early threat detection. - Red & Blue Team Exercises
Simulates cyberattacks to test security defenses and response effectiveness.
A SOC is a critical component in protecting businesses from cyberattacks, reducing dwell time, and ensuring incident containment.
NOC vs. SOC: Key Differences
Why Businesses Need Both NOC and SOC Services
Organizations cannot afford to choose between network performance and cybersecurity—both are critical. While a NOC focuses on maintaining IT health, a SOC ensures protection against cyber threats. Investing in Managed Detection and Response (MDR), SIEM solutions, and vCISO services provides a holistic approach to security and operational efficiency.
How Our Managed Security Services Can Help
We offer comprehensive NOC and SOC solutions to safeguard your organization from both network failures and cyber threats. Our services include:
- Managed SIEM & Threat Intelligence
Real-time monitoring and advanced analytics for threat detection. - Incident Response & Emergency Breach Management
Rapid containment and remediation of security incidents. - Cloud Security & Identity Access Management (IAM)
Protecting hybrid and cloud environments from unauthorized access. - Penetration Testing & Risk Assessments
Identifying vulnerabilities before attackers do. - NOC Monitoring & Helpdesk Services
Ensuring IT infrastructure reliability and uptime.
Final Thoughts
Both NOC and SOC play crucial roles in modern cybersecurity strategy. While a NOC ensures seamless IT performance, a SOC protects against evolving cyber threats. Partnering with an expert cybersecurity provider enables businesses to achieve both operational efficiency and security resilience.
Looking to enhance your network operations and security posture? Contact us today for a free consultation and learn how our NOC and SOC services can help protect your business!
The Difference Between a Cybersecurity Audit and Assessment: What Your Business Needs & When
In today's rapidly evolving threat landscape, organizations must take a proactive approach to cybersecurity. However, terms like "audit" and "assessment" are often used interchangeably, creating confusion about what each entails and when they should be conducted. At Fortuna Cysec, we provide both cybersecurity audits and risk assessments to help businesses stay compliant, secure, and resilient. Understanding the difference is critical to making the right choice for your organization.
In today's rapidly evolving threat landscape, organizations must take a proactive approach to cybersecurity. However, terms like "audit" and "assessment" are often used interchangeably, creating confusion about what each entails and when they should be conducted. At Fortuna Cysec, we provide both cybersecurity audits and risk assessments to help businesses stay compliant, secure, and resilient. Understanding the difference is critical to making the right choice for your organization.
What is a Cybersecurity Audit?
A cybersecurity audit is a formal evaluation of an organization’s security posture, ensuring compliance with industry regulations and standards such as NIST, HIPAA, CIS Controls, and PCI DSS. Audits are typically structured, in-depth, and focus on whether security policies and controls meet the required benchmarks.
Key Components of a Cybersecurity Audit
- Regulatory Compliance Verification
Ensures adherence to standards like NIST, HIPAA, CIS Controls. - Review of Security Policies & Procedures
Evaluates security controls, data protection policies, and access management practices. - Incident Response & Remediation Evaluation
Analyzes existing incident response, breach management, and forensics processes. - Network & System Security Audits
Examines the effectiveness of IPS, NDR, SIEM, and Managed EDR solutions. - Data Protection & Privacy Audits
Ensures proper Data Loss Prevention (DLP) and Identity & Access Management (IAM) controls.
Who Needs a Cybersecurity Audit?
- Organizations in regulated industries (finance, healthcare, government) that must comply with industry standards.
- Businesses undergoing mergers & acquisitions that need to assess security risks.
- Companies dealing with third-party vendors that must ensure security compliance across their supply chain.
What is a Cybersecurity Assessment?
A cybersecurity assessment is a proactive evaluation that identifies security gaps, vulnerabilities, and risks within an organization’s infrastructure. Unlike audits, assessments are more flexible and focus on improving security posture rather than meeting compliance standards.
Key Components of a Cybersecurity Assessment
- Threat Detection & Risk Analysis
Uses Threat Intelligence, Proactive Hunting, and Vulnerability Management to identify weaknesses. - Penetration Testing
Simulates cyberattacks through internal, external, application, and cloud penetration testing to uncover security flaws. - Red & Blue Team Exercises
Tests an organization’s defense capabilities through simulated adversary attacks. - Security Risk Assessments
Evaluates overall security posture and aligns with NIST, HIPAA, and CIS Controls. - Remediation & Incident Management Plans
Provides strategies to mitigate, respond to, and recover from security incidents.
Who Needs a Cybersecurity Assessment?
- Businesses looking to strengthen their security posture before an audit or regulatory inspection.
- Organizations implementing new technologies (cloud adoption, remote work, IoT) that require security validation.
- Companies with sensitive data that need proactive risk management and forensics capabilities.
Audit vs. Assessment: Which One Do You Need?
How Fortuna Cysec Can Help
At Fortuna Cysec, we offer comprehensive cybersecurity audits and risk assessments tailored to your industry and security needs. Our expert team provides:
- Managed SIEM & Threat Intelligence for real-time threat detection.
- Penetration Testing & Vulnerability Management to identify and mitigate risks.
- vCISO & Security Consulting to guide your organization’s security strategy.
- Incident Response & Emergency Breach Management for rapid containment and recovery.
Take the Next Step Towards Cybersecurity Resilience
Don't wait for a security incident or regulatory penalty to take action. Whether you need an audit to ensure compliance or an assessment to strengthen your defenses, Fortuna Cysec has you covered.
📞 Contact us today for a free consultation and learn how we can protect your business from evolving cyberthreats!
Fortuna Cysec helps Extended Care Facility increase its security and privacy posture
A Lifespan community in South East US with more than 800 residents in its various facilities which include Independent Living (IL), Assisted Living (AL), Skilled Nursing home (SNF) and Memory Care.
Heading 1
Heading 2
Heading 3
Heading 4
Heading 5
Heading 6
Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.
Block quote
Ordered list
- Item 1
- Item 2
- Item 3
Unordered list
- Item A
- Item B
- Item C
Bold text
Emphasis
Superscript
Subscript
Fortuna Cysec helps Healthcare Organization protect sensitive patient health information through robust cybersecurity measures
Working with the acute care facility’s IT security team Fortuna Cysec was able to assess the implemented solutions, find gaps in the implementations, bring best practices and discuss with the team.
Heading 1
Heading 2
Heading 3
Heading 4
Heading 5
Heading 6
Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.
Block quote
Ordered list
- Item 1
- Item 2
- Item 3
Unordered list
- Item A
- Item B
- Item C
Bold text
Emphasis
Superscript
Subscript
Invite the visitor to try your product or service
