Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Guessing how many marbles are in a jar is either a fun carnival game (pick the average based on the wisdom of the crowd) or a math problem involving orb volume, cylinder volume and the estimated space between marbles. You can also just count the marbles. Unfortunately, when it comes to identifying the number of devices connected to your network, none of these approaches works – although quasi-manual counting remains all too common.

Given that active cyber warfare has broken out alongside Russia’s active invasion of Ukraine - from Russian wiper malware to Anonymous hacking Russian state TV - CISA’s recent “Shields Up” memo is a timely insight into some of the TTPs defenders of critical infrastructure should be keeping an eye out for. Let’s break down the four key areas outlined in the memo and examine ways they can be detected with network data.

Almost a year since the Colonial Pipeline ransomware attack on critical infrastructure occurred, the question still looms large: not whether such an incident could happen again, but when?

On Sunday, Feb. 13, the NFL’s San Francisco 49er organization issued a statement confirming they experienced a network security incident. Shortly after the incident, BlackByte ransomware gang listed the 49ers as one of their alleged victims. The 49ers franchise didn’t confirm if ransomware was involved, but it did state that only the corporate IT network was affected. As with all breaches, one commonality eventually appears: vulnerabilities.