Steven Lim

🌐 Understanding OSI Layers & Cyber Attacks The OSI model isn’t just theory—it’s the foundation of how data moves across networks. But with every layer, there’s also a set of vulnerabilities that attackers try to exploit. Here’s a quick breakdown: 🔹 Physical Layer – The backbone of connectivity (Ethernet, DSL, Fiber). Risks include hardware tampering and signal interference that can disrupt communication. 🔹 Data Link Layer – Ensures reliable transfer within a LAN (Ethernet/Wi-Fi). Attackers use MAC spoofing or switch flooding to mislead devices or overload switches. 🔹 Network Layer – Handles packet routing with IP and ICMP. Attacks like IP spoofing or route manipulation can redirect traffic and break routing paths. 🔹 Transport Layer – Manages end-to-end delivery (TCP/UDP). Common threats are SYN floods and UDP floods, aiming to exhaust resources and slow down services. 🔹 Session Layer – Maintains sessions between devices. Vulnerable to session hijacking, replay attacks, and MITM, which steal or manipulate active sessions. 🔹 Presentation Layer – Focused on data encryption and translation (SSL/TLS). Weaknesses include SSL stripping and encoding exploits, reducing data protection. 🔹 Application Layer – Where users interact (HTTP, FTP, SMTP). The most exploited layer—SQL injection, XSS, phishing—all happen here. #Saleem #ITJobs #JobsInLahore #JobsInIslamabad #JobsInDubai #JobsInKSA #ITCareers #LahoreJobs #IslamabadJobs #DubaiJobs #SaudiJobs #TechJobs #NetworkingJobs #CyberSecurityJobs #CloudJobs #SoftwareJobs #DevOpsJobs #SystemAdminJobs #DatabaseJobs #NetworkingCareers #DubaiTech #KSAJobs #MiddleEastJobs #ITSupportJobs #HelpdeskJobs #RemoteITJobs #JobsPakistan #PakistaniJobs #GulfJobs #ITHiring #NowHiring #ITProfessionals #NetworkEngineer #CyberSecurity #CloudComputing #SystemAdministrator #FortinetJobs #CiscoJobs #MicrosoftJobs #AWSJobs #AzureJobs #LinuxJobs #RedHatJobs #OracleJobs #VMwareJobs #ITFreshers #InternshipIT #EntryLevelJobs #SeniorITJobs #TechCareers #FutureOfWork #JobHunt #JobSeeker #HiringAlert #TechHiring #ISJobs #PakTech #PakistanIT #IslamabadTech #LahoreTech #PeshawarJobs #KarachiJobs #GulfTech #DubaiHiring #KSAHiring #QatarJobs #UAEJobs #RemoteJobs #WorkFromHomeIT #JobMarket #CareerGrowth #FreshGraduatesJobs #NetworkingPakistan #CyberSecPakistan #CloudPakistan #TechCommunity #SystemEngineerJobs #ITOperations #InfoSecJobs #ITILJobs #InfrastructureJobs #DigitalTransformation #TechnologyCareers #JobSearch #TechOpportunities #PakistanJobs2025 #GulfHiring2025 #JobOpening #RecruitmentIT #HRHiringIT #HiringNow #TrendingJobs #CareerDevelopment #NewJobAlert #LahoreHiring #IslamabadHiring #DubaiTechJobs #KSAITJobs #PakistanTechJobs #MiddleEastIT #SaleemNetworking #NetworkingWithSaleem

107

1 Comment

Did the acquisition target for Palo Alto Networks’ identity market entry absolutely have to be CyberArk? No, but CyberArk was the best option they had among scaled identity companies. There just aren’t that many viable targets with the right financial profile and product suite. CyberArk is a great company. I’m surprised they got it. CyberArk has more pieces of a comprehensive workforce identity offering than most other scaled alternatives. They have PAM, SSO (albeit third or fifth in the market), and they just acquired IGA with Zilla, an early-stage company. Most of the other targets Palo Alto Networks could have acquired would have required add-on acquisitions to round out the full workforce identity offering. Okta now has SSO/IGA/PAM but likely wasn't willing to sell at their current market cap of ~$17 billion. That's roughly half its all-time high, and now below CyberArk (even before the acquisition report broke). Todd McKinnon is still a relatively young CEO who looks committed for the long haul. Ping Identity could have made sense, but their product portfolio doesn’t have well-established IGA or PAM capabilities, even with ForgeRock. Palo Alto Networks likely didn’t want to be in the customer identity business, either. They do have a directory product, which is nice...but again, directory is not the way the identity market will be won. SailPoint just went public again and has had a successful return. They’re primarily an IGA company that has acquired its way into PAM, but is nowhere near the depth of CyberArk there. They don’t do SSO yet, either. Great company, not as great of a strategic fit for Palo Alto Networks. There is a long tail of smaller companies in the identity market with varying shapes and sizes of a product portfolio. Some have eight and nine figures of revenue: – Saviynt – RSA Security – SecureAuth – 1Password – Keeper – Veza – StrongDM – ...dozens more Palo Alto Networks was playing an entirely different game here. The plan wasn’t to do value acquisitions of different market leaders in multiple identity segments and slowly grow an identity business. The quest to win against both hyperscalers and large competitors like CrowdStrike needed a transformative deal.

661

49 Comments

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77

Insider Threat Matrix: Practical Prevention and Detection! Insiders often have access to systems, data, and processes, making detecting and preventing malicious activities harder. Handling insider threats requires a well-thought-out incident response strategy to quickly identify, contain, and mitigate the damage. The Insider Threat Maturity Matrix categorizes and detects activities that could indicate malicious or negligent insider behavior. • Suspicious Intranet Activity • Activity Outside of Normal Scope • Creation of New Accounts • Downloads from Email/IM/Chat • Screenshots • Downloading from Internal File Share • Uploads to 3rd Party File Share • Use of Removable Storage Devices • External Email with Attachments • Destruction of Physical Device The matrix also addresses the proactive measures and business impact by identifying data exposure, misappropriations, and malicious system changes, ensuring a swift response to limit damage. Source: https://lnkd.in/gdQiGxke Advanced data analysis techniques are key in identifying anomalies, detecting suspicious behavior, and correlating patterns that indicate potential insider threats. Discover over 10+ essential data analysis techniques for effective threat hunting in my "Cyber Threat Hunt 101" YouTube series, explained simply: https://lnkd.in/gkVB6B2j Please share and subscribe if you enjoy the content! #cybersecurity #threathunting #threatdetection #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #DataAnalysis #IncidentResponse

136

3 Comments

The Palo Alto Networks-CyberArk megadeal risks overshadowing one of the most interesting dynamics in identity: the convergence of historically separate disciplines into a holistic platform: https://lnkd.in/eNxzAJfT Access management, privileged access management, and identity governance and administration emerged in the market as standalone products, developed in siloes because of fundamentally different control points, user personas and operational requirements. But these markets are now merging to reduce customer complexity and increase signal-sharing across the identity stack, said Gautham Mudra, senior director analyst at Gartner. "We noticed those siloed markets creating inefficiency in really protecting those identities, because you need to manage different type of policies for governance of those identities and for securing the identities and for the authentication of those identities, and so on," CyberArk Chief Solutions Officer Gil Rapaport told Information Security Media Group (ISMG). "The cracks between those silos - this is exactly where the new attack factors started to develop." Also featuring commentary and analysis from: Okta President and COO Eric Kelleher SailPoint co-founder and CEO Mark McClain #ISMGnews

32

Signatures, ASM queries, and a PCAP are now available to VulnCheck Initial Access Intelligence customers for #Oracle E-Business Suite CVE-2025-61882, which was targeted by #Cl0p in a widespread #extortion campaign. Our #vulnerability research team was able to reproduce the attack and observe expected IOCs. Defenders should note that the #exploit has been available to other threat actors for several days, and exploitation is likely to increase. https://lnkd.in/e9cZpGDB

33

🔴🔵🟢 Cybersecurity Tip: Beware of lookalike URLs - The Homoglyph Attack Have you ever clicked on a link that looked perfectly legit - only to land on a malicious site? You might’ve been a victim of a Homoglyph attack. 👀 What is it? Homoglyph attacks exploit visually similar characters in URLs (like using “𝖌oogle.com” instead of “google.com”). These characters may come from different alphabets (Latin, Cyrillic, Greek) but appear nearly identical to the human eye. 📌 Real-World example: A phishing email might link to microsоft.com (with a Cyrillic “о”) instead of microsoft.com. The site looks familiar, but it’s designed to steal credentials or deliver malware. 🧠 How to Spot It: 1. Always hover over links before clicking - check for odd characters or spelling. 2. Use (secure) browser extensions or password managers that verify known domains. 3. Be cautious with shortened URLs - preview them first. 4. Enable URL highlighting in browsers to focus on the domain name. 4. Right click on the URL, copy and then put it in the in-private/incognito browsing mode and carefully read the URL before moving forward. 🛡️ What End Users should do: 1. Report suspicious links to IT/security team immediately. 2. Bookmark trusted sites and access them directly. 3. Enable multi-factor authentication (MFA) to reduce impact even if credentials are stolen. 4. Educate yourself and your team - remember awareness is the first line of defense. 🔄 Future-Proofing Tip: Organizations should implement domain monitoring to detect lookalike registrations and use email authentication protocols (DMARC, SPF, DKIM, etc.) to reduce spoofing risks. Cyber hygiene starts with the smallest habits. Let’s make the web safer - one click at a time. 💡 Dont forget to share & repost in your professional community. Remember "Sharing is Caring" 🙏 . Thank you Raghuveer Singh for sharing. #CyberSecurity #PhishingAwareness #HomoglyphAttack #Infosec #SecurityTraining #EDR #SIEM #SOAR #EmailSecurity #SecurityIncident #CloudSecurity

37

6 Comments