Empowering You with the Region's Largest Pure-play Cybersecurity Expertise & Innovation. Your Partner in Confronting the Challenges of the Digital World. 800+ Professionals in Cybersecurity. Innovation Our Commitment. Strategic Partnerships Across the Globe. CONSULT Harness our expertise to fortify your digital defences and safeguard your valuable assets. Attack Surface Management Management of digital asset vulnerabilities to reduce cyber risks and improve cybersecurity posture. Advisory & Cyber Strategy Expert guidance on managing cyber risks and developing of cybersecurity strategies to protect digital assets. DESIGN & BUILD Create robust and resilient cybersecurity solutions tailored to your unique business needs. GRC Stay compliant with regulations, manage risk effectively, and maintain a strong security posture. Advanced Analytics Detect and respond to emerging threats quickly using advanced technology. Access & Identity Secure user identities, manage access controls, and prevent unauthorised entry to your digital assets. Infrastructure Security Fortify your network infrastructure against cyber threats, ensuring uninterrupted operations and data integrity. Data Protection Implement comprehensive measures to safeguard sensitive information and maintain regulatory compliance. Endpoint Security Protect your devices and networks from malicious attacks, ensuring data integrity and user privacy. OPERATE Ensure round-the-clock protection for your business. Advanced Security Operations Monitor and respond to threats with precision. End-to-end Security Management End-to-end security infrastructure management, from setup to maintenance and upgrades. Advanced Threat Detection & Response Use cutting-edge tech and skilled analysts to counter cyber threats swiftly. RESPOND Rapidly respond to cyber incidents, minimising damage and restoring normalcy. Digital Forensics & Incident Response Investigate and analyse digital evidence to identify the cause, extent, and impact of cyber incidents. Cyber Threat Hunting Identify and neutralise potential risks before they escalate. Pinnacle of Recognition: Ensign InfoSecurity's Multitude of Awards. Top 250 MSSPs List 2023 - Ranked 7th Worldwide. Cybersecurity – Managed Security Service Provider Award 2023 (Malaysia). SG Enable Enabling Mark 2023 (Silver). The Straits Times Singapore’s Best Employers 2023. SkillsFuture Employer Awards 2022 (Silver). The Cybersecurity Award 2022 – MNC (Vendor) Award. Top 250 MSSPs List 2022 - Ranked 6th Worldwide. SBR Technology Excellence Award 2022. Top 10 Managed Security Services Companies in APAC 2022. Channel Asia Innovation Awards 2021. Top 10 Managed Security Service Provider in APAC 2021.

Empower your cybersecurity with cutting-edge solutions. Empowering Digital Defence. Safeguard your critical assets and maintain a competitive edge in the digital landscape. At Ensign, we are committed to revolutionising the field of digital defence by continuously pushing the boundaries of innovation. Harnessing the power of cutting-edge AI technology, our advanced cyber analytics provide real-time insights and proactive measures against evolving threats. Additionally, our pioneering threat intelligence platforms empower organisations to anticipate and stay ahead of cyber threats. Helios. AI Technologies for Accurate and Efficient Cybersecurity. Helios enhances threat detection, reduces alert fatigue, and improves accuracy. It utilises patented AI technologies for advanced threat detection, including self-taught learning and domain communication analysis. Helios also offers high-fidelity alerts, scalability, and ease of deployment without the need for agents.C3S (Cyber Central Command System) Enhancing Cyber Defence Operations and Response with Comprehensive Situation Awareness and AI-driven Insights. Our goal is to proactively halt attacks during the preparation phase. With aggregated cyber and operational data, our C3S concept provides intuitive presentation of the overall situation, leveraging battle-tested experience and a proprietary Crisis Management Framework. The Helios AI/ML Suite supports decision-making with recommendations and actionable insights on threat patterns and adversary behaviours. Apollo. Empowering Advanced Threat Hunting with AI/ML Techniques and Cloud Computing. Traditional threat hunting is time-consuming and challenging. Apollo, our advanced Threat Hunting Platform, leverages cloud compute and anomaly detection on forensic logs to expedite the process. By analysing behaviours holistically and correlating relationships between entities, it enables continuous threat hunting and accelerates analysts' capability to identify points of interest. Our cloud-based multi-tenant system has already achieved significant milestones and is currently undergoing trials with a global MNC. Artemis. Faster Incident Response and Threat Hunting. During cyberattacks, organisations operate under extreme pressure and face regulatory deadlines. Artemis accelerates the process by processing forensic evidence at scale, providing answers within hours. It correlates against a comprehensive rule set, leveraging AI/ML algorithms for accuracy and zero human errors. It also gathers cyber intelligence to enhance response measures. With significant milestones achieved, Artemis revolutionises Threat hunting and Incident Response.

Helios​. Detect advanced threats with AI-Powered Cyber Analytics. Establishing a Multi-Layered Defence. Organisations constantly face an increasing need to transform their security operations for improved effciency and productivity. Along with this transformation come cyber challenges that must not be taken lightly. As the threat landscape continues to evolve, threat actors intensify deployments of advanced techniques to launch targeted, persistent attacks. Phishing and data breaches have existed for decades. Yet, they remain prevalent threats as attackers continuously evolve their techniques to evade traditional signature and rule-based systems. To help address these concerns, Helios can work in tandem with an organisation’s existing cyber systems to establish a multi-layered defence against such advanced and evolving cyber threats. Challenges Organisations Face. Inability to detect rapidly evolving cyberattacks through conventional methods. Growing vectors for attack of prevalent threats like phishing. Expensive investment in human capital to process increased alerts. Lack of skilled cybersecurity talent, leading to overlooking of critical alerts. Key Features. It is imperative that organisations recognise that the traditional rule-based and signature detection models will not be able to keep up with threat actors and the unknown. Using the resources and advanced tools that they have, adversaries will break through traditional defences sooner rather than later. However, with the complements of behavioural-based detection models, organisations can detect evolving and advanced threats faster. Benefits of Employing Ensign Helios. Detect evolving and previously unknown threats using AI-Powered Cyber Analytics backed by patented self-learning techniques. Comprehensive protection against advanced threats by supplementing existing cybersecurity solutions to detect threats conventional rule-based systems miss. Highly accurate detection correlated with expert tradecraft to greatly reduce false positives, which is then streamlined and prioritised. Compatible with on-prem and cloud infrastructures. Ensign adopts the MITRE ATT&CK Framework and MITRE Engage Framework to harmonise the taxonomy of observed threats, and the defensive engagement activities that exist in today’s landscape. As such, Ensign Helios currently offers organisations THREE suites of solutions with the following features that can solve top cybersecurity concerns. INITIAL ACCESS DETECTION SUITE. Detect when employee connects to a phishing site regardless of the source. Detect phishing sites employing top phishing techniques (e.g. homoglyphs, typosquatting) with >90% accuracy. Identify compromised IPs to minimise impact of breach. Fixed cost – pay the same to protect every employee. C2 DETECTION SUITE. Detect compromised devices that exhibit advanced evasive threat behaviour in the form of DGA C2 communications. Enable earlier detection of compromised devices exhibiting beaconing behaviour within an organisation's network. Identify compromised endpoints with >99% accuracy. EXFILTRATION DETECTION SUITE. Detect and prevent modern cyberattacks that bypass traditional Data Loss Prevention (DLP) controls, seeking to exfiltrate data for extortion, sale for exploitation. Automated profiling of entities to determine unique communication behaviour and identify anomalies, without the need for manual rules or user setup. Detect data exfiltration attempts with >99% accuracy, whether via Email or DNS. Where can Helios be deployed. Organisations can leverage on Ensign’s end-to-end cyber security expertise that provides proactive threat detection and quick response which are supported by contextualised and actionable insights. Helios can flexibly be deployed in the following areas. Helios in the Cloud. Helios on Prem. Managed Security Services powered by Helios. Useful Resources. Combatting DGA with Ensign’s DGA Detection Model. Data Exfiltration Through Emails: What Is It And How Do you Detect It? Helios: Detect Advanced Threats with AI-Powered Cyber Analytics.

Develop bespoke solutions against state-of-the-art threat actors. Tailored Solutions Against Advanced Threat Actors. In today's threat landscape, sophisticated threat actors, including state-sponsored and corporate espionage groups, possess the capabilities to exploit software vulnerabilities and execute large-scale attacks that can evade standard security measures. To outpace cybercriminals, organisations must leverage threat intelligence that offers enhanced visibility into sector-specific threats and early detection of imminent attacks. At Ensign, we provide bespoke solutions to help organisations stay ahead of evolving threats and protect their valuable assets. Unique challenges faced by organisations: Reactionary approach to threat detection Combat evolving threats with proactive defences, avoiding costly reactionary measures. Increasing need for highly bespoke solutions. Generic solutions often fail to meet sophisticated security needs. Lack localised threat intelligence. Relevant threat intelligence feeds tailored to specific markets are crucial for organisations. Overwhelmed by unactionable threat intelligence. Organisations face alert fatigue due to talent shortages and data overload. Data Science. Cutting-Edge Data Science for Enhanced Threat Detection. Leveraging proprietary detection models and patented algorithms, our Data Science capability enhances threat detection accuracy and speed. It enables machine learning with partially labelled data, reducing dependency on labelled data for model training. This improves the effectiveness of threat detection for our clients. Cyber Research. Advanced Cybersecurity Analysis and Research. Our experts utilise cutting-edge techniques to analyse malware, conduct threat research, and perform in-depth vulnerability assessments. With extensive databases and data sources, we provide actionable insights, automate attack contextualisation, and deliver comprehensive threat reports. We help organisations understand their weaknesses, defend against attacks, and enhance their cybersecurity posture. Engineering. Integrated Solutions Development for Enhanced Cybersecurity. Our Solutions Engineering team leverages our diverse capabilities to architect and develop tailor-made solutions based on client needs. With expertise in big data engineering and web development, we combine data science and engineering concepts to create robust processing platforms and customised applications for our clients.

Patented innovations for unique cybersecurity solutions. Innovating Unique Cybersecurity Solutions. Empower your business with tailored, innovative solutions that elevate your security posture to the next level. Explore our portfolio of pioneering cybersecurity patents, showcasing our unwavering dedication to staying ahead of the ever-evolving threat landscape. These patents exemplify our relentless pursuit of providing unparalleled protection for your invaluable digital assets. Self-Learning Algorithm. Automate threat detection with cutting-edge self-learning models. DGA. Detect Domain Generation Algorithms (DGAs) using advanced deep learning techniques.

Cloud Services. Fortify Your Cloud The growing shift to the Cloud has provided numerous advantages for businesses, such as improved productivity and remote accessibility. However, it has also exposed vulnerabilities that can be exploited by attackers. Challenges in Cloud technology include insecure APIs, compromised credentials, unsanctioned platform usage, data replication, and limited visibility. To protect your valuable digital assets, we offer a comprehensive suite of Cloud Security Services that utilise state-of-the-art technologies and industry best practices. What does Ensign offer? Cloud Security. Protecting your data with our robust Cloud Security solutions and expertise. We offer a comprehensive suite of Cloud Security services that cover the entire lifecycle, from initial concept to operational management and incident response. Ensign’s team of security experts designs and deploys multiple Cloud security components, ensuring secure integration and supporting clients' business operations. Ensign's executive advisors provide strategic guidance and develop a roadmap for Cloud initiatives that align with the organisation's business strategy. They also manage daily security operations, including threat monitoring and incident response, to ensure the ongoing safety and integrity of the cloud infrastructure. Cloud Workload Security Monitoring. Addressing challenges and enhancing security in the Cloud. The digital transformation era brings a proliferation of applications, APIs, and diverse delivery methods. Cloud adoption, whether private, public, or hybrid, poses challenges. Legacy security tools burden IT and security teams, while the complexity and volume of alerts hinder threat detection and response. Moving to the cloud creates an extended perimeter requiring constant vigilance against cyberattacks. Our solution offers continuous alert rule tuning, customised rules, data connectors, playbook automations, and proprietary threat detection models for enhanced security.

Detection Strengthening Your Defence Against Evolving Cyber Threats As organisations undergo digital transformation, cybersecurity becomes a crucial aspect of their resilience. The constant evolution of cyber threats and technologies increases the challenge and cost of staying ahead. Balancing protection and growth becomes a struggle. Our solution offers round-the-clock monitoring of your infrastructure, leveraging automation, proprietary threat intelligence, and patented models. Ensign's SOCs provide real-time monitoring and clear visibility of your data across on-premises and hybrid cloud environments, enhancing your security posture and enabling prompt detection and mitigation of security threats. What does Ensign offer? Ensign Security Operations Centres (EnSOCs) Advanced Managed Solutions for Enhanced Threat Detection and Response Ensign Managed Security Services offers advanced managed solutions through its ISO27001-certified Ensign Security Operations Centres (SOCs). These SOCs adhere to globally recognised security standards and best practices, with OSPAR attestation. Equipped with automation, proprietary threat intelligence, and patented threat models, Ensign SOCs streamline threat alert detection, investigation, and escalation, minimising time and resources required. With our next-generation SOCs, we proactively prevent and mitigate the impact of malicious threats on your business, protecting your data wherever it may be. Managed Detection and Response Safeguarding Against Sophisticated Attacks As malware and zero-day attacks grow in sophistication and prevalence, traditional intrusion prevention systems fall short when detecting these advanced threats. Our Managed Security service, in collaboration with experts and technology partners, offers clients advanced threat detection and response capabilities. Leveraging proactive threat hunting, incident response services, behavioural analytics, automation, and a team of experts, Ensign's Managed Detection and Response service effectively mitigates the impact of advanced threats targeting our customers' environments.

Executive Advisory Empowering Executives and Management to Protect Your Organisation Traditionally, cybersecurity has been delegated solely to the CISO and their team. Nevertheless, organisations are increasingly recognising the far-reaching consequences of cyberattacks on financial profitability, reputation, legal obligations, and public trust. As a result, it has become imperative for executives, board members, and management to actively engage in the cybersecurity posture of the company. By actively participating and taking ownership, they contribute to a comprehensive and resilient cybersecurity framework that protects the organisation from potential threats and ensures its long-term success. What does Ensign Offers? Advisory & Cyber Strategy Strategic Advisory and Consultancy Services for Proactive Cybersecurity At Ensign, we provide Advisory and Cyber Strategy consultancy services that empower your entire organisation, from leadership to security operations, with a proactive shift left mindset to combat emerging threats. Leveraging our extensive experience gained from numerous client engagements, we possess a profound understanding of sector-specific challenges and requirements. Our knowledgeable consultants will deliver a tailored strategy, roadmap, and implementation plan to enhance your cybersecurity posture, ensuring a fit-for-purpose approach that strengthens your organisation's resilience. Cyber Maturity Assessment Tailored Insights for Prioritising Risk Mitigation Each enterprise is unique, with varying priorities and levels of cybersecurity maturity. The key objective is for organisations to assess their cybersecurity posture, determine prioritised risks, and collaborate towards the common goal of mitigating those identified risks. Our Cyber Maturity Assessment provides tailored insights, enabling enterprises to understand their cybersecurity standing and focus efforts on addressing the most critical vulnerabilities, fostering a proactive and effective risk mitigation approach.

Identity Management Protecting Critical Data Privileged access is a prime target for cybercriminals due to the valuable and confidential information it grants access to, including customer identities, financial data, and personally identifiable information. Once breached, cybercriminals can exploit privileged accounts to navigate laterally or create sub-administrative accounts, extracting critical data. Common challenges in access and identity management include inadequate processes for removing employee accounts upon exit, granting administrative access to third-party vendors for convenience, limited granularity in privileged access control, and the rise of shadow IT as employees use personal devices outside corporate security policies. At Ensign, we provide top-notch Identity Management services to secure your digital identity. What does Ensign Offers? Identity Management Protect Data Integrity To protect critical data, organisations need to tackle common access and identity management challenges head-on through the adoption of robust Identity Management services. This entails establishing well-defined offboarding procedures, enforcing stringent controls for third-party vendor access, deploying role-based access control with data classification, and ensuring comprehensive IT security policies that encompass personal devices used for work. By fortifying Identity Management practices, organisations can safeguard the integrity of their data and mitigate the risks associated with unauthorised access or data breaches. Privileged Access Management Safeguard privileged accounts, control access, and enhance security posture With privileged access being a prime target for cybercriminals seeking valuable and confidential information, organisations must prioritise robust controls. At Ensign, we provide Privileged Access Management services which put a focus on data and identity protection, preventing unauthorised access and data exfiltration. By implementing proper controls and restricting privileged data access, we fortify your organisation's defence against internal and external threats in your IT environment.

ENSIGN CYBERSECURITY SERVICES Incident Response Mitigate Breach Impact with Our Expert Cyber Incident Response Team.  Ensign’s Incident Response Service Our cyber incident response service offers you peace of mind with a dedicated incident response team that monitors, detects, and mitigates threats around the clock. We are ready to respond to any incident swiftly to keep your systems always secure. Interested to learn more about Ensign’s capabilities? Read our case study on “BlackCocaine” Ransomware , as we investigated its impact on a banking and financial software company. 24/7 Response Round-the-clock technical support from a dedicated team of cybersecurity experts. Our team ensures prompt, on-site support within 8 hours for clients based in Singapore, resulting in minimal downtime and swift resolution of any security-related challenges. Red Team Augmentation Red Team augments investigations, offering offensive perspectives that delve deeply into the methods and tactics used by attackers. This provides a detailed and clear understanding of how breaches occurred, enabling you to enhance your defences effectively. Comprehensive Solutions
Our services encompass a comprehensive range of critical aspects, from incident response planning and threat containment to crisis communication, recovery, digital forensics, and litigation support. We provide thorough preparation and strategic planning to swiftly contain threats, manage crises effectively, and ensure a smooth recovery process. Post-Incident Monitoring We offer continuous protection and rapid detection of lingering threats to safeguard your organisation post-incident. Our proactive monitoring and advanced threat detection systems ensure that any residual threats are quickly identified and prevented from recurring. Select Your IR Retainer Package
When every second counts during a cyber incident, having a reliable plan in place is crucial. Ensign offers a selection of Incident Response Retainer Packages, crafted to ensure your business can quickly and effectively respond to threats. Explore our options to find the right fit for your security needs. Features Essentials Package Standard Package Ad-hoc Package Get a Quote Upfront Costs	Initial Response Time	Additional Cost Upon Activation Conversion of Unused Manhours	Renewal of Retainer	 Minimal upfront costs. From USD2,000/Year fee with 10 manhours included upon activation Pre-purchase of blocks of 100 manhours	 Immediate access to a dedicated team of experts via a hotline	Same as Essentials package	Longer onboarding process is required to ensure custodianship
Discounted manhour rate upon activation with 50-manhour cap in Phase One investigation*	 Drawdown from prepaid discounted manhours. 50-manhour cap in Phase One investigation*	Standard-priced manhours Annual *Note: In most cases, a Phase One investigation is sufficient for clients to mitigate and respond to the initial cyber-attack. 







Infrastructure Security Fortifying Your Digital Defences At Ensign, we specialise in fortifying your digital defences through our comprehensive Infrastructure Security services. With a focus on ensuring the confidentiality, integrity, and availability of your network, we provide peace of mind in today's complex cybersecurity landscape. Our team of experienced professionals delivers tailored solutions to safeguard your critical assets and protect you from evolving threats. We fortify your digital defences and provide you with the robust cybersecurity services you need for a secure and resilient infrastructure. What does Ensign Offers? OT/IoT Security Securing the Converged OT Environment: Ensign's Comprehensive OT Security Solutions As the convergence of IT and OT domains becomes essential to meet production demands in the Operational Technology (OT) sector, the increased connectivity also brings greater vulnerability to cyber threats. Ensign provides a holistic solution with Design, Protect, Detect, Control, and Respond capabilities to proactively secure your OT environment. Our comprehensive approach encompasses OT Security Advisory, Access Management, Network Management, OT Compliance & Assessment, Zones & Conduits, Business Continuity Planning, Situational Awareness, and Proactive OT Monitoring.

Protection Enhancing Data Protection and Endpoint Security in a Connected World In today's interconnected world, we understand the importance of enhancing data protection and endpoint security. Ensign’s comprehensive Protection solutions go beyond traditional measures, offering robust safeguards against cyber threats. By leveraging advanced encryption and proactive monitoring, we ensure the utmost security for your sensitive information. Our goal is to mitigate risks and provide organisations with peace of mind, knowing that their data and endpoints are fortified against potential attacks. What does Ensign offer? Data Protection Comprehensive Data Protection: Our Data Loss Prevention Suite As digitalisation and the adoption of IoT and Cloud technologies surge, the exponential growth of data poses significant risks. Organisations face an expanded digital attack surface, increasing the potential for sensitive data exposure and breaches. Our Data Loss Prevention Suite offers robust protection for data in-use, data in-motion, and data at-rest across endpoints, networks, storage, and the Cloud. With advanced detection and prevention capabilities, it safeguards against critical data leaks or breaches, empowering organisations to maintain data security and compliance. Endpoint Security Empowering Faster Threat Detection and Response At Ensign, our Endpoint Security services provide full spectrum visibility within the network, ensuring faster response times. Our solutions include Network Threat Analytics, enabling the inspection of packet data to identify malicious traffic that may bypass conventional detection devices. With advanced threat detection and response capabilities in endpoints, we enhance security measures. Continuous vulnerability management and configuration management database enrich internal processes, further strengthening your security posture. With our comprehensive Endpoint Security services, organisations can effectively detect and respond to threats, minimising potential risks. 

Risk Management Enhancing Cyber Risk Management across Supply Chains In today's interconnected world, organisations often overlook the cyber risks lurking within their supply chains. While internal networks receive security measures, the broader cyber supply chain ecosystem remains vulnerable. At Ensign, our extensive cyber threat research exposed a startling reality – companies across industries were oblivious to leaked third-party user credentials and unprepared to tackle such breaches. Further investigation unveiled a lack of enforcement and risk visibility between organisations and their suppliers. We offer a comprehensive approach to cyber risk management, empowering organisations with the tools they need to enhance visibility, enforce robust security standards, and effectively manage risks across their supply chains. What does Ensign offer? 3rd Party Supply Chain Mitigating Third-Party Cyber Risks in the Supply Chain Organisations must recognise and address the cyber risks posed by partners, vendors, and suppliers. To mitigate these risks, they should implement third-party risk assessment and monitoring, leverage advanced cybersecurity solutions, establish incident response playbooks, and maintain good cyber hygiene practices. This multi-layered approach enhances visibility, detects threats, and ensures effective incident resolution and prevention. Attack Surface Management Managing the Evolving Attack Surface for Enhanced Cybersecurity In the pursuit of resilience and customer-centricity, organisations are expanding their cyber supply chains and inadvertently increasing their digital attack surface. This expansion exposes them to elevated cyber risk exposures. At Ensign, our Attack Surface Management services help organisations effectively manage and mitigate these risks by providing comprehensive visibility, proactive threat detection, and robust security measures. Enterprise Governance Risk and Compliance Ensuring Compliance, Risk Management, and Threat Intelligence Ensign's Qualified Security Assessors (QSA) assist clients in achieving PCI DSS compliance, protecting cardholder data across processing, storage, and transmission. We guide clients in maintaining compliance with evolving regulations. Our expertise includes identifying information security gaps against ISO 27001:2013 standards. Our certified IT auditors provide Internal Audit-as-a-Service (IAaaS) for neutral assessments. We offer a comprehensive view of risk elements in emerging technologies, leveraging threat-informed approaches like the MITRE ATT&CK framework for risk identification and analysis.

Training & Exercises Building a Proactive Cyber-Ready Organisation Enhancing your organisation's cyber defence goes beyond implementing technologies and hiring skilled personnel. Threat actors continuously evolve their tactics, making regular testing of cyber defences crucial to stay ahead. At Ensign, we assist in testing and improving your cybersecurity posture by employing a threat-driven approach. Our consultants identify real-world adversaries targeting specific organisations and replicate their tactics to compromise critical systems and extract sensitive data. This helps organisations evaluate and enhance their readiness for cyber threats, ensuring increased cyber resiliency. What does Ensign offer? Tabletop Exercise Strengthen Incident Response with Collaborative Tabletop Exercises Tabletop exercises educate C-suite executives on cyber crisis management principles, validate and test crisis management and communication strategies, and assess the organisation's strategic decision-making capabilities under duress. Purple Teaming Enhancing Cybersecurity Readiness through Adversarial Emulation Purple Teaming adopts a collaborative approach, leveraging the synergy between our Red Team and your organisation’s Blue Team. The comprehensive attack-and-defend strategy enables organisations to achieve several objectives: It helps them identify vulnerabilities within their systems. It allows them to optimise their cybersecurity posture. It facilitates the enhancement of People, Process, and Technology aspects across their systems. Red Teaming and Breach Simulation Enhancing Cybersecurity Readiness through the Attacker's Perspective Our Red Team conducts realistic cyberattack simulations to enhance your organisation’s detection and response capabilities. Our threat analysis team complements the Red Team by identifying and analysing known and unknown threats, aligning them with the MITRE ATT&CK Framework throughout the entire kill-chain. By employing automated and manual techniques, we perform advanced penetration tests to uncover vulnerabilities in applications, networks, systems, and cloud environments. This comprehensive service provides a thorough assessment of system flaws and associated technical risks.





Combat Ransomware Crippling effects of Ransomware on your business Ransomware attacks are a growing threat to businesses and organisations worldwide. These attacks can have significant impacts, including financial losses, downtime, damage to reputation, data loss, regulatory non-compliance, productivity loss, and business continuity disruption. The frequency and sophistication of ransomware attacks have increased in recent years, and businesses must take proactive measures to protect themselves from this threat. Failure to do so can result in significant harm to the organisation, as well as its employees and customers. Combatting Ransomware Attacks Ransomware has become an increasingly prevalent threat in recent years, with numerous high-profile attacks targeting both individuals and organisations. The rise of ransomware has been driven by several factors, including the increasing reliance on technology, the growing sophistication of cybercriminals and the opportunities made available by inadequate security controls. The increasing use of cryptocurrencies has also made it easier for attackers to receive ransom payments anonymously, making it more difficult to track and prosecute them. The impact of ransomware attacks can be severe, with victims facing not only the loss of valuable data but also potential financial and reputational damage. The Internet Crime Complaint Center (IC3), the FBI’s lead federal agency for investigating cybercrime, received 3,729 ransomware complaints that led to $49.2 million worth of losses. In response, many organisations are investing in cybersecurity measures to protect themselves against ransomware and other types of cyber threats. However, the evolving nature of ransomware attacks means that vigilance and proactive measures are necessary to stay ahead of the threat. As ransomware continues to gain prominence as a serious cybersecurity threat, it is important for individuals and organisations to remain informed about the latest trends and best practices for preventing, detecting, and responding to attacks. Financial Losses
Businesses can suffer substantial financial losses as a consequence of ransomware attacks. Apart from fulfilling the ransom demand, companies may need to bear expenses related to data recovery, system repairs, and various secondary costs such as legal fees and the costs of restoring their reputation. Downtime A business can experience considerable periods of inactivity due to ransomware attacks. To contain the malware's spread, it may be necessary to temporarily shut down systems, resulting in employees being unable to access data and systems during this time. Regulatory Non-Compliance Numerous businesses must adhere to data privacy and security regulations imposed by regulatory bodies and industry standards. If a ransomware attack occurs, it can result in non-compliance with these requirements, consequently exposing the business to fines and other penalties. Productivity Loss Employees can experience decreased productivity as a result of a ransomware attack. When systems and data are inaccessible, employees may face challenges in effectively carrying out their work responsibilities. Business Continuity Disruption The continuity of a business can be severely disrupted by a ransomware attack. Depending on the attack's severity and the effectiveness of recovery strategies, the business may be forced to suspend operations for an extended duration, leading to enduring consequences for the organisation. Reputational Damage
The reputation of a business can be adversely affected by a ransomware attack. Customers and partners may lose trust in the business's capability to safeguard their business relationships, potentially resulting in lost revenue and opportunities. Data Loss Occasionally, ransomware attacks can lead to the irrevocable loss of essential data, which can severely impact a business's operations. This is especially problematic when an organisation's backup strategy is insufficient, rendering the lost data irretrievable thereby exacerbating the consequences.RaaS: The coordinated and concerted nature of Ransomware attacks In the past, ransomware attacks were perpetrated by isolated Threat Groups. Due to the incentives that successful ransomware attacks offer, an entire ecosystem has emerged to prey on the vulnerabilities afforded by victims. The emergence of Ransomware-as-a-Service (RaaS) as a business model where cybercriminals offer ransomware services is a key development in support of this ecosystem. RaaS enables cybercriminals who lack the necessary skills or resources to create their own malware to carry out attacks on a larger scale and with greater sophistication. Figure 1: Arrangement of techniques carried out by Threat Actors mapped against MITRE ATT&CK Today, RaaS offerings can be found on the dark web and even on legitimate websites. Some RaaS Operators operate as a subscription-based service, allowing criminals to purchase access to a suite of malware tools and services. Others offer a pay-per-use model, where criminals can rent specific ransomware tools for a short period of time. To attract more customers, RaaS Operators have also improved the user experience and made their services more user-friendly. Some RaaS Operators even offer technical support to their customers to ensure that their ransomware attacks are successful.The sophistication of RaaS has also increased. To further improve the rate of a successful deployment of the ransomware payload, ransomware attacks often combine the ransomware payload with other types of malware, such as Qakbot, TrickBot and Ursnif. This allows attackers to move laterally through a victim's network, maintain persistence, avoid sandboxes and virtual machines, as well as search capability for disk encryption software in their attempts to extract unencrypted files, and more. How to protect and recover from a ransomware attack While the inevitability of an attack seems to propagate the “Doom and Gloom” outlook with no hope in sight, there are steps businesses can take to prepare for a ransomware attack, mitigate its impact during an attack, and recover from the attack afterwards. Before an attack, businesses should implement security measures such as a ransomware-centric backup strategy as a viable countermeasure to paying the ransom, adequate vulnerability, and patch management to reduce the porosity of the attack surface. Employee training can reduce the organisations’ susceptibility to insider-related threats which could lead to a ransomware event. The familiarity of stakeholders with established Incident Response plans can also help them efficiently manage an actual ransomware-related breach. During an attack, businesses should have adequate measures to detect, identify and contain the effects of the ransomware detonation. These measures should include the active monitoring of technology assets to quickly detect ransomware-related events, information flow controls to find anomalies such as data exfiltration, hardware and software asset inventory records to minimise the time to identify the affected assets and their connectivity with other assets. Last but not least, organisations should have well-trained response personnel, including senior and business leaders, to manage the incident as it unfolds. After an attack, businesses should thoroughly assess the damage, restore data from backups, and identify the vulnerabilities that led to the attack to prevent future incidents. The first step is to determine the extent of the damage caused by the ransomware attack. This includes identifying which systems and data were affected, as well as the operational, financial, and reputational impacts and costs to remediate. The restoration of data and systems should take place concurrently when a sufficient level of confidence is provided by technology teams that the malware has been eradicated. Finally, an in-depth review of existing controls and measures should be conducted to improve and tighten controls to thwart further attacks. How Ensign helps you stay protected For organisations looking to curb ransomware threats, Ensign offers an end-to-end suite of services to prevent, detect, and respond to advanced ransomware threats. Click here to find out more about Ensign’s Anti-Ransomware Suite of services. Additional Resources Ensign Anti-Ransomware Suite

ENSIDERVOICES Join us at EnsiderVoices, a podcast series where we take you on a journey through the world of Cybersecurity. EP 2: ROLE OF PUBLIC, PRIVATE, PARTNERSHIP AND ACADEMIA IN ASIA’S UNIQUE THREAT ENVIRONMENT In this podcast episode, we delve into the unique cyber threat landscape of Asia. Through the advocacy and adoption of threat-informed defence approaches, we'll discuss the unique insights and threat groups we've observed in the region. 

EP 1: LEVERAGING AI AND ML FOR MALWARE RESEARCH AND ANALYSIS Joining us in this episode are host - Gaurav Keerthi (Head of Advisory and Emerging Business), and special guests - Lee Joon Sern (Director of ML and Cloud Research) and Eng De Sheng (Cyber Vulnerability Researcher). We delve into the evolving landscape of malware, highlighting how traditional classification methods struggle to keep up. As we explore the promising realm of image-based malware classification, we offer a solution to these limitations, revolutionising detection techniques, and reshaping cyber operations. We also examine global and Asia-Pacific region challenges in adopting novel classification methods. Discussing the pivotal role of AI and ML in modern cybersecurity, we uncover their potential in combating contemporary cyber threats, all while emphasising the irreplaceable importance of human oversight in maintaining the delicate balance between automation

EP 2: ROLE OF PUBLIC, PRIVATE, PARTNERSHIP AND ACADEMIA IN ASIA’S UNIQUE THREAT ENVIRONMENT In this podcast episode, we are joined by hosts Teo Xiang Zheng (Vice President of Advisory) and Bach HD (Senior Consultant) from Ensign InfoSecurity, along with our special guest, Benjamin Ang (Senior Fellow; Head of Centre of Excellence for National Security; Head of Digital Impact Research) from RSIS, NTU.

 

We'll delve into the unique cyber threat landscape of Asia. Through the advocacy and adoption of threat-informed defence approaches, we'll discuss the unique insights and threat groups we've observed in the region. Organisations should take note of these insights to inform their cyber strategies and defences. We'll also uncover the power of collaboration between the public, private, and academic sectors in strengthening cybersecurity, exploring the far-reaching benefits that these partnerships bring to communities for developing the cyber ecosystem across the region. Lastly, we'll explore ASEAN's pivotal role in shaping regional and international cybersecurity policies, offering an insider's perspective on their influence.

Out-of-bounds Write Vulnerability in Avast Antivirus Sandbox Driver (aswSnx.sys) due to Time-of-check Time-of-use Race Condition CVE NUMBER
CVE-2023-5760

SUMMARY
The sandbox driver (aswSnx.sys) in Avast Antivirus contains a vulnerability which could be exploited at the kernel level to perform Local Privilege Escalation, allowing attackers to gain NT AUTHORITY\SYSTEM privileges. 

MITIGATION
The issue was fixed with Avast/AVG Antivirus version 23.9

CVSSV3 SCORE
8.2

CWE
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

DETAILS
The sandbox driver (aswSnx.sys) is installed as part of the Avast Antivirus software package providing core functionalities for the antivirus.

The vulnerable sandbox driver contains a time-of-check to time-of-use (TOCTOU) bug in handling of certain IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability which can be further exploited, allowing an attacker to gain full local privilege escalation on the system.

RESOLUTION
To remediate the vulnerability, remove all outdated installation of Avast Antivirus and install the latest version of Avast Antivirus software package. 

The latest installation package can be obtained from the Avast Website.
TIMELINE
Aug 2023 – Vendor Disclosure
8 Nov 2023 – Vendor Patch Release
9 Nov 2023 – Public

CREDIT
Ensign InfoSecurity Labs - Akash Chandrasekaran, Teo Wei Sheng, Eng De Sheng

URLS
NVD-CVE Details

NVD - CVE-2023-5760 (nist.gov)

Norton Security Advisories (refer to CVE-2023-5760)

https://support.norton.com/sp/static/external/tools/security-advisories.html


Over the past two years, companies and individuals have relied on the Internet to continue running their operations or stay connected with loved ones. In fact, there were 64.2 zettabytes (ZB) of data created, captured, copied and consumed globally in 2020, up from 41ZB in 2019. According to Statista, data creation could grow to more than 180ZB by 2025. While data is essential for organisations to create better customer experiences and make more informed decisions, they are constantly challenged to secure it. The surge in data introduces a host of cyber vulnerabilities–from data loss in breaches to the sheer numbers of cyber attacks. To top it off, threats have become more sophisticated with time, and hacker groups are already forming alliances to steal data in exchange for money.That said, companies need to beef up their cybersecurity efforts to prevent further loss of data in the evolving digital landscape. This is where Data Loss Prevention comes in, and everyone within the organisation has a role to play in preventing hackers from stealing company data. What Laws Exist to Protect Personal Data? Smaller organisations often do not have the necessary tools to secure their sensitive data and shore up their defences against data breaches. Countries have recognised the threat data breaches pose; therefore, governments have taken action to safeguard data. For instance, Singapore has the Personal Data Protection (Amendment) Act (PDPA), which took effect in February 2021. It is meant to strengthen regulations on the collection, use, and disclosure of personal data. It tackles four areas: bolstering consumer trust through organisational accountability; ensuring effectiveness of enforcement; enhancing consumer autonomy; and supporting data use for innovation.
Furthermore, organisations must follow new sets of directives, like the Mandatory Data Breach Notification, which requires them to report breaches within 72 hours upon discovering the incident. Should companies fail to mitigate the breach, they may face penalties, amounting to 10% of the organisation’s annual turnover in Singapore or up to S$1 million, whichever is higher. In Malaysia, the Personal Data Protection Act 2010 covers personal data and the regulation of personal data processing in commercial transactions. It pertains to information related directly or indirectly to a subject whose identity can be known from that data. However, any information processed for credit reporting purposes by a credit reporting agency is exempted. Simply put, the law aims to guard individuals’ data from being abused by those who have control over that data. This includes information such as names, addresses and contact details. Sensitive pieces of information such as a person’s physical or mental fitness, religious beliefs and political views are also included. Meanwhile in Korea, the Personal Information Protection Act prescribes how personal data should be processed to protect the rights and interests of its citizens. It protects against the collection, unauthorised use, abuse and disclosure of personal data. In Hong Kong, the Personal Data (Privacy) Ordinance, which applies to both private and public sectors, requires that personal data only be collected for a lawful purpose directly connected to the data user’s function or activity. It does not allow the use of personal data for any other purposes unrelated to the original purpose of collection, unless allowed by the owner. But as measures have evolved to protect personal data, so have cyber criminals’ methods. Just last year, cybercrime had skyrocketed by 600% during the COVID-19 pandemic. How Is Data Lost?
Cybercrime comes in many different forms, but they all target a computer, a network or a network-connected device. Often, the culprits’ goal is to make money. Some forms of cybercrime include: Email or internet fraud Identity fraud Theft of card payment data or corporate data Cyberextortion (such as ransomware attacks) Theft of cryptocurrency Cyberespionage These potentially cause great damage, not just to companies, but to entire economies. Just last year, the United States White House issued a statement declaring that ransomware attackers had disrupted services, businesses, banks, government offices, hospitals and energy companies, among other industries. The global economic losses breached $400 million in ransom in 2020, and over $81 million in just the first quarter of 2021. Cyber criminals have teamed up to take advantage of security weaknesses. US oil supplier Colonial Pipeline was targeted by Russian group DarkSide by providing Ransomware-as-a-Service (RaaS) to an unidentified criminal group to execute the attack. JBS Foods, the National Basketball Association (NBA), Acer, AXA, Kaseya and Brenntag were also victims of ransomware attacks last year. Cybercrime occurs more often than those instances illustrated above, and hackers have branched out in terms of ways to do so. The techniques have become more sophisticated, and many criminals have even teamed up to launch attacks. What proactive measures can be taken? In light of these threats, there are suggested efforts to fortify personal data security. The following strategies require you to know what you need to protect. Data classification This refers to organising data into relevant categories for easier use and protection. Classification makes data easier to search and track as well as reduces storage and backup costs. For data security purposes, this process facilitates proper security responses depending on what type of data is being retrieved, transmitted or copied. Data visibility This helps businesses see what data they have, where it is located, who is authorised to access it, and what protection method is needed to remove risk. Without this, an organisation may use a solution that does not comply with security requirements, or even negatively impacts the business. Data protection This shields sensitive data from corruption, compromise or loss. More than that, it gives the organisation the ability to restore data to a functional state. However, to successfully implement this, a company must undergo a broad mindset change. They must communicate and garner support from its stakeholders, as well as provide training and continuous guidance for employees. They must also identify reporting metrics and indicators of success with business leaders. What are the roles of members of the organisation? All constituents of any organisation, whether they be employees, managers or security experts, have functions to perform in the personal data protection. Roles of leadership Employers or managers must value transparency in how they are using personal data within and outside of the organisation. Under Singapore’s PDPA, they must meet the following considerations: Accountability: Data protection policies, practices and complaints process must be made available upon request. To this end, they must assign a data protection officer and make business contact information readily accessible to the public. Employers must likewise initiate policies and foster a culture of responsibility through training and awareness programmes. Notification: Organisations must inform Individuals of the purposes for which their data is being collected, used and disclosed. Consent: Individuals must give their consent to the collection, use, and disclosure of their data. They must also be allowed to withdraw their consent and be informed of the consequences of withdrawal. Managers must also heed obligations with regards to: purpose limitation, accuracy, protection, retention limitation, transfer limitation, access and correction, data breach notification and data portability of personal information. Roles of data security experts An organisation’s security leaders must take on a holistic approach to their responsibilities. It transcends traditional IT, legal and security roles, and covers data privacy, security education and even opportunity within the organisation. Data protection officers (DPO) help organisations comply with privacy provisions and best practices. They oversee the company’s data protection strategies and implementation. They serve as the link between the company and authorities that supervise data privacy-related activities. DPOs must also educate leadership and employees on compliance with data privacy rules and regulations. This involves training the staff to follow these rules. They too have the job of determining what can be deemed personally identifiable information. But most of all, they have to ensure that the organisation is continuously updating their data protection. Roles of employees Data loss is not only perpetrated by criminal organisations or ill-meaning entities. In some instances, employees are tricked by malware and spoofing. As a result, they send out sensitive information to a seemingly trusted party. As such, employees need to undergo training regarding data security, upholding a culture based on security best practices. They must also avoid doing work on personal devices. Some of the ways to do this is to provide employees with a company device, or ask employees to choose a device on which to work and stick to it. How can organisations apply DLP? Today’s digital scene requires the cooperation of every department in the organisation for Data Loss Protection (DLP) to work. To successfully implement DLP, there needs to be a shift in the company's mindset. Communicate and garner stakeholder support To effectively implement DLP, stakeholders must be first identified and informed about why this needs to take place. Stakeholders influence the security policy and implementation of a company. Train employees and provide continuous guidance Every employee must be educated about policies and correspondent changes. This applies to new workers as well. Define success and reporting metrics with business leaders It’s important to communicate key performance indicators (KPI) with business leaders so they know what they should be looking at to determine the programme’s success. These metrics must demonstrate DLP’s positive effect and the value it brings to the business. How can Ensign’s Data Loss Prevention Help? Ensign’s Data Loss Prevention Suite allows organisations to secure data in-use, data in-motion, and data at-rest across endpoint, network, storage and in the Cloud. It can help see and shield against serious data exposure or breaches. The Data Loss Prevention Programme has four stages: Preparation This phase involves scoping out the hardware and software the organisation uses. Stakeholders must be identified to keep them abreast of the whole process. Existing DLP techniques are to be evaluated, and the environment should be tested to catch any issues early on. Prioritisation After establishing the information on hand, organisations must prioritise its protection. It is advisable to start out small and expand coverage when kinks in the process are ironed out. Knowing the most important things to protect can help your security leaders focus on what should be monitored and what can be left alone. To this end, this stage also tackles defining KPIs. Understanding Data and Rules The organisation’s privacy rules must be reviewed next. In this stage, data used by the company should also be identified. Here, implications of the chain of custody in collecting evidence in a DLP solution must be explained. Communications Communication with stakeholders and users must be consistent. Department points of contacts should be established to help them go through the requirements and obstacles that may arise. This also covers keeping key stakeholders informed through CISO and compliance, as well as training and education initiatives. The programme is aligned to five functions of the NIST cybersecurity framework: Identify, Protect, Detect, Respond and Recover. This process ensures that the programme is continuously improving to address the evolving threat landscape. The Ensign Data Loss Prevention Programme improves compliance to regulations, particularly that of PDPA and GDPR requirements. It enables protection of sensitive data like intellectual property, client personal details as well as company financial information. Finally, it lessens the risk of cyber breaches and financial penalties. The DLP is a programme. Therefore, it needs unity among all members of the organisation for it to be effective. Ensign InfoSecurity can help companies implement this programme to shore up their cybersecurity while still growing the business. Additional Resources Ensign Data Loss Prevention Programme Factsheet









 








































Secure Cloud Journey By 2025, it is predicted that worldwide data will grow to 175 zettabytes (ZB), with 49% of data residing in the public Cloud, according to IDC. Of this, 90 ZB of data will be created on IoT devices. It is irrefutable that the Cloud brings huge benefits such as greater agility, efficiency, and accessibility to organisations as they embark on their digital transformation journeys. Embracing the Cloud is no longer an option for most organisations if they want to remain competitive and stay ahead of the game. But all new technologies come with new risks. Cloud isn’t spared. Across all Cloud technologies—from Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) to Software-as-a-Service (SaaS)—organisations can expect an enlarged digital attack surface. It’s where cyber threat actors can now leverage new pathways and means to conduct their malicious activities and compromise systems. Two of the top few risks that organisations must grapple with are cyber supply chain and API-related threats. With Cloud, threat actors evolve their Tactics, Techniques and Procedures to conduct their activities upstream, embedding malicious codes in the software or hardware developed by manufacturers and vendors. This poses challenges to many organisations. These codes come in as ‘trusted sources’ which, without the right processes and means for detecting them, will likely remain hidden. This can ultimately result in opening a backdoor for hackers to exploit and conduct their ransomware or data exfiltration activities. As organisations embark on their Cloud journey, they need to understand the unique attributes of the Cloud that are absent from traditional on-premise environments. Responsibility is now shared between the organisation and vendor, a vastly different model compared to on-premise systems. In a traditional on-premise environment, ownership of data, management, monitoring, and regulatory compliance mainly lie within the organisation. This has given organisations greater control over their cybersecurity posture. But this has changed with Cloud. Referencing the CISA Cloud Security Technical Reference Architecture v2.0, responsibilities differ for different types of Cloud service models, i.e., IaaS, PaaS, and SaaS. Although this makes management more complex, it also means that organisations can now also place more trust and ownership on vendors and service providers to fulfil certain requirements. This brings the next point on cyber risk: Measuring and managing cyber risk now needs to go beyond the organisation. The Cloud vendors and service providers have to be considered as part of the organisation’s larger digital attack surface as a compromise or breach in their systems can lead to a downstream impact. Organisations should clearly define service level agreements and contracts, to have a common consensus with service providers on the shared responsibility of the Cloud systems that are going to be deployed. Organisations should adopt a different cybersecurity mindset when it comes to workload migration. One common pitfall of workload migration is having a ‘lift and shift’ mindset where applications and cybersecurity controls are moved from the on-premise environment to the Cloud without considerations of redesigning the workflow. Organisations have to understand that each cloud-native environment has a unique structure, vastly different from a traditional on-premise structure. This requires cybersecurity teams to be familiar with each specific environment and configure it to protect data from policy-violating behaviours. Moreover, with the Cloud, IT teams now have the flexibility to spin up new databases more frequently. An automated process must now be developed to monitor these new databases to detect any anomalous behaviours. The strategy of building ‘high walls’ and limiting entry points on the perimeter layer is another mindset that must change. This does not work in today’s day and age. As organisations adopt Cloud technologies, crown jewels such as sensitive data can be anywhere in the Cloud. Furthermore, COVID-19 has resulted in a predominantly work-from-home culture, further blurring the lines between trusted and untrusted boundaries. It is from this blurring of lines that Zero-Trust has become necessary in a digitally connected enterprise. Zero-Trust is more than a conversation on technology; it is a strategy. Ensign adopts a phased approach, aligned to the NIST Cybersecurity Framework of Identify, Protect, Detect, Respond and Recover, to help organisations implement Zero-Trust. We do this by first categorising and selecting key resources, and then helping them understand their communications flow, and the protocol and ports they use. We also look at the permissions of the users and roles to minimise the application-level permissions they have to the resource. Figure 2 shows Ensign’s approach to helping organisations implement Zero-Trust in their environments. Use existing frameworks and technology stacks to your advantage. You don’t necessarily need to reinvent. There are many more tools and frameworks available now compared to 5 years ago. This has made development work much more automated and streamlined. For example, the SG Tech Stack and Central Platforms such as Infrastructure-as-Code (SIaC), CloudSCAPE, shiphats, etc., are readily available resources for public use. These can help guide agencies and organisations adopt best practices to execute their digital or Cloud-based projects securely. Leveraging Machine Learning for Threat Detection in Cloud Security operations Cloud will not be fully optimised without the use of Machine Learning (ML) and Artificial Intelligence (AI) for Threat Detection in Cloud Security operations. Using AI/ML in the Ensign Security Operations Centre (EnSOC)—and integrating it with automation tools such as a Security Orchestration, Automation and Response (SOAR) Platform—provides us with the ability to detect and respond to advanced threats faster. Resources, once catered to perform manual operations, can now be diverted to higher-valued tasks such as threat hunting and incident response. At Ensign, we drive Cyber AI across 3 main areas for greater efficacy of threat detection and response in our Security Operations Centre (SOC). They are in (i) Cyber AI Infrastructure, (ii) Data Science, and (iii) Machine Learning Operations. Cyber AI Infrastructure End to End Cloud/On-premise platform to perform analysis of cyber data points, model development, model deployment Develop inline to Cyber Security Operations Remove complexity of establishing AI infrastructure for stakeholders Data Science Collaborate with Ensign Business users or Customers to identify use cases Rapid testing and deploying of AI models Machine Learning Operations Automate the operationalisation of Cyber AI models Monitoring and maintenance of Cyber AI Models Retraining and redeployment of models when Cyber Environment changed Governance Structure Benefits of leveraging the Cloud for Ensign’s Cyber AI initiatives: Removes the complexity of establishing AI infrastructure for machine learning development and operations for our stakeholders Enables fast experimenting, testing, deployment, and fine tuning of data models, with the ability to access operational data on Cloud More cost-effective to run machine learning models on Cloud compared to on-premise Easily scales up Machine Learning operations when required Easier integration and faster deployment with readily available Software Developer Kits and APIs from Cloud service providers

Careers at Ensign Be among those who help secure the cyberspace of enterprises, sectors, and nations through world-class expertise and innovative technologies. Explore Careers at Ensign Be a Cyber Defender of Choice As one of Asia’s largest pure-play cybersecurity firms, we’re unique in that we have our own R&D lab. Innovation is our DNA in powering up our business lines. We have won several awards and accolades that attest to our Innovation. Cybersecurity is not purely a technology issue, so we have some of the brightest and most talented people in the industry driving our growth. Join us to get opportunities to work with a great team to collaboratively advance your industry knowledge, certifications and work on challenging projects in security. Benefits of working at Ensign We strive to provide Ensiders and their loved ones with benefits that support their well-being. Our benefits are thoughtfully designed to care for you and your family – for now and the future. We build everyone, together.* Health Benefits Medical insurance for employees and dependents. Teach@Ensign / Brown Bag Sessions We promote a knowledge sharing culture within Ensign, where we support one another in our development. Dive deeper into a variety of topics at Ensign’s regular knowledge-sharing sessions, taught by Ensign’s very own staff. On-Site Fitness Centre Sweat it out in our own indoor gym, within a few walking steps from your office space. E-Learning Platform Expand your knowledge in a wide range of subjects including cloud, cyber, and other technology-related courses. Partnerships with Institutes of Higher Learning (IHLs) Ensign addresses industry skill gaps with Singapore Institute of Technology (SIT) to provide an inclusive alternative pathway for in-employment learners to upskill and pursue a degree through the Competency-Based Workplace Learning Pathway. On-Site Meals and Snacks Ensiders are served free bento sets every Monday and Friday. Great opportunities in cybersecurity across the region Here are some of the positions we offer across our offices: Big Data Engineer Cloud & Security Solutions Engineer Cyber Risk Consultant Data Scientist Incident Responder
Penetration Tester SOC Analyst Threat Hunter Threat Intel Analyst Vulnerability Researcher And many more... Technical Graduate Programme for Students The TGP is a three-year programme that aims to maximise your growth opportunities in cyber. Experience annual job rotations, and learn from a dedicated mentor, among other things!

























 


Unleash the best in you. Be a cyber defender of choice.The Ensign Technical Graduate Programme (TGP) seeks to cultivate the next generation of cybersecurity leaders. This is a three-year programme with an annual job rotation across three of our six business units. You will gain critical cross-functional knowledge and experience from working with the different departments, expanding both your depth and breadth in cybersecurity. Get the support you need to adapt to a dynamic work environment, and maximise your growth opportunities by accessing an active internal network of industry experts and a dedicated mentor. You will undergo a steep learning curve, but it will be worth it. If you are the talent we are looking for, join us! EXPERIENCE THREE JOB ROTATIONS ACROSS ENSIGN’S SIX BUSINESS UNITS The Consultant Be a trusted advisor in our Consulting business unit when it comes to planning and implementing cybersecurity strategies against evolving threats. The Designer Be the architect that builds secure-by-design solutions in our Systems Integration business unit for a more robust defence The Eye Your watchful, vigilant eyes, gut feel, and deep understanding of threats can save the day for many companies in our Managed Security Service business unit The Innovator Be part of a team with the passion for developing cutting-edge and bespoke cybersecurity solutions in our Labs business units PROGRAMME HIGHLIGHTS JOB ROTATIONS TRAINING AND MENTORSHIP NETWORKING AND EXPOSURE FAQs Programme FAQ: How is the Programme structured? This is a 3-year programme with an annual rotation across three of our six business units. Our fast-paced programme will accelerate your career in Cybersecurity, providing you with exposure and experience across a wide range of cybersecurity areas from which you can gain cross-functional knowledge and skills. Application FAQs: How do I apply to the programme? Email your CV to graduates@ensigninfosecurity.com. Who should apply to the programme? We seek technically strong, curious go-getters who want to make a difference in Cybersecurity. When do you begin accepting applications? Applications will open from October each year. When is the closing date for application? The closing date for applications is 31 December 2023. When does the programme commence every year? The programme will start upon graduation in Q3 2024 the following year. I am a Year 2 student, can I apply? Yes! We welcome all applicants, and will make early offers for subsequent intakes to successful applicants. Will I be notified if I am not selected? Yes, unsuccessful candidates will be notified via email. What is the hiring process like? There will be four rounds of selection, which include HR screening, two panel interviews and an aptitude test. What kind of roles can I expect for rotation? There is a variety of roles you may rotate through, such as Cyber Threat Intel Consultant, Security Operations Centre Analyst, and Advanced Analytics Consultant. Do I get to choose my rotation? We will take your career aspirations and interests into consideration wherever possible. Will I be able to work abroad for one of my rotations? It is possible to work in a different country for one of your rotations. However, as we will need to take business needs into consideration, we cannot guarantee an overseas rotation. What is the commpensation package for this programme? We offer a competitive salary package along with fringe benefits.

Vulnerability Reports Threat Advisories Disclosed Vulnerability Reports REPORT DATE CVE NUMBER CVSS SCORE LAN-Side Unauthenticated Remote Code Execution (RCE) in D-Link DIR-822 routers due to Stack-Based Buffer Overflow in HNAP 31 Jan 2024 TBC TBC
Out-of-bounds Write Vulnerability in Avast Antivirus Sandbox Driver (aswSnx.sys) due to Time-of-check Time-of-use Race Condition 9 Nov 2023 CVE-2023-5760 8.2

LAN-Side Unauthenticated Remote Code Execution (RCE) in D-Link DIR-822 routers due to Stack-Based Buffer Overflow in HNAP CVE NUMBER TBC SUMMARY An unauthenticated attacker can gain Remote Code Execution in the D-Link DIR-822 router due to a stack-based buffer overflow vulnerability in the HNAP service. CVSSV3 SCORE TBC CWE CWE-787: Out-of-bounds Write CWE-121: Stack-based Buffer Overflow DETAILS A stack-based buffer overflow vulnerability is discovered in the (Home Network Administration Protocol) service on the D-Link DIR-822 routers. This vulnerability can be exploited by unauthenticated attackers to gain arbitrary remote code execution on the vulnerable router. RESOLUTION The latest firmware version (v2.03B01) released for DIR-822-CA (Rev.B) on 27 October 2023 is still vulnerable to exploitation. Firmware development for DIR-822 (Rev. A and Rev.B models) has ceased and these devices will no longer be supported. D-Link US recommends D-Link devices that have reached EOL/EOS, to be retired and replaced. 10 January 2024 – Initial contact with D-Link 16 January 2024 – Vulnerability Disclosure 31 January 2024 – Public Support Announcement by D-Link for DIR-822 CREDIT Ensign InfoSecurity Labs – Quynh Le, Eng De Sheng URLS https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10372













Welcome to our Fraud Awareness page In an era where trust and reputation define businesses, safeguarding our integrity is paramount in serving you better. We want to caution you about potentially fraudulent activities targeting online users by impersonating and exploiting our brand through deceptive emails and/or graphics. Your vigilance serves as the cornerstone of our collective defence against impersonation and deception. Stay Informed Be vigilant against phishing, identity theft, and unauthorised data access attempts. We will never request sensitive information through unsolicited means. Stay Protected Avoid responding to suspicious emails, always verify sender addresses, and refrain from clicking on unfamiliar links or attachments. Reporting Fraud If you suspect fraudulent behaviour involving the misappropriation of our identity (Ensign InfoSecurity), we encourage you to promptly report the incident through our web form Report here Examples of Fraudulent Behaviour Fraudulent Website When uncertain about a website using the Ensign InfoSecurity brand, access via our official website for guaranteed security. Our official website: https://www.ensigninfosecurity.com/ Fraudulent Email All official Ensign InfoSecurity communication will always be sent from @ensigninfosecurity.com. Fraudulent SMS SMS scams often employ shortened URLs like https://bit.ly/ to obscure the true destination. The sender number frequently appears as a generic name, such as "Cyber Security," and may have a country prefix from an unexpected territory (e.g. +234). Fraudulent Social Media Accounts The account lacks verification/authenticity (e.g. incomplete, or inaccurate "About Us" section). The account attempts to communicate through encrypted channels like WhatsApp or Telegram. The account is newly created. Suspicious offers such as "free services" or "you have won 1 million dollars". Inadequate profile picture (Ensign InfoSecurity logo) and inconsistent background picture. 

Ensign InfoSecurity is the first organisation headquartered in Singapore to become a Research Sponsor of MITRE Engenuity CTID “Ensign InfoSecurity, an advanced practitioner and advocate for a threat-informed defense, brings a critical regional perspective to our global mission to change the game on the adversary. With a strong foundation already in place, we look forward to our continued research and development collaboration that will benefit their clients and the global cybersecurity community. Together, we will pioneer new horizons, pushing boundaries and delivering innovative solutions.” Jonathan Baker Director and Co-founder, Center for Threat-informed Defense, MITRE Engenuity We are thrilled to announce that Ensign InfoSecurity is the first Singapore headquartered organisation to become a Research Sponsor with the MITRE Engenuity Center for Threat-Informed Defense (CTID). This partnership represents our dedication to making meaningful contributions to the cybersecurity community and society at large. By joining forces with MITRE Engenuity and other industry leaders, we are empowered to tackle emerging threats and challenges head-on. Our primary objective as a Research Sponsor is to provide relevant and advanced cybersecurity solutions that help businesses address the evolving landscape of cybersecurity challenges. Through this collaboration, we can leverage the expertise of MITRE Engenuity CTID and other thought leaders to enhance our existing solutions and achieve our shared goal of a more secure digital world and advocate for responsible behaviours in cyberspace. As part of our commitment, we are delighted to contribute our expertise, staff, and resources to advance MITRE Engenuity CTID research programme in the public interest. This collaboration with MITRE Engenuity and other industry thought leaders will strengthen the cybersecurity community and make a significant impact in the fight against cyber threats. At Ensign InfoSecurity, we firmly believe that collaboration and knowledge-sharing are vital in advancing cybersecurity. We believe that investing in research and development is essential to address the evolving cybersecurity landscape effectively. And, being a research sponsor with the MITRE Engenuity CTID aligns with our mission to provide our clients with advanced cybersecurity solutions that protect them from the evolving threat landscape. Our application of Threat-informed Defence approaches to provide enhanced cybersecurity services At the forefront of cybersecurity innovation, we integrate Threat-informed Defence (TID) concepts into our cutting-edge solutions. This integration enhances our solutions, to provide contextual, and relevant insights into the cyber threats and risks facing organisations in their operating territories of concern, fostering a proactive and adaptive cybersecurity approach. Furthermore, our commitment to TID extends to enhancing our service offerings, such as Cyber Maturity Assessment, Simulation Exercises, Intel-led Red Teaming, and Incident Response. By analysing threat actors' Attack Flow, and mapping their Tactics, Techniques and Procedures (TTPs), alongside organisation- and region-specific threats, we assess defensive controls against material threats, enabling strategic resources prioritisation. This application of TID not only fortifies our cybersecurity services but also establishes a resilient foundation for navigating the ever-evolving landscape of cyber threats with confidence. About Ensign InfoSecurity Ensign InfoSecurity is the largest, pure-play end-to-end cybersecurity service provider in Asia. Headquartered in Singapore, Ensign offers bespoke solutions and services to address its clients’ cybersecurity needs. Its core competencies are in the provision of cybersecurity advisory and assurance services, architecture design and systems integration services, and managed security services for advanced threat detection, threat hunting, and incident response. Underpinning these competencies is in-house research and development in cybersecurity. Ensign has two decades of proven track record as a trusted and relevant service provider, serving clients from the public and private sectors in the Asia Pacific region. About the Center for Threat-Informed Defense The Center for Threat-Informed Defense is a non-profit, privately funded research and development organization operated by MITRE Engenuity. The Center’s mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the Center builds on MITRE ATT&CK®, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations. Because the Center operates for the public good, outputs of its research and development are available publicly and for the benefit of all.

Implementing Identity & Access Management (IAM) Key Factors of IAM IAM serves as the foundation for protecting sensitive information, mitigating cybersecurity risks, and streamlining operational processes. Although IAM policies, processes, and technologies can differ between companies, it is an essential part of cybersecurity for organisations of all sizes. It enables them to manage the digital identities of individuals and control their access to resources. At its core, IAM revolves around the concepts of identity, authentication, authorisation, and accountability. Together, these can be used to mitigate cybersecurity risks by reducing or restricting user access to sensitive data. IAM systems consist of several interconnected components that work together like a well-oiled machine to ensure secure and efficient access to resources. These key factors include: Identity Management Checks a login attempt against an identity management database, which is an ongoing record of everyone who should have access. Authentication Verifying the identity of users, services, and applications. Authorisation Assigning users with specific roles and ensuring they have the right level of access to resources. Access management Granting authenticated users access to specific resources or functions. Auditing Tracking and monitoring user activity to detect and respond to suspicious behavior in real-time. Identity governance Identity governance is the process of tracking what users do with their resource access. IAM systems monitor users to ensure they don't abuse their privileges—and to catch hackers who may have snuck into the network. Identity lifecycle management Identity lifecycle management is the process of creating and maintaining a digital identity for every human or non-human entity on a network. Threats to Identity Access Management (IAM) Having access to data and systems is essential for the smooth functioning and resilience of business operations. Simultaneously,however, it exposes organisations to significant risks. If IAM is not implemented correctly or neglected, organisations may face various threats and vulnerabilities that can compromise their security and operational integrity. Some of these key threats include (but are not limited to): Unauthorised Access This threat involves attackers gaining unauthorised access to systems, applications, or sensitive data by exploiting vulnerabilities in IAM processes or bypassing authentication mechanisms. It can result in data breaches, unauthorised modifications, and the compromise of critical resources. Insider Threats This refers to malicious or negligent actions by individuals who have authorised access to systems and data. This threat can include disgruntled employees or contractors intentionally abusing their privileges, stealing sensitive information, or causing disruptions to operations. Weak Authentication Using weak passwords or failing to implement multi-factor authentication can make it easier for attackers to gain unauthorised access to systems or user accounts. This threat exposes organisations to credentials-based attacks and identity theft. Inadequate Access Controls This can lead to excessive privileges or improper authorisation. This threat includes scenarios where users have access to resources beyond their job requirements. Or where access control policies are not properly enforced, increasing the risk of unauthorised access and potential data breaches. Poor IAM Governance Weak governance practices, such as ineffective user provisioning, insufficient role management, or lack of regular access reviews, can create vulnerabilities in IAM processes. This threat can result in inconsistent access rights, unmonitored accounts, and difficulties in tracking and managing user identities. IAM is a critical component of an organisation's overall security strategy. Failing to implement IAM correctly exposes organisations to these threats and vulnerabilities. In addition, addressing these threats requires a comprehensive IAM strategy that is tailored to the needs of the organisation.  Safeguarding User Identities and Access Controls Thus, implementing IAM is an important strategy for reducing the risk of cybersecurity threats. To mitigate these threats effectively, organisations can implement the following strategies: 
Implement Strong Authentication Mechanisms Utilise Multi-factor Authentication (MFA) to strengthen the authentication process. Require users to provide multiple forms of identification, such as passwords, biometrics, or hardware tokens, to verify their identities. This reduces the risk of unauthorised access even if passwords are compromised. Enforce Least Privilege Implement the principle of least privilege, granting users the minimum necessary access rights to perform their job functions. Regularly review and update access privileges to ensure they align with user roles and responsibilities. This reduces the risk of unauthorised access and limits the potential damage caused by insider threats. Conduct Security Awareness Training Provide regular security awareness training to educate users about IAM best practices, password hygiene, and common threats like phishing and social engineering. Empowering users with knowledge helps them make informed decisions, and reduces the likelihood of falling victim to identity-related threats. Conduct Regular Audits and Assessments Perform regular audits and assessments of IAM infrastructure, policies, and processes. This helps identify vulnerabilities, gaps, and areas for improvement. Maintain comprehensive logs and audit trails to track user activities for forensic analysis and compliance purposes. Engage in Third-Party Security Assessments Consider engaging independent third-party security professionals to conduct periodic security assessments and penetration testing. This helps identify potential weaknesses in IAM systems, and provides valuable insights for remediation. How can Ensign help? The critical success factors that Ensign implements are: Programme Approach Involving the right stakeholders in the programme Understand the risk of this programme and dependencies upfront Organisation Acceptance of the programme at the organisational level Initiate change management well in advance Technology Product selection strategy Various testing phases Process Well- defined IAM processes Identification of crown jewels

Tackle Deepfakes Real-Time Detection of Manipulated Audio and Video Content Deepfakes are an escalating threat to consumers, enterprises, and government entities, posing significant risks through fraud, misinformation, and the manipulation of public opinion. With the rapid advancement of AI, bad actors are creating increasingly convincing fake audio and video, making it harder to distinguish between real and manipulated content. As these sophisticated deceptions become more widespread, the need for reliable detection methods is more critical than ever. In response, Ensign InfoSecurity has developed Aletheia—an advanced AI-powered solution that detects deepfakes within seconds. This proprietary tool identifies manipulated media in real-time, helping organisations and individuals safeguard against deepfake threats and preventing the spread of fraudulent content. Aletheia – A Real-time Deepfake Detection Solution for Enterprises, Governments and End Consumers Aletheia can alert users to deepfakes during virtual meetings or while browsing the internet. This solution will be available to enterprises, governments and end consumers as either an Endpoint Software or a Chrome browser plug-in, offering timely and accurate detection of deceptive content. Download the Deepfake Detection Solution Factsheet here. Real-time Detection, Within Seconds Up to 90% Accuracy Alert Fakes Across Modalities (Audio and Video) Developed In-house Available as an Endpoint Software or Chrome Extension Seamless SIEM Integration Register Your Interest For Ensign Aletheia Register Now





Digital Reputation Risk Management Suite AI-powered Innovations to Help Organisations Safeguard Their Reputations In today’s cyber environment, your organisation’s reputation is prone to a range of threats. The proliferation of fake news and leaked sensitive information, as well as increasingly sophisticated deepfakes and phishing scams puts every aspect of your brand’s digital presence at risk. Unaddressed vulnerabilities can further expose your business to exploitation by malicious actors. Ensign’s Digital Reputation Risk Management Suite addresses these concerns by providing modular solutions tailored to resolve your organisations’ unique challenges. The combination of our cutting-edge technology and proactive strategies, equips your organisation with the essential tools to detect and mitigate these threats – protecting your brand, internally and externally, while providing the insights needed to prevent risks from spiralling out of control. Ensign’s ZEUS Engine Powering Your Reputation Defence Suite Ensign ZEUS is designed to address the diverse challenges that organisations face today. Its modular architecture enables flexible deployment, allowing organisations to implement components as required. Ensign offers comprehensive cybersecurity capabilities ranging from advisory, architecture, and implementation to cyber operations and incident response. Specialist support is also provided where required. With seamless integration, Ensign ZEUS enables the rapid identification of risks across the web, delivering comprehensive coverage and timely alerts to protect your brand in an increasingly complex threat landscape. It leverages graph-based anomaly analytics at the Tactics, Techniques, and Procedures (TTPs) level, and help distinguish genuine malicious TTP sequences from benign ones – allowing for a refined comprehension of potential risks. Holistic Visibility A fully unified perspective across all digital assets and attack surfaces to help analysts prioritise remediation efforts Proactive Cyber Risk Management Obtain contextual insights into the connection between internal and external activities to minimise cyber risks Enhanced Decision-Making Equip leaders to make informed, strategic decisions through an aligned, centralised cyber-business view Three Modular Solutions The Digital Reputation Risk Management Suite comprises three modular solutions. Each module is a sophisticated fusion of cutting-edge analytics and real-time threat intelligence, empowering organisations to proactively safeguard their reputation by detecting and analysing a wide array of threats, including misinformation, data leaks, and digital scams. 
Anti-Scam Module Defend Your Organisation from Scams and Phishing Attacks Early Warning Module
Stay Ahead of Emerging Threats with Proactive Alerts Brand Monitoring Module Combat Misinformation and Safeguard Sensitive Data Across the Web Download Factsheet For a Comprehensive Overview, Download the Full Suite Factsheet for Insights on All Modules Download Full Suite Factsheet

EP 3: MITIGATING CYBER THREATS IN ASIA: LEVERAGING THREAT-INFORMED DEFENCE Joining us are host - Gaurav Keerthi (Head of Advisory and Emerging Business), subject matter expert - Teo Xiang Zheng (Vice President of Advisory), and special guest - Mike Cunningham (R&D Program Manager, Center for Threat-informed Defense, MITRE Engenuity).  In the episode, we'll dive deep into the topic of mitigating cyber threats in Asia through Threat-informed Defence. We'll discuss the unique cyber threat landscape in Asia and its contrasts with other regions. We'll also introduce the concept and importance of threat-informed defence and explain how organisations can enhance their cyber defence strategies using the MITRE ATT&CK framework. The discussion includes real-world examples of threat detection techniques and cybersecurity scoring, offering practical steps for implementing effective cyber defences and understanding adversaries. 

StrongKeep by Ensign InfoSecurity One Platform to Manage All Your Cybersecurity Needs with Ease. Cybersecurity Protection for Your Small Business Small-Medium Businesses (SMBs) Lack Proper Defence Against Cyberattacks—The rapid advancement of cyber threats poses increasing risks to businesses across all sectors, especially for organisations with resource constraints and no dedicated cybersecurity staff. At Ensign, we know the challenges of running a business, and how quickly those efforts can be undone if an attack compromises your data or harms your reputation. Unfortunately, for small-medium businesses (SMBs), the complex jargon and high costs of cybersecurity often make it difficult to prioritise protection. By leveraging Ensign’s AI-driven analytics and advanced cyber tools, StrongKeep empowers SMBs to manage their cybersecurity measures with an easy-to-use platform that seamlessly integrates compliance, protection, training, detection, and incident response. This streamlined approach helps SMBs be more secured, reduce risks, and achieve CSA’s Cyber Essentials with ease. Get your business started on StrongKeep’s platform today! Key Features Centralised Platform StrongKeep serves as a centralised platform where users can meet all their cybersecurity needs, from monitoring and managing risks to implementing protective measures, all in one place. Advanced AI-powered Analytics By leveraging advanced, AI-powered analytics and cyber tools, our cybersecurity services and solutions are well-designed and specially tailored to meet the specific needs of SMBs. Simple and IntuitiveOur dashboard is designed to be simple and intuitive, with guided processes, making it easy for users to navigate and manage their cybersecurity measures. Affordable Pricing We offer an affordable pricing plan that provides SMBs with the security they need without stretching their limited resources. Visit StrongKeep

CYBERSECURITY 101 The Definitive Resource for Businesses Navigating the Intricate World of Cybersecurity Welcome to Ensign’s Cybersecurity 101, the definitive resource for businesses navigating the intricate world of cybersecurity. Our glossary helps you demystify cybersecurity jargon, empowering your team to make informed decisions and implement robust security measures. Gain insights from cybersecurity experts who provide practical examples and contextual understanding for each term, enabling your team to apply this knowledge effectively. Cryptojacking - Cryptojacking is the unauthorised use of victims’ devices or servers to mine cryptocurrency for illicit profits. Attackers who engage in this form of malicious cryptomining aim to remain hidden in their victims’ computer systems or network for as long as possible to maximise the profits gained from cryptomining. Cybersecurity Incidents - Cybersecurity incidents are events that pose a threat to the confidentiality and accessibility of an organisation’s data or assets. They often result from failed or inadequate cybersecurity measures and have the potential to disrupt business operations. Data Breach - Data breach refers to any cybersecurity incident where sensitive or confidential data belonging to individuals or organisations is accessed by unauthorised personnel. These data include Personally Identifiable Information (PII), private credentials, intellectual property, and other classified information. It is important to note that not all cybersecurity incidents or cyberattacks constitute data breaches, as in the case of Denial-of-Service (DoS) attacks. Digital Forensics - Digital forensics, a branch of forensics science, deals with the acquisition and analysis of digital evidence. The digital evidence gathered is crucial in investigating cybersecurity incidents or other criminal activities, contributing to legal procedures and incident response efforts. Incident Response - Incident response, in the realm of cybersecurity, refers to the approach taken by organisations to manage and address cybersecurity incidents. It encompasses a series of procedures, strategies and technologies aimed at efficiently responding to incidents, mitigating adverse effects and restoring operations to their normal state. Malware - Malware, short for malicious software, includes any software intentionally designed to cause harm to a computer, server, or network. Malware can come in many variants, but they share similar objectives: financial gains, disruption and destruction of targeted entities, and political motivations. Phishing - Phishing is a type of social engineering attack where emails, messages, or social media are used to manipulate individuals into compromising their data security. Threat actors often impersonate trusted entities to deceive victims into clicking malicious links or revealing sensitive credentials and personal information. Ransomware - Ransomware is a type of malicious software (malware) that blocks a victim’s access to data or a computer system, usually by encrypting it, until the victim pays a ransom fee to the attacker. Attackers often promise to restore the data if the ransom is paid, but these days, victims cannot be sure about this assurance, as the risk of data being destroyed or leaked remains.

ENSIGN CYBERSECURITY SERVICES Emergency Incident Response Under Attack? Contact Our Expert Cyber Incident Response Team Now.  Request Assistance Why Choose Our Emergency IR Service?
Ensign is the largest pure-play end-to-end cybersecurity service provider in Asia, trusted by reputable organisations and renowned for delivering swift and effective solutions to the most advanced cyber threats. Comprehensive Crisis Management Our team of experienced incident responders provides comprehensive support to help you combat threat actors.24/7 Availability We provide you with round-the-clock access to our incident response experts, supporting your IR operations anywhere in the world.Reduced IR Expense As a tech-enabled firm, we practise threat-informed incident response using proprietary IR tools and tradecraft to streamline your operations and save costs. How Our Emergency Incident Response Service Works Step 1: Contact Us Immediately Complete the cyber breach assistance form, and our team will contact you soon. Meanwhile, assess the situation and consider isolating the compromised systems from your network to prevent further spread. However, do not power off any machines as this may lead to data loss or hinder forensic analysis. If you are running a virtual machine, take a snapshot of it immediately to capture the system's current state for further investigation. All information shared is treated with absolute confidentiality and will not be disclosed to any authorities or third-parties without your explicit consent. Step 2: Rapid Compromise Assessment Once we receive your request, our cybersecurity experts will promptly assess the situation. This involves identifying the nature and extent of the compromise. Based on this assessment, we will provide you with detailed guidance on the immediate mitigation steps to take, ensuring that you can stabilise your systems quickly and effectively. Step 3: Incident Containment
Our team will work swiftly to contain the threat and prevent any further damage to your network and systems. This involves isolating the affected areas, implementing temporary security measures, and ensuring that the threat is neutralised. Our goal is to minimise the impact on your operations while securing your environment. Step 4: Recovery and Continuous Monitoring After containing the incident, we will assist you in recovering your systems to their normal operational state. This includes restoring data, reconfiguring security settings, and ensuring that all traces of the threat are removed. We will also put in measures to monitor for any lingering threats.Step 5: Digital Forensics and Reporting We will conduct a thorough digital forensic analysis to understand how the incident occurred, who might be responsible, and what vulnerabilities were exploited. We will provide you with a detailed report outlining our findings and recommendations to prevent future incidents. We also serve as expert witness to support any follow-up investigations. Request Assistance

Cryptojacking Explained: Types, Detection Methods, and Prevention Strategies What is Cryptojacking? Cryptojacking is the unauthorised use of victims’ devices or servers to mine cryptocurrency for illicit profits. Attackers who engage in this form of malicious cryptomining aim to remain hidden in their victims’ computer systems or network for as long as possible to maximise the profits gained from cryptomining. How Does a Cryptojacking Attack Happen? Although the methods by which a cryptojacking attack is carried out may vary, most attacks follow a relatively standard methodology. Infection of victims: Victims of phishing attacks often unknowingly get infected by cryptojacking scripts or malware when they open malicious links on their browser or install infected applications on their device. Attackers may also set up fake Wi-Fi hotspots that appear to be legitimate public networks, such as those in coffee shops or airports, and gain unauthorised access to victims’ devices when they connect to these fake networks. Execution of malware or script: Once a device is infected, the cryptomining malware or script runs silently in the background, using the device's central processing unit (CPU) or graphics processing unit (GPU) to solve complex cryptographic puzzles. The rewards gained from solving those puzzles is directed to the attackers’ digital wallet. The cryptojacking activity may persist undetected, potentially for a long time. To avoid detection, the cryptojacking malware may use anti-analysis techniques, throttle CPU or GPU usage based on user activity, or hide among legitimate background processes. Such cryptojacking scripts often form part of a larger botnet, combining the computational power of many infected devices to maximise financial gains.Types of Cryptojacking Attacks Cryptojacking has evolved to become more sophisticated, manifesting in various forms. Understanding the different types of cryptojacking is crucial in recognising and mitigating its impacts. Browser-based Attacks In browser-based cryptojacking, attackers run JavaScript code directly within the victims’ web browser when they visit an infected website or click on a malicious advertisement. The malicious script then runs in the background, utilising the browser’s resources to mine cryptocurrency for as long as they remain on the page. Since this form of cryptojacking does not require installation of software, it is less damaging on the victims’ device but also harder to detect. System-based Attacks This type of cryptojacking occurs when a user unknowingly downloads and installs cryptojacking malware onto their device. The cryptomalware runs in the background, using the processing power of the victims’ devices to mine cryptocurrency. The system-based form of cryptojacking is more harmful as it gives attackers greater control over the victim's computer, enabling them to steal sensitive information. Hybrid Attacks  Hybrid cryptojacking attacks take browser-based attacks a step further. Not only does the malicious script run on the victims’ browser, but it also exploits vulnerabilities in the browser or plugins to drop a payload on the victims’ system. This payload is usually a more persistent form of cryptomining malware that installs itself on the system, allowing it to run continuously even after the browser is closed. Hybrid attacks enable attackers to continue their operations long-term and improve cryptojacking efficiency and profitability. Cloud-based Attacks With more organisations shifting their operations to the cloud, cryptojacking attacks that target cloud servers have become more prevalent. Attackers exploit vulnerabilities or use stolen credentials to gain access to cloud infrastructure, then use the compromised resources for cryptomining. Given the vast resources available in cloud infrastructures, attackers can gain significant computational power for their mining operations, making this type of cryptojacking particularly lucrative. Signs That You May Be Under a Cryptojacking Attack 
Cryptojacking can be stealthy, but there are several indicators that your system or network may be compromised: Decreased performance: Your computer or device may become unusually slow or unresponsive. Applications may take longer to load, which may indicate cryptomalware infection. Unresponsiveness of web browsers and automatic opening of multiple tabs may be a sign of cryptojacking scripts affecting web performance. Since cryptojacking consumes excessive power, your device’s battery may also drain unusually quickly. Overheating: Your device may overheat due to the excessive CPU or GPU usage required for cryptocurrency mining. You may notice the device's cooling fans running more frequently or at higher speeds. Increased CPU/GPU usage: A significant spike in CPU or GPU usage even when the system is idle or running minimal applications may indicate that cryptojacking software is running in the background. The Task Manager (for Windows users) or Activity Monitor (for Mac users) may also show high resource usage by unknown or suspicious processes. Unexpected system behaviour: Systems infected with cryptojacking malware may become unstable, crashing frequently or experiencing unexplained reboots. Increased electricity bills: In cloud environments, you may receive unexpected bills for excessive usage of computing resources. This can be a sign that your cloud instances are being used for cryptomining. Unfamiliar processes: Check for unfamiliar processes or services running on your system. Cryptojacking malware often disguises itself, but unusual or unknown processes can still be identified. Alerts from security software: Modern antivirus and anti-malware solutions often detect and alert you to cryptojacking attempts. Pay attention to these alerts and take them seriously. Suspicious browser extensions: Be on the lookout for unwanted or suspicious browser extensions, as they may be vectors for cryptojacking scripts. Regularly review and remove any extensions you do not recognise or need. What Are the Implications of a Cryptojacking Attack? Cryptojacking attacks may often be perceived as less harmful than other forms of cybercrime because it does not directly damage victims’ computers or steal data. However, the covert nature of these attacks means they can go undetected for extended periods of time, silently draining resources and potentially causing considerable damage. Due to the considerable amounts of CPU and GPU resources that cryptojacking malware and scripts consume, slower system performance and more frequent system lags and crashes may significantly reduce productivity for victims and businesses. Financial losses incurred from the increased energy consumption, repair and replacement of hardware, and remediation costs may place heavy financial burden on victimised businesses. Network security may also be compromised as cryptojacking malware may create backdoors that allow attackers to deploy additional malware, potentially exfiltrating sensitive data and spreading to other systems across the network. Over time, reputational damage to organisations may be severe if the cryptojacking operations negatively affect organisations’ service quality or cause service disruptions. Customer and investor trust may erode, potentially leading to the loss of business opportunities and partnerships. How to Defend Against Cryptojacking Attacks? Protecting your systems and networks from cryptojacking attacks requires a comprehensive approach that addresses both prevention and detection. Given the stealthy nature of these attacks, it is essential to implement robust security measures across all potential points of entry. Maintain Browser Security Many cryptojacking scripts rely on JavaScript to execute. Disabling JavaScript in browsers when it is not needed or using ad-blockers and script-blockers may prevent these malicious scripts from running on the browser, thus defending against browser-based cryptojacking attempts. Employee Training 
By empowering employees with cybersecurity awareness, organisations can turn them into a proactive defence system. Regular training sessions can equip them with the knowledge to identify signs of cryptojacking, and practice safe browsing habits such as avoiding untrusted websites and downloading software only from reputable sources. Cloud Security Measures Regular monitoring of cloud instances for unusual activity, such as spikes in CPU usage or unauthorised instance creation, may aid in early detection of cryptojacking activities. Organisations should also implement strict access controls and multi-factor authentication to secure cloud environments, ensuring that only authorised personnel have access to critical resources. Cloud-native security tools like Microsoft Defender should also be used to continuously analyse and improve security posture. Regular Software Updates Regular updating and patching of computer systems is essential for maintaining a robust defence against cryptojacking attacks. Pay special attention to critical security updates and patches and prioritise their installation. This proactive approach helps to reduce the risk of exploitation and infection by cryptojacking malware. Endpoint Detection and Response (EDR) Implementing EDR solutions to monitor endpoints for suspicious activities may enhance detection of potential cryptojacking attempts and reduce response times. EDR tools can detect abnormal behaviour associated with cryptojacking and provide alerts for quick response. Addressing cryptojacking attacks on ever-growing attack surfaces may be complex and burdensome for organisations to maintain and operate, especially without a comprehensive support system. Ensign’s Managed Detection and Response service provides a holistic solution to mitigate cryptojacking threats, leveraging the expertise of specialists, technology partners and advanced capabilities to detect and respond to cryptojacking attempts fast and accurately. Prevent Cryptojacking with Ensign's Managed Detection and Response (MDR) Ensign's MDR offers: 24/7 Threat hunting: Our security experts constantly monitor your systems for signs of cryptojacking and other cyber threats. Threat intelligence integrated operations: Our credible cyber threat intelligence enable early warning and detection capabilities through advanced analytics. Rapid response: We take immediate action to isolate and neutralise threats, minimising system damage and downtime. Expert guidance: Our team provides ongoing security advice and recommendations to strengthen your cyber posture.  Learn more about our Managed Detection and Response (MDR) services.

What Are Cybersecurity Incidents? Cybersecurity incidents are events that pose a threat to the confidentiality and accessibility of an organisation’s data or assets. They often result from failed or inadequate cybersecurity measures and have the potential to disrupt business operations. It should be noted that cybersecurity events and cybersecurity incidents, though often interpreted similarly, have some key differences. Cybersecurity events are any occurrences in a system or network related to cybersecurity, which may or may not be harmful. On the other hand, cybersecurity incidents are events that have escalated to cause a negative impact on an organisation. Incidents typically require investigation and immediate responses to mitigate risks and eliminate the threat. Types of Cybersecurity Incidents Cyber attackers execute various types of cybersecurity incidents against organisations, utilising different software, programmes, and codes. The methods of attack differ depending on the attackers’ objectives. Below are some common cybersecurity incidents: Phishing: Manipulates individuals into revealing sensitive information or downloading malware, typically through methods like emails, messages, calls, or social media. Malware: Refers to all kinds of malicious software, where the programs or codes are designed by attackers to infect devices, disrupt operations, or compromise systems. Examples include ransomware, Trojans, worms, viruses, and spyware. Advanced Persistent Threats (APTs): A prolonged cyberattack where hackers infiltrate and gain access to a network, remaining undetected while spying, disrupting operations, or stealing sensitive data. Supply chain attacks: Target a company’s supply chain network, exploiting third-party tools or vendors to compromise systems or data. Insider threat: Malicious or negligent individuals within organisations, authorised to access systems and data, may misuse their privileges to disclose sensitive information. This exposes the company to internal vulnerabilities that cybercriminals can exploit. Internet of Things (IoT) vulnerabilities: Refers to weaknesses in IoT devices that attackers can utilise for their attacks. IoT devices, such as sensors and smartwatches, are hardware capable of connecting to networks and exchanging data. 
Denial-of-Service (DoS) and Distributed-Denial-of-Service (DDoS) attacks: Disrupt normal operations by overwhelming servers, systems, or networks, making them inaccessible to legitimate users. Why Do Cybersecurity Incidents Occur? While not all cybersecurity incidents are cyberattacks, those driven by malicious intentions often stem from attackers’ motivations such as: Financial incentives: Attackers capitalise on the lucrative nature of cybercrime by stealing financial information, such as bank account details, for direct monetary gain. They may also sell stolen data on the dark web or demand ransom payments, potentially yielding substantial sums, especially when targeting highly confidential data within large companies. Revenge: Incidents may arise from negative sentiments toward the target party or organisation. Hacktivism: A portmanteau of “hack” and “activism”, refers to when hacktivists conduct cyberattacks due to their political or social agendas. Common avenues include DoS and DDoS attacks. Cyber espionage: Carried out to steal confidential information for advantage over competitors or national security purposes. Intellectual challenge: Some hackers derive satisfaction from these activities, considering them personal achievements.  In other cases, cybersecurity incidents could occur unintentionally due to human error, system misconfigurations, or malfunctions. What Are the Consequences of Cybersecurity Incidents? Cybersecurity incidents, whether malicious or non-malicious, inevitably impact organisations. The implications of these incidents can generally be classified into: Financial Loss Cybersecurity incidents can be very costly for organisations due to the extensive remediation efforts required during and after an incident. Operational capabilities often suffer, leading to a direct impact on revenue. In major incidents, companies may incur monetary losses from compensating affected customers or making ransom payments. Restoration expenses, such as software and hardware upgrades, digital forensics, and new cybersecurity measures, add to the financial burden. In attacks where competitors steal intellectual property and proprietary information, organisations face the challenge of adapting to the loss of competitive advantage or disrupted Research and Development (R&D) pipelines. Failure to adjust business strategies effectively can result in a decreased market share and even potential business failure. Operational Disruptions Cybersecurity incidents inevitably lead to disruptions in network systems and operational processes. Serious attacks, such as malware infections or data breaches, necessitate downtime for containment or investigations. Not only does this impact business operations and potential revenue, but it can also adversely affect work productivity. Employees’ efficiency may be reduced as they adapt to changes in processes resulting from the incident. Reputational Damages While it is understood that cybersecurity incidents are unavoidable, those with significant consequences can damage relationships with stakeholders. They erode trust with customers, business partners, and investors, reducing business opportunities and revenue. When confidence in a business diminishes, attracting new customers and employees becomes more challenging, hindering business growth. Furthermore, such incidents can influence a company’s share price and market standing. Consequently, organisations would have to dedicate substantial and consistent effort to rebuilding their brand reputation, a process that can often take a long time. Legal and Regulatory Complications Cybersecurity incidents can result in organisations violating regulations or laws, depending on the extent of the damages and legal compliance they are required to adhere to. In cases where data is breached, organisations must promptly report the incident to relevant authorities and affected stakeholders within a specified timeframe, as mandated by data breach notification laws. Failure to comply with the necessary legal procedures can result in organisations incurring fines or penalties. How to Defend Against Cybersecurity Incidents There is no one-size-fits-all solution in defending against cybersecurity incidents due to factors such as Incident types 
Industry-specific considerations Diverse organisational operational needs Unique risks for specific organisations Different regulatory requirements However, several strategies can enhance security posture and increase resistance towards cybersecurity incidents. These approaches include: Deploy Proper Cybersecurity Tools At a minimum, organisations should have security tools in place to defend against cybersecurity incidents. Some of these tools include Endpoint Detection and Response (EDR), Intrusion Detection and Prevention Systems (IDS/IPS), and vulnerability management solutions. Organisations can manage these tools using technologies like Security Information and Event Management (SIEM), Unified Threat Management (UTM), Security Orchestration, Automation, and Response (SOAR), and other network monitoring tools. Regular security assessments and updates are also essential to keep pace with rapid advancements in cyber threats and patch vulnerabilities in the company’s networks and systems. Incident Response Plan Incident response plans consist of procedures that organisations follow when facing cybersecurity incidents. A well-defined incident response plan equips cybersecurity teams and relevant stakeholders with the necessary tools and expertise to address cybersecurity incidents promptly and effectively. Time is of the essence in minimising the extent of impact, and a comprehensive plan not only streamlines incident response efforts but also ensures that organisations are well-prepared to take the necessary steps for compliance with legislation. Engage Cybersecurity Experts Drawing on the expertise of cybersecurity professionals enables a thorough analysis of an organisation’s unique needs, leading to customised and advanced defence strategies for managing cybersecurity incidents. Outsourcing cybersecurity experts relieves organisations from the burden of in-house security management while allowing them to leverage up-to-date defence technologies that these experts consistently keep up with. This is particularly helpful for organisations lacking a strong internal security team, which can often be costly and resource-intensive. Strengthen Your Cybersecurity Posture with Ensign Cybersecurity incidents are unpredictable and can occur at any time without warning. With increasingly advanced techniques and resourceful cyber attackers, many traditional detection technologies are inadequate in combating these incidents effectively. Ensign’s Security Incident Monitoring provides real-time monitoring of your network security devices and endpoint protection solutions. This clear visibility, together with our advanced threat detection technologies and tools, identifies your organisation’s areas of vulnerability to stay ahead of these attackers. Learn about our Ensign Security Operations Centres (EnSOCs) service.

Understanding Data Breaches: Causes, Consequences and Response What is a Data Breach? Data breach refers to any cybersecurity incident where sensitive or confidential data belonging to individuals or organisations is accessed by unauthorised personnel. The data includes Personally Identifiable Information (PII), private credentials, intellectual property, and other classified information. It is important to note that not all cybersecurity incidents or cyberattacks constitute data breaches, as in the case of Denial-of-Service (DoS) attacks. How Does a Data Breach Occur? Data breach occurs mainly through cybersecurity incidents to compromise systems or networks to gain unauthorised access. Common data breach attack vectors include: Phishing attacks: Social engineering tactic which manipulates individuals into revealing sensitive information or private credentials through legitimate emails, messages or calls. Malware infections: Refers to programs or codes designed by attackers to infect devices, disrupt operations, or compromise systems. Sensitive data may be extracted by these attackers for unauthorised purposes or to demand ransom, as in the case of ransomware. 
System vulnerabilities: Refers to weaknesses in systems that attackers can exploit. Such weaknesses include system misconfigurations or unsecured networks and devices. Insider threat: Malicious or negligent individuals within organisations may intentionally or accidentally misuse their access to systems and data. As such, sensitive information may be disclosed, or vulnerabilities are created for attackers to take advantage of. Supply chain attacks: Occurs when attackers target third-party systems such as an organisation’s suppliers, vendors, or managed service providers to gain access to the organisation’s data. Man-In-The-Middle (MITM) attacks: Steal data or credentials through interrupting the traffic between the victim and the target server. Implications of Data Breaches Data breaches disrupt business operations, potentially leading to revenue losses for organisations. Additionally, they have adverse effects on organisations’ reputation, impacting their market position and share value. When personal data is compromised, companies not only face financial losses due to legal penalties and compensation but also lose trust from their customers. The impact of data breaches varies based on their extent and the parties affected. In highly regulated industries, breach consequences can be particularly severe where organisations incur significant penalties. What Should You Do When Encountering a Data Breach? Before responding to a data breach, organisations should be aware of the applicable regulations to ensure compliance with legal requirements. Note that the information herein is not presented as a source of legal advice. Some of the regulations in the Asia-Pacific region include: Singapore: Organisations must adhere to the Personal Data Protection Act (PDPA). In the event of a data breach, organisations have 30 calendar days to assess if the breach is notifiable. Under the Personal Data Protection (Data Breach Notification) Regulations 2021 (PDP(DBN) Regulations 2021), the Personal Data Protection Commission (PDPC) must be informed within three calendar days once the breach is deemed to be notifiable. Hong Kong: Organisations must comply with the Personal Data (Privacy) Ordinance (PDPO) and are advised to follow the Guidance Note issued by the Office of the Privacy Commissioner for Personal Data (PCPD). The Guidance Note provides frameworks to assist organisations with data breach prevention and response. Malaysia: The Personal Data Protection Act 2010 (PDPA) encompasses personal data and the regulation of personal data processing in commercial transactions. Data breach notification is not mandatory, but it can be done through a Data Breach Notification form issued by the Personal Data Protection Commissioner (PDPC). China: Organisations must adhere to the Cybersecurity Law (CSL), Data Security Law (DSL) and Personal Information Protection Law (PIPL). Under these laws, security incidents must be reported to the relevant authorities, such as the Cyberspace Administration of China (CAC), and if necessary, to affected individuals. Indonesia: The Law No.27 of 2022 on Personal Data Protection mandates that organisations notify the government and affected individuals within 72 hours of becoming aware of a data breach. Australia: Part of the Privacy Act 1988, the Notifiable Data Breaches (NDB) Scheme requires the Office of the Australian Information Commissioner (OAIC) and affected individuals to be promptly notified of eligible data breaches. South Korea: The Personal Information Protection Act (PIPA) requires organisations to notify data subjects within 24 hours of discovering the breach and to notify the Personal Information Protection Commission (PIPC) if the breach affects 1000 or more data subjects. Guidelines vary across countries, including the criteria for notification, timeframes, and penalties. Different sectors also face specific regulations for data breaches. For instance, owners of critical information infrastructure must notify the Commissioner of Cybersecurity of the Cyber Security Agency (CSA) of Singapore, while organisations processing personal data of European Union (EU) residents must comply with the General Data Protection Regulation (GDPR), among others. Beyond compliance obligations, organisations should establish clear data breach response strategies to react promptly and effectively to any cybersecurity incident involving potential data breaches.The Singapore PDPC’s guide on “Managing and notifying data breaches” outlines the CARE framework, which consists of four steps an organisation can take when encountering data breaches: Contain: As with any incident response protocol, a data breach must be contained to curb the damages and prevent the escalation of the threat. Assess: This next step involves the organisation assessing the impact of the data breach and its remediation approach including assessing if the breach is a notifiable one. Report: Once determined that the breach is notifiable, the organisation must notify the relevant entities and affected individuals. Failure to comply with these data breach laws and notification requirements may result in enforcement actions against the organisation and consequently, penalties incurred. 
Evaluate: The last step of the CARE framework involves evaluating the data breach response efforts, refine and improve strategies to strengthen defence against future data breaches. Handling data breaches is a complex challenge that requires organisations to possess robust technical expertise. The actual procedures extend beyond the details outlined above and there are many more details organisations need to be aware of. At Ensign, our Digital Forensics and Incident Response teams excel in swiftly containing cybersecurity incidents, effectively minimising our clients' data loss and financial impact. How to Prevent Data Breaches? Establish a Data Breach Management Plan In addition to complying with legal regulations, organisations should implement a data breach management plan. This plan ensures preparedness for data breaches, effective response, and fosters trust with stakeholders. Referring to the PDPC’s Data Protection Management Programme (DPMP), it outlines four steps that organisations can consider when establishing a robust data protection foundation. Adopt Data Security Measures On top of having a clear data breach management plan and response protocols, there are strategies organisations can consider implementing to strengthen data breach prevention: Data classification: Refers to organising data into relevant categories for easier use and protection. This process facilitates proper security responses depending on what type of data is being retrieved, transmitted or copied. Data protection: Shields sensitive data from corruption, compromise or loss as well as the ability for organisations to restore the data. This may be done using security tools such as endpoint security solutions, Data Loss Prevention (DLP) systems and data encryption tools. Zero Trust adoption: Implement Zero Trust Architecture (ZTA) by applying identity-based controls to continuously validate every user and device accessing network resources, enforcing strict least privilege access based on their responsibilities. Network segmentation is also essential to limit unauthorised access and prevent lateral movement. Effective Zero Trust measures require comprehensive data visibility, which can be supported by technologies such as Security Information and Event Management (SIEM) and Identity and Access Management (IAM) solutions. Third-party Risk Management Given the growing threat from attackers targeting third-parties, organisations should perform cyber risk assessments when selecting their vendors or partners. Monitoring third parties’ security controls ensures data security, and promptly addressing any vulnerabilities that arise is crucial. Additionally, organisations should include cybersecurity data breach clauses in contracts and limit the data provided to third parties to minimise the risk of data breaches. Comprehensive Data Protection: Ensign’s Data Loss Prevention Suite Data breaches, regardless of if they are accidental or intentional, can lead to hefty fines. Enhanced data security posture can help mitigate such financial risk to your organisation. Our Data Loss Prevention (DLP) Suite enables organisations to secure data in-use, data in-motion, and data at-rest across endpoint, network, storage and in the Cloud. It detects and prevents potential critical data leaks or breaches. Beyond safeguarding sensitive data and intellectual property, we ensure that your organisation complies with PDPA and GDPR requirements. Our DLP process is continually enhanced to address the evolving threat landscape, ensuring your organisation is protected against data breaches and exposure. Learn more about our Data Loss Prevention (DLP) Suite.

Cybersecurity Incident Response: Frameworks and Tools You Need to Know What is Incident Response? Incident response, in the realm of cybersecurity, refers to the approach taken by organisations to manage and address cybersecurity incidents. It encompasses a series of procedures, strategies and technologies aimed at efficiently responding to incidents, mitigating adverse effects and restoring operations to their normal state. Types of Cybersecurity Incidents Cybersecurity incidents are events that pose a threat to the confidentiality and accessibility of an organisation’s data or assets. They often result from failed or inadequate security measures and have the potential to disrupt business operations. Common types of cybersecurity incidents organisations may encounter include: Phishing: Manipulates individuals into revealing sensitive information or downloading malware, typically through methods like emails, messages, calls, or social media. 
Malware: Refers to all kinds of malicious software, where the programs or codes are designed by attackers to infect devices, disrupt operations, or compromise systems. Attackers develop and utilise different types and variants of malware infections depending on their attack motives. Ransomware: Encrypts files or systems and demands payment for decryption. It is a type of malware that typically infiltrates devices through phishing attacks. Denial-of-Service (DoS) and Distributed-Denial-of-Service (DDoS) attacks: Disrupt normal operations by overwhelming servers, systems or networks, making them inaccessible to legitimate users. Insider threat: Security risks posed by malicious or negligent individuals within organisations who have authorised access to systems and data. These individuals, whether intentionally or unintentionally, may misuse their access to disclose sensitive information, potentially exposing the company to internal vulnerabilities that cybercriminals can exploit. Why is Incident Response Important? In today’s digital landscape, where cyber threats are increasingly sophisticated and pervasive, incident response emerges as a critical part of an organisation’s cybersecurity posture. Effective incident response strategies not only act as a stronghold against the severe consequences of cybersecurity incidents but also strengthen companies' defences against future threats. By responding appropriately, organisations can mitigate the impacts, which often include data losses, financial setbacks, and reputational damage – key factors for maintaining trust with stakeholders, including customers, partners, and investors. How Does Incident Response Work? In general, incident response teams in many organisations reference their incident response steps to one of the prominent frameworks by the National Institute of Standards and Technology (NIST), a federal agency in the United States that advances measurement science, standards, and technology. In Ensign, we refer to the NIST framework to guide our incident response strategies for ourselves and our clients. NIST Incident Response Framework Preparation This first phase of the incident response lifecycle involves understanding the organisation’s risk profile and business operations to formulate an incident response plan. It requires collaboration among relevant stakeholders and specialists within the organisation to develop technologies and coordinate efforts to solidify the incident response strategy. The strategy will continuously adapt to evolving cyber threats and trends to enhance its efficiency and efficacy. Additionally, protocols are established to ensure compliance with legal requirements during a crisis. Detection and Analysis This stage focuses on the rapid and accurate detection of cybersecurity incidents through monitoring and analysing network traffic for any unusual activity or potential threats. Organisations may utilise advanced threat detection technologies to identify the security threat, prompting the company to act accordingly. Containment, Eradication and Recovery Containment: Once the security incident is confirmed, containment measures are quickly implemented to prevent escalation of the threat. Infected systems or devices will be isolated from the rest of the network to minimise further damages as much as possible. Additionally, forensic data collection begins at this stage to gather evidence, ensuring the preservation of valuable information and insights in case of alterations or destruction during the incident response process. This helps ensure that forensic evidence stays legally admissible in court, especially important when pursuing legal actions. Eradication: With the threat contained, incident response teams then work towards eliminating it from the system entirely. Some examples of remediation efforts include removing malware and reconfiguring security controls to close security gaps and vulnerabilities. Recovery: In the recovery stage, affected systems and data are restored back to normal operations. This must be executed carefully to prevent misconfigured systems from worsening the situation. Organisations must also keep their Recovery Time Objectives (RTO) in mind to ensure timely restoration of vital services and operations. Post-incident activity The final stage of the incident response process involves thorough review and analysis of the incident to derive actionable insights and areas for enhancement. This includes examining the timeline of events, from the emergence and progression of the threat to the organisation's incident response performance. These insights serve as learning points for the team and organisation to refine their incident response plan, adopting better strategies to tackle such threats more effectively in the future. Incident Response Tools and Technology Throughout the incident response process, incident response teams utilise various tools and technologies to streamline workflow and remove the threat efficiently. Some common tools and technologies include: Intrusion Detection System (IDS) Early threat detection can be facilitated by IDS, a network security tool which monitors network traffic and systems for signs of malicious activities or suspicious behaviour. When such events are detected, they are flagged out to the organisation’s centralised security infrastructure such as the Security Operations Centre (SOC) or security team. Security Information and Event Management (SIEM) A SIEM, one of the many centralised security tools available, analyses security alerts generated by network hardware and applications in real-time. It aggregates data from other network sources within the organisation to identify patterns, anomalies and potential cybersecurity incidents. Following this, security teams can prioritise their efforts on addressing the more advanced and severe threats. Security Orchestration, Automation, and Response (SOAR) SOAR platforms help streamline the incident response process by allowing security teams to set up playbooks which helps to coordinate the various tools and operations. It also automates manual and inefficient tasks for security teams to focus their efforts on the challenging ones to better tackle the issue at hand. Endpoint Detection and Response (EDR) EDR solutions aims to protect an organisation’s end-user devices by continuously collecting endpoint data to detect and respond to signs of potential security threats. It also provides security teams visibility into endpoint activity. Extended Detection and Response (XDR) XDR extends beyond EDR to analyse data across a variety of sources, such as organisations’ endpoints, network traffic, cloud applications and workload. The enhanced visibility boosts organisations’ ability to detect threats, enabling quicker response times for businesses when addressing cybersecurity incidents. User and Entity Behaviour Analytics (UEBA) UEBA solutions specialise in detecting suspicious activities within organisations by harnessing technologies such as machine learning and behavioural analytics. They often collaborate closely with other security tools like SIEM and EDR to provide comprehensive threat detection and response capabilities. Better Incident Response with Ensign Navigating a cybersecurity incident as it unfolds can be daunting and confusing. Even organisations that wish to prepare for potential attacks may lack the expertise to effectively plan and execute a response. With Asia’s largest on-site incident response team, Ensign supports organisations in their incident response operations. Beyond managing Digital Forensic and Incident Response (DFIR), we assist you through the chaos of a cyberattack. Our services include advising on threat actor interaction, crisis communication, regulatory compliance, and litigation, ensuring comprehensive support during critical times.

Understanding Malware: Types, Signs, and Prevention What is Malware? Malware, short for malicious software, includes any software intentionally designed to cause harm to a computer, server, or network. Malware can come in many variants, but they share similar objectives: financial gains, disruption and destruction of targeted entities, and political motivations. Types of Malware Over the years, malware has evolved significantly, becoming more sophisticated and harder to detect. Modern malware can operate stealthily, embedding itself deep within systems, evading detection by traditional security measures, and executing complex attacks. This evolution has led to the development of specialised types of malware, each designed for specific purposes such as stealing sensitive data, extorting money, disrupting operations, or gaining unauthorised access to systems. Understanding the various types of malware is essential for more effective detection, prevention, and response strategies to protect valuable data and maintain cybersecurity.Virus A virus is a malicious code that attaches to clean files and replicates itself by modifying other computer programmes and inserting its own code, spreading throughout a computer system. It requires user interaction to spread from one system to another, such as opening an infected file. Worm In contrast to a virus, a worm is a type of malware that does not require any user interaction to spread. A worm is a standalone malware that replicates itself automatically, spreading across networks by utilising automatic file transfer features that may have been enabled, either deliberately or accidentally, on network computers. Its ability to replicate without needing to attach itself to programmes or files enables it to propagate across networks more quickly than a virus. It often gains access into a system through exploiting network vulnerabilities, backdoors or external drives. Trojan Trojan malware disguises itself as legitimate software that tricks victims into installing it, giving unauthorised access to victims’ systems. It is designed to operate under-the-radar once the code is activated by the victims and is often used to let other types of malware into the system. Although a trojan cannot self-replicate and spread automatically like worms, they are still capable of destructive damage to business operations. A prominent example is the Emotet malware, which according to Ensign’s Cyber Threat Landscape Report 2023, started out as a banking trojan in 2014 and have since evolved into a more complex and adaptable threat, utilising Excel Macros and PowerShell to deliver payloads and developing sandbox evasion techniques. Spyware Spyware is a software that secretly monitors user activity without their knowledge or consent. Instead of disrupting a device's operations, spyware aims to collect sensitive information that can provide attackers with remote access. Attackers often use the keystroke logging capability of spyware to track and collect victims’ login credentials, browsing history and location details, using the data for financial theft or selling it to third parties. Adware Adware refers to unwanted software designed to display advertisements on the victims’ screens. It often occurs within the victims’ web browser and consumes processing power, slowing down the performance of their devices. While adware is not always dangerous, in some cases it may be designed to analyse the websites visited by victims, present advertising content, install additional programmes, and redirect victims’ browsers to unsafe sites, potentially hijacking their browsers to install viruses or spyware.
 Ransomware Ransomware locks or encrypts data on a victim’s computer system and demands a ransom for its release.  Despite the attacker’s promises to restore the locked data once ransom is paid, victims cannot guarantee the recovery of their files, thus the risk of data being destroyed or leaked remains. While ransomware is mostly distributed as Trojans, it can also be delivered via viruses and worms, exploiting different methods to reach and infect systems. Fileless Malware Fileless malware uses legitimate, built-in system tools and processes to carry out malicious activities. It operates entirely in a computer's memory without writing files to the hard drive, and often utilise system processes available and trusted by the operating system. This makes it difficult to for traditional antivirus solutions to detect and remove since they are designed to scan files. Fileless malware often utilises PowerShell, Windows Management Instrumentation (WMI), or other native Windows tools to carry out attacks while evading detection. Cryptojackers Cryptojackers are a form of malware designed to mine cryptocurrency from a victims’ devices without their knowledge. Attackers use victims’ Central Processing Unit (CPU) or Graphics Processing Unit (GPU) resources on their computers or mobile devices to verify transactions on a blockchain network and earn cryptocurrency. This malicious form of cryptomining significantly reduces costs for an otherwise resource-intensive and expensive process for cybercriminals. Signs You May Be Under a Malware Attack Malware can often operate covertly, making it challenging to recognise without keen awareness and the right tools. However, certain telltale signs can indicate that your system may be compromised. Being able to identify these warning signs can help you take prompt action to address the infection and secure your data and systems. Slow performance: If your computer or device is running unusually slow, it could be a sign that malware is consuming system resources. Malware often runs processes in the background that can significantly degrade performance. Frequent crashes: Unexpected crashes, freezes, or blue screens of death (BSOD) can be indicative of malware interference. Malware can corrupt files and disrupt normal system operations, causing instability to your computer system or network. Unusual network activity: Increased or unexplained network traffic, especially when the system is idle, may indicate that malware is communicating with a remote server. This communication may be for the purpose of sending stolen data, receiving commands, or downloading additional malicious payloads. 
Influx of pop-up advertisements: A sudden increase in pop-up advertisements, especially when you are not browsing the internet, is a common sign of adware. Unauthorised access: Unusual login attempts or changes in account activity may indicate that malware is attempting to steal credentials or gain unauthorised access. This could include changes to passwords, new accounts being created, or logins from unfamiliar locations. How Do Malware Attacks Occur? Malware attacks typically unfold in several phases, each involving different techniques to compromise a system. Understanding these phases can help in developing robust defences and mitigation strategies. Phase 1: Delivery and distribution The first phase of malware attacks involves leveraging various delivery methods to distribute malware. They include: Mobile phishing: Cybercriminals often leverage social media and messaging applications to deploy phishing techniques, deceiving smartphone users into downloading malware infected documents or opening malicious links. Email attachments: Attackers often use phishing emails to deliver malware. These emails may appear legitimate, coming from trusted sources or using convincing language to trick recipients into opening attachments containing malware. 
Malicious links: Cybercriminals embed malicious links in emails, social media posts, or websites. Clicking on these links can download malware onto the device or direct the user to a malicious website.Software downloads: Attackers may create fake versions of popular software or completely new malicious applications. When users download and install these programs, they inadvertently infect their systems with malware. Phase 2: Exploitation of Vulnerabilities Once the malware is delivered, attackers take advantage of either technical vulnerabilities, human vulnerabilities, or both to facilitate the entry of malware into their systems and devices. System and software vulnerabilities: Malware exploits known vulnerabilities in operating systems, software, or applications that have not been patched or updated. These vulnerabilities serve as entry points for attackers. Human vulnerabilities: Social engineering attacks manipulate people into performing actions or divulging confidential information. These attacks often bypass technical defences by targeting weaknesses in human behaviour, such as fear or a false sense of security. Attackers may also take advantage of weak passwords to infiltrate networks or devices and deploy malware. Phase 3: Installation of Malware After the malware is downloaded on a device, there are two main ways that it may execute its malicious code: User activation: Some malware types require user interaction to execute, such as opening an infected email attachment or running a downloaded file. These malware types include viruses, trojans, and ransomware. Automatic activation: Other types of malware, such as worms, can self-execute and replicate in the victim’s computer system or network. Malware often take steps to persist on the system, such as modifying registry entries to start the execution automatically, or creating scheduled tasks that launch the malware. Phase 4: Command and Control (C&C) Once the malware is installed, it establishes a communication channel between the compromised system and the attacker-controlled server, enabling the attacker to control the malware remotely. The malware may use domain generation algorithms (DGAs) or pre-configured domains and IP addresses to connect to the attacker’s C&C server, receiving instructions and sending back data that was exfiltrated. To avoid detection by security software, the malware may use various evasion techniques, such as encrypting communication with the C&C server to evade network monitoring tools and changing its code or behaviour to avoid signature-based detection. Phase 5: Payload Delivery A payload refers to the intended damage that the malware is designed to inflict. Payloads can be delivered in different forms based on the attacker’s objectives: Destructive actions: Certain types of malware, such as wipers, are designed specifically to delete or corrupt data on a system, while ransomware uses encryption to withhold files from victims. Other types of malware, such as worms and adware, are designed to disrupt the normal functioning of a system, which include system crashes and network outages. Espionage: Spyware, such as keyloggers, screen recorders and form grabbers, collect sensitive information such as login credentials, credit card numbers, and other personal data, and sends it back to the attacker. Financial theft: Banking Trojans are designed to steal financial information, such as online banking credentials, credit card numbers, and other sensitive data. Resource hijacking: Cryptojackers use the CPU and GPU resources on victims’ computer system to perform the complex calculations required for mining cryptocurrency.  Phase 6: Propagation
Malware can spread through various methods, including network shares, email attachments, malicious links, and removable media like USB drives. It can also capitalise on vulnerabilities in connected devices, such as printers, routers, and Internet of Things (IoT) devices. More specifically for worms, they can replicate and spread to other systems within a network without any user intervention, enabling them to propagate quickly.  What Are the Implications of a Malware Attack? 
 

When a malware attack occurs, its implications can extend beyond the immediate disruption of services or theft of information. These attacks often have far-reaching and severe consequences that affect individuals, businesses, and even national security. Understanding the full spectrum of these implications is crucial for comprehending the true cost of malware and the importance of robust cybersecurity measures. Individuals Malware that has infected individual users’ devices and files may inadvertently spread to their company and infect organisational systems. If the individual brings their infected device to work and connects to the company’s local network, the malware can propagate to other devices on the same network. Using shared drives or collaboration tools to upload or share infected files can also spread malware within the organisation. Businesses Financial impacts are often significant, including potential ransom payments, costly remediation efforts, increased insurance premiums, and revenue losses due to business disruptions. These costs can far exceed the initial ransom demand. Organisations risk permanent loss of sensitive information if they are unable to decrypt their files. Modern attacks often involve double or triple extortion, adding another layer of risk. Reputational damage can be long-lasting, eroding customer and investor trust, potentially leading to lost business opportunities and partnerships. If proprietary information is leaked, their competitors may gain unfair advantages. National security Malware attack implications on a national scale will be more extensive and severe compared to those on an organisational scale. Malware targeting critical infrastructure, such as water supply systems and transportation networks, can lead to widespread disruption of essential services. Attacks on public safety systems, such as emergency response and healthcare networks, can endanger lives and further undermine national security. Malware may also be used by nation-state actors to steal sensitive government and military information for cyber espionage, compromising national security. How to Defend Against Malware Attacks? In view of the dire consequences of malware attacks, it is crucial for organisations to take precautionary measures to bolster their cyber defences. That requires a comprehensive approach that combines technical measures, user education, and robust security practices. Employee Training and Education Organisations should provide ongoing security awareness training to help staff recognise phishing attempts, avoid suspicious downloads, and create strong and unique passwords for all accounts. Multi-factor authentication should also be enabled for staff to prevent unauthorised access. Regular Data Backups and System Updates Implementing multiple backup methods, such as storing data on external hard drives and cloud services, and regular backup schedules protects against data loss from malware attacks and enhances organisational cyber resilience. Regular updating and patching of operating systems, applications, and software is essential to address vulnerabilities that malware could exploit. Prioritising critical security updates and patches will help to seal potential entry points for malware attacks. Usage of Modern Malware Detection Solutions With the prevalence in usage of polymorphic malware and other advanced threats in malware attacks today, traditional signature and rule-based systems are no longer effective in detecting modern elusive malware. Utilising advanced threat detection and response solutions have therefore become even more crucial for organisations to keep up with the threats. This is where Ensign’s advanced AI-powered detection and response solutions (Helios) excels, providing accurate data-driven threat insights for organisations to gain better visibility into impending attacks. Our patented technologies ensure high-fidelity alerts, significantly reducing false positives and streamlining threat prioritisation. Helios also ensures comprehensive threat coverage by being able to detect a wide range of threats including malware, ransomware, phishing, exfiltration, and insider threats. To learn more about how Helios may enhance your organisation’s cyber defences, you may download the Helios factsheet.  Protect Your Organisation from Malware with Ensign Helios Ensign Helios offers a robust, AI-powered cyber analytics solution designed to detect and respond to advanced threats, including malware, with unparalleled accuracy and efficiency. AI-powered threat detection: Leveraging advanced analytics and AI, Ensign Helios identifies and mitigates threats faster and more accurately than traditional methods. Data-driven defence: Integrates seamlessly with your existing cyber systems to establish a data-driven, threat-informed approach against evolving cyber threats. High accuracy and low false positives: Our patented technologies ensure high-fidelity alerts, significantly reducing false positives and streamlining threat prioritisation. Comprehensive threat coverage: Detects a wide range of threats, including ransomware, phishing, exfiltration, and insider threats, ensuring comprehensive protection for your organisation. 
Scalable and customisable: Easily deployed in any environment without the need for agents or sensors, scalable to fit the needs of any organisation. Learn more about the capabilities of Helios.Develop a Comprehensive Incident Response (IR) Plan A comprehensive incident response (IR) plan provides organisations with clear steps to minimise damage, eradicate the malware threat, and recover normal business operations efficiently. Regular testing and updating of the IR plan through tabletop exercises and simulations helps to reveal potential vulnerabilities for malware exploitation which can then be addressed promptly.  Get Expert Support With Ensign’s Incident Response Services Given the rapid and relentless nature of cyberattacks, timely remediation of intrusions is crucial to prevent further damage to critical infrastructure. However, developing a well-defined and comprehensive IR plan may seem complex and daunting without the right expertise. With Ensign’s Digital Forensics and Incident Response (DFIR) services, we go beyond providing remediation solutions in the event of a cyber attack, we also identify the motivation and root causes of the incident to prevent its recurrence. To learn more about our incident response services.

Phishing Attacks: Types, Implications and Prevention What is Phishing? Phishing is a type of social engineering attack where emails, messages, or social media are used to manipulate individuals into compromising their data security. Threat actors often impersonate trusted entities to deceive victims into clicking malicious links or revealing sensitive credentials and personal information. This can lead to a range of cybercrimes, including data theft, identity fraud, and malware infection. Types of Phishing Phishing manifests in different forms, targeting victim demographics ranging from the less technologically literate to cybersecurity professionals. Its tactics vary to exploit numerous vulnerabilities, such as individuals’ lack of cybersecurity awareness, greed for deals, and carelessness in navigating phishing attempts. Traditional phishing often operates at scale, targeting many individuals indiscriminately to benefit from easier implementation, broader reach, and economies of scale. Common types of phishing include: Email phishing: The most common phishing medium involves cybercriminals mass sending fraudulent emails to potential targets. Victims are prompted to click on malicious links, disclose confidential information such as login credentials, or download harmful attachments containing malware. To appear credible to unsuspecting users, attackers may employ fake email domains to impersonate reputable sources such as banks, online services, or established firms—a tactic known as email spoofing. SMS phishing (Smishing): Utilises text messages instead of emails to deceive recipients. SMS messages have the advantage of reaching recipients quickly and directly, bypassing email filters and heightening the urgency of the message. Voice phishing (Vishing): Employs phone calls to manipulate individuals. Attackers use compelling speeches to lower victims’ defences and prove credibility. Skilled attackers adapt their tactics based on victims’ responses during conversations, crafting convincing narratives in real-time to deceive them effectively. Spear phishing: A targeted approach where cyber attackers tailor their attacks to specific individuals within organisations, typically through email. Attackers often conduct sufficient research to gather details such as names, positions, contact details, and project specifics. Using this information, these cybercriminals create emails or messages that appear legitimate and relevant to the target’s responsibilities. These communications often contain links or attachments aimed at stealing sensitive information like login credentials, enabling unauthorised access to systems and data. With this access, attackers can scale their operations or facilitate more precise attacks like Business Email Compromise (BEC) and whale phishing. Business Email Compromise (BEC): Involves cybercriminals impersonating high-level executives or trusted personnel using compromised or spoofed email accounts. They manipulate employees into performing financial transactions, changing payment details, or disclosing sensitive information by falsifying company email messages. Whale phishing: Also known as whaling, this method targets high-profile individuals within organisations such as C-suite executives or other senior officials. Most whaling attacks aim to trick executives into authorising significant financial transfers or disclosing confidential information. What Are the Implications of Phishing? Phishing attacks often serve as the initial entry point for many cyber threats, allowing attackers to infiltrate and exploit vulnerabilities within systems. Examples of these cyberattacks include malware propagation, ransomware attacks, data breaches, and Advanced Persistent Threats (APT). Such incidents can severely disrupt business operations, resulting in data theft, financial losses, loss of stakeholder trust, and other implications depending on the attackers’ motives and the specifics of the incident. How Does Phishing Work: Spot the Signs of Basic Phishing The human element is often the weakest link in an organisation’s cybersecurity defences. Recognising the signs of phishing is crucial for individuals to avoid falling victim to these tactics. Some obvious indicators of phishing attempts include: Unusual requests: Be cautious of requests to reveal sensitive information or transfer funds. Mismatched links and domains: Hover over links in emails to verify the actual URL destination, as it may differ from the displayed text, potentially suggesting a malware infection attempt. Another notable indicator is when the email domain does not correspond with the organisation the sender claims to be from, or the domain contains spelling errors. Suspicious attachments: Malicious files may be disguised as attachments in phishing emails or messages, which lead to malware infections if downloaded or opened. Generic content: Bulk phishing attempts often use generic greetings without specific reference to the recipient’s name or other verification details, such as username or account number. The content of these phishing attempts tends to be reusable for other targets with little or no modifications needed. Use of strong emotions and pressure techniques: Attackers create urgency to pressurise their victims into quick actions and giving away confidential information hastily. Common ways include imposing time limits or threatening consequences for delayed response. Language errors: Phishing emails may contain spelling or grammar errors, unlike communications from legitimate companies that maintain professional standards. Advanced Phishing Attacks Beyond easily identifiable phishing attempts, these attacks have evolved to become more targeted and complex. Advanced phishing attacks employ strategic methods to deceive potential victims and circumvent traditional security measures, posing challenges even for cybersecurity experts. Adversary-in-the-Middle (AiTM) Phishing: AiTM phishing aims to acquire unauthorised access through interrupting the traffic between the victim and the login page of the target website. There are two methods that AiTM phishing may employ: Reverse proxy method: Upon clicking on the malicious link in phishing emails or messages, victims are routed to a proxy server that exists between the victim and the actual website. While information is relayed across the proxy when the victim is logging into the website, attackers intercept to collect sensitive credentials and session cookies. With this data, attackers can bypass multi-factor authentication (MFA) and impersonate the victim on the website or application. Indirect proxy method: This method involves attackers setting up a phishing website instead of a proxy server. It gives attackers the flexibility to customise the page to align with their attack objectives. These fake websites replicate legitimate ones using malicious URLs that seem authentic. AiTM phishing often escalates into a BEC attack when the attackers use the acquired information to impersonate the victim and manipulate other parties into making fraudulent transactions via email. This unauthorised access allows attackers to conduct various malicious activities, including data theft and malware deployment. Homoglyph Attack Homoglyphs are characters that seem similar and are used to create malicious email domains or URLs that appear legitimate. For instance, the letter “I” and lowercase letter “L” may look similar in some fonts, deceiving users of their malicious intent. An example of a homoglyph is shown below: Invisible Ink Phishing 
 

The invisible ink technique involves embedding invisible characters into emails, links, or documents using methods like Cascading Style Sheets (CSS) and HyperText Markup Language (HTML). Attackers may use characters such as soft hyphens, zero-width joiners, or text with zero font size. While users see and read one set of content, Secure Email Gateways (SEG) detect the hidden text, interpreting the context differently and therefore allowing the email through. The example below demonstrates how an invisible ink phishing attempt using soft hyphens can bypass SEG and other detection tools, allowing the phishing email to reach the victim’s inbox. Typosquatting Typosquatting is used in phishing attacks to make fraudulent websites appear credible and trustworthy. Malicious actors create fake websites designed to look like legitimate ones, exploiting common typographical errors in the web address. For example, using “amzon” instead of “amazon” or “dbss” instead of “dbs.” Users who land on these counterfeit sites due to a misspelling in the URL may disclose their credentials while making transactions. Artificial Intelligence (AI) Powered Phishing AI has transformed phishing attacks by automating the process and enabling easy scalability. AI and large language models can quickly generate highly personalised and persuasive phishing emails or messages using publicly available information about targets. This eliminates the need for manual research by attackers. Additionally, deepfake phishing technology, powered by AI, further blurs the line between legitimate and fraudulent communications, making it increasingly difficult for users to discern between the two. As phishing attacks become more convincing and cost-effective, their frequency and success rates will rise. How to Defend Against Phishing Attacks Avoiding phishing attacks is essential for individuals and companies to safeguard themselves from potential threats. Here are some approaches companies can take: Employee Awareness and Training Organisations should educate employees on cybersecurity best practices, such as verifying the legitimacy of sources before sharing classified information and handling spam emails with caution. It is also highly recommended that organisations reinforce awareness of phishing threats by conducting simulated phishing exercises. Use Multifactor Authentication (MFA) MFA enhances login security by requiring additional verification beyond passwords. This added security mitigates the risk of unauthorised access, even if passwords are stolen. Implement Domain-based Message Authentication, Reporting, and Conformance (DMARC) DMARC, designed to combat email spoofing, allows domain owners to define how emails should be authenticated and specify actions for emails that fail these checks. This helps protect individuals and companies from fraudulent emails that falsely claim to be from trusted domains. DMARC can be complemented with AI-based email filtering services that detect and block malicious emails from reaching users’ inboxes. Establish Endpoint Security Measures Endpoints are vulnerable to phishing attacks. Organisations should strengthen their endpoint defences through measures such as: Endpoint Detection and Response (EDR) Solutions: Identify phishing attempts and automate necessary responses when attacks are detected. Unified Endpoint Management (UEM): Further strengthen this defence by centrally administering security configurations and ensuring software updates across all devices, including managing email filtering and phishing protection settings. Anti-phishing Software: Employed directly on endpoints to enhance protection through features such as scanning and filtering emails and blocking malicious links or attachments. Ensign’s Patented Anti-phishing Suite While standard cybersecurity protocols and measures provide organisations with a layer of protection against phishing attacks, they may prove ineffective against skilful phishing attackers. We recognise the evolving tactics of these advanced deceptions and continuously innovate to stay ahead of the threat actors. Our Phishing and Deepfake Detection solution, designed by Ensign Labs, deploys our patented phishing detection suite to effectively detect phishing domains. The system comprises four modules: Homoglyph Phishing-Domain Detection Module Typo-squatting Phishing-Domain Detection Module General Phishing-Domain Detection Module Alert Module This innovation boasts an exceptional detection rate exceeding 95% for zero-day phishing attacks and campaigns. In addition to our detection capabilities, we offer our clients insights into possible targeted Internet Protocols (IP) addresses within their organisation and provide up-to-date insights on the advancement of phishing attacks. 

Ransomware Explained: Types, Impacts and Prevention Strategies What is Ransomware? Ransomware is a type of malicious software (malware) that blocks a victim’s access to data or a computer system, usually by encrypting it, until the victim pays a ransom fee to the attacker. Attackers often promise to restore the data if the ransom is paid, but these days, victims cannot be sure about this assurance, as the risk of data being destroyed or leaked remains. Types of Ransomware Ransomware can be categorised into two main types: those that use encryption (crypto ransomware) and those that do not (locker ransomware). Crypto Ransomware This is the most common type of ransomware, where attackers lock their victims’ files via encryption, until the ransom is paid. Victims are often coerced into paying the ransom as only the attackers hold the decryption key needed to regain access to the files and data. Regardless of whether they pay the ransom, businesses are highly likely to face business disruptions and the risk of their data being sold on the dark web. Doxware, also known as extortionware, adds a particularly insidious dimension to crypto ransomware. It not only encrypts victims’ data but also steals personal information like emails, photos, and other records. Attackers will threaten to release sensitive data to the public unless the ransom payments are made. Doxware attacks are often highly targeted, with attackers conducting preliminary surveillance to identify potential data targets and system weaknesses of specific victims. As a sidenote, crypto ransomware shouldn’t be confused with crypto malware (cryptojacking) where the latter enables threat actors to mine cryptocurrencies from the victim’s devices. Locker Ransomware Locker ransomware, or lockers, does not encrypt files. Rather, it locks victims out of their device or system. Lockers can work in various ways, such as disabling the mouse and keyboard, or displaying a persistent window that blocks other applications until the ransom payment is made. Users will be provided with instructions on how to make the ransom payments in exchange for regaining access to their devices or systems. How Does Ransomware Infect Users? Ransomware originates from various vectors that take advantage of human susceptibilities, exploit weak credentials, and leverage technological weaknesses. Some common vectors by which ransomware can infect users include: Social Engineering Attacks Social engineering is the psychological manipulation of people into performing actions or divulging confidential information for information gathering, fraud, or system access. These manipulation tactics exploit victims’ sense of security by establishing rapport and trust. Social engineering attacks can come in various forms:  Phishing: Phishing involves sending fraudulent communications that appear to be from trusted sources to trick victims into revealing personal information, such as login credentials. These communications can come through email, text messages (smishing), or voice messages (vishing), leading victims to malware-infected sites or fake websites. It is a common method for initiating ransomware attacks, exploiting users’ susceptibility to social engineering tactics. Baiting: The attacker baits victims by leaving physical media such as USB drives with enticing labels. Victims that insert such media into their devices or systems will be infected with malware.  Scareware: Scareware are fake security alerts or warnings used to cause fear and panic, prompting victims to install malware that are disguised as security software or paying for false services. Operating System and Software Vulnerabilities Cyber attackers often exploit flaws and weaknesses in the code or design of an operating system or application software to gain unauthorised access and conduct malicious activities. Zero-day vulnerabilities are one such example. They refer to inherent flaws or weaknesses in a computer system that are unknown to the developers, hence having zero days to address the vulnerability before it is exploited. Drive-by Downloads They are a type of malware that is unintentionally downloaded onto a computer or mobile device without the user's knowledge or consent. Victims typically encounter drive-by downloads by visiting an infected website or downloading infected files, some of which are ransomware. Since drive-by downloads can be triggered without needing users to click on anything to initiate the download, it is able to infect systems and spread easily among unsuspecting users. Stolen Credentials Attackers take advantage of weak passwords to steal credentials, which they can use to infiltrate networks or devices and deploy ransomware. Additionally, they may sell the stolen credentials on the dark web, allowing other cybercriminals to exploit the same vulnerabilities. Ransomware can also propagate laterally and infect multiple devices by using techniques such as pass-the-hash to impersonate legitimate users. Some advanced ransomware strains maliciously utilise legitimate network administration tools like remote desktop protocol (RDP), PowerShell scripts, or group policy objects to spread further. Ransomware-as-a-Service (RaaS) Inspired by the Software-as-a-Service (SaaS) business model, the low barrier to entry of RaaS has contributed to its proliferation in the cybercrime space. Ransomware tool kits are developed by operators and sold to other hackers or affiliates, who then use these tools to launch attacks on victims. This model allows affiliates with no technical expertise to participate in ransomware attacks, making it easier for new cybercriminals to carry out their attacks. In the RaaS model, specialised operators develop ransomware tool kits and maintain the back-end infrastructure. These kits are then sold to affiliates, who may lack technical expertise but can still effectively launch attacks. This division of labour increases efficiency and reach, as affiliates focus on infiltrating networks and deploying the malware.The accessibility of RaaS is further enhanced by its user-friendly features, including customer support and regular updates. This makes it easier for new cybercriminals to participate in ransomware attacks, expanding the pool of potential attackers.Financially, RaaS operates on a profit-sharing model. Affiliates typically receive a significant portion of the collected ransom, creating a strong incentive for widespread and aggressive attacks. This arrangement has not only increased the frequency of ransomware incidents but has also driven up their sophistication and effectiveness. What Is a Double- Or Triple-Extortion? The evolution of ransomware attacks also saw the development of more sophisticated tactics to pressure victims into paying. This has led to the emergence of double- and triple-extortion techniques. Double-extortion ransomware attacks involve two layers of threat: Traditional data encryption: Attackers encrypt the victim’s files, making them inaccessible. Data theft and leak threat: Before encryption, criminals steal sensitive data and threaten to publish or sell it if the ransom isn’t paid. This approach puts additional pressure on victims, because even if they can restore their data from backups, they still risk having sensitive information exposed.  Triple-extortion takes this a step further by adding a third layer of additional coercive pressure, which may include: Threatening to notify the victim’s customers, partners, or media about the breach. Launching DDoS (Distributed Denial of Service) attacks on the victim’s infrastructure. Directly threatening the victim’s business partners or customers. Using stolen data for further attacks or fraud. These multi-layered extortion techniques make ransomware attacks more damaging and complex. They target not just data availability, but also its confidentiality and the broader reputation and operations of the victim organisation. As a result, victims face increased pressure to pay the ransom, even if they have robust backup systems in place. What Are the Implications of a Ransomware Attack? Ransomware attacks often have severe consequences for businesses, affecting them financially, operationally, and reputationally: Financial impacts are often significant, including potential ransom payments, costly remediation efforts, increased insurance premiums, and revenue losses due to business disruptions. These costs can far exceed the initial ransom demand.  Organisations risk permanent loss of sensitive information if they are unable to decrypt their files. Modern attacks often involve double or triple extortion, adding another layer of risk. Reputational damage can be long-lasting, eroding customer and investor trust, potentially leading to lost business opportunities and partnerships. If proprietary information is leaked, their competitors may gain unfair advantages. Most attacks cause significant operational disruptions lasting anywhere from 7 to 21 days on average. This downtime often results in substantial productivity losses and can be more costly than the ransom itself.  How Can You Defend Against Ransomware? Secure Network Access Points Start by securing your network access points, particularly by reviewing and limiting open ports. Pay special attention to Remote Desktop Protocol (RDP) and Server Message Block (SMB) ports, as these are common entry points for attackers. This not only fortifies your network security but also helps prevent unauthorised access and discourages drive-by download attacks on unsuspecting users.  Implement Comprehensive Cybersecurity Software Cybersecurity software forms another vital layer of defence. Deploy robust anti-virus programs to detect and prevent malware infections and utilise intrusion detection systems (IDS) to monitor network traffic for suspicious activities. Content filters can also play a crucial role by blocking access to malicious websites and downloads. Scan, Update and Patch Regularly Regular scanning, updating, and patching are essential for maintaining a robust defence against ransomware. Pay special attention to critical security updates and patches and prioritise their installation. This proactive approach helps close potential entry points for ransomware and other malicious software. Education Organisations can transform their workforce into a vigilant first line of defence by fostering a security-conscious culture. Regular training sessions equip users with the skills to spot phishing attempts, avoid suspicious downloads, and create strong passwords. Simulated attacks reinforce these lessons, while encouraging prompt reporting of potential threats keeps everyone engaged in the ongoing battle against cybercrime. Maintain Backups Implementing a robust backup strategy that includes off-site storage and frequent updates, and regularly testing these backups to ensure data integrity provides a safety net in case of a successful attack. It also strengthens an organisation’s overall resilience, reducing the temptation to pay ransoms and enabling quicker restoration of normal operations Develop a Comprehensive Incident Response (IR) Plan A comprehensive incident response plan can provide a clear guideline to help organisations to identify, contain and eradicate threats fast. Organisations should also test and update the IR plan through tabletop exercises and simulations to identify gaps or areas for improvement. Having a good IR plan will strengthen the organisational cyber infrastructure and preparedness for a ransomware attack. Check out Ensign’s Incident Response Retainer Packages.Get External Support While antivirus software and vulnerability scans can help prevent ransomware attacks, external cybersecurity expertise can significantly bolster an organisation’s efforts in ransomware prevention and response. These specialists bring a wealth of experience and knowledge, and can offer critical guidance and support, especially during crises. They serve as a point of contact every step of the journey, from threat detection to forming a comprehensive incident response plan to prevent the next attack.  Mitigate Ransomware Risks With Ensign Ransomware attacks can cripple businesses, leaving them with the agonising choice of paying a ransom or facing devastating downtime and data loss. Even the most prepared organisations can struggle to navigate the technical complexities and high-pressure decision-making of a ransomware incident. Ensign’s ransomware response expertise goes beyond decryption. We offer comprehensive guidance, including threat analysis, negotiation tactics, and post-incident remediation to help organisations recover swiftly and minimise damage. Click to find out more about our anti-ransomware suite.

Charles Ng Chief Executive Officer Kok Leong Chan Head of SI Engineering Zong Fu Chua Head of Managed Security Services Gaurav Keerthi Head of Advisory and Emerging Business Minhan Lim Head of Consulting Steven Ng Chief Information Officer Diana Tan Chief Legal Officer and Head of Corporate Functions Paul Tan Head of Systems Integration Ah Tuan Tan Head of Ensign Labs Lee Fook Sun Chairman Yap Chee Keong Director Teo Ek Tor Director Yeoh Keat Chuan Director Nikhil Eapen
Director Rashmy Chatterjee Director Chia Choon Hwee Dennis Director Hoo Chuan Wei Alternate Director

Search