Castellum Labs

And, we have 25,000 followers of our LinkedIn page. Thanks to each & everyone of our supporters & page followers !! This year, we will bring exceptional updates, Deep tech content and strategic articles to our page, everyday ... Keep checking, keep following. https://lnkd.in/fSWrmMs #25k #followers

As per World Economic Forums 2025 risk report .. 66% of CISOs think that AI will pose the biggest risk !! Following is the state of the AI adoption, 1. Pilot adoptions are done without approvals & controls 2. No process exists for security review, before AI dev starts 3. Limited tools & controls are exerted post adoption of AI/LLMs What is your strategy on securing your organization, while your company makes a full shift to AI driven digital transformation ? Talk to us ... Ph - 8639953505 | e-Mail - reach@castellumlabs.com #aisecurity #ai #cybersecurity

One Nation, One People, One Direction Many Colors, Many Names, Many Joys !! Happy Makar Sankranti Happy Pongal Happy Bihu To ALL Celebrate the rainbow, all of us have been gifted. Celebrate India, in its truest form, "Diverse Yet One" #makarsankranti #bhogi #bihu #pongal

नमस्तेऽस्तु महामाये श्रीपीठे सुरपूजिते। शङ्खचक्रगदाहस्ते महालक्ष्मि नमोऽस्तु ते॥ जो महामाया है, सभी वैभव का आधार है, जो देवताओं द्वारा पूजित है, (महालक्ष्मी) आपको नमन है। जिसके हाथों में शंख, चक्र और गदा हैं। हे महालक्ष्मी, तुम्हे नमन है। The illusory power of the universe and the basis for all wealth, & worshipped by deities, Salutations to you (Mahālakṣmī). who has a conch, discus, and mace in hand. Oh Mahālakṣmī, obeisances to you ! शुभ दीपावली आप सभी को !! Happy Deepawali to All of You !! reach@castellumlabs.com | 8639953505 #deepawali #diwali #2024 #happydiwali

Darkweb is key to knowing your threats !! External threat sources, infra & assets is key to defense .. Finding out stolen data is key to course correction of your cyber ... Do you have partner, - Which goes beyond keyword searches on Darkweb? - Can tell you not just a list of things, but precise actions? - Will present to you not just intel data, but attack probability? Our Darkweb Services, 1. Are powered by our own advance technology 2. Use counter intelligence as one of the key model 3. Enable powerful threat hunting for you, in your SOC reach@castellumlabs.com | 8639953505 #darkweb #darkwebmonitoring #threaintel

Vulnerabilities, if not enriched with intelligence and a valid score, Job is still half done, half baked and detection does not mean much. A model which works well, to allocate a risk score to a vuln is not a formulae driven model, to come up with a number. It is a must have, for prioritization and valid treatment of vulnerability. Vulnerability life cycle management should have risk score, as one big most influential criterion. Risk scoring, is where most of the companies do not do good job. This is a sample of how risk scoring for a given vulnerability can be done. It is a representative only. Every org must have one for themselves. To know more about how we treat a vuln, when we do VAPT for you reach@castellumlabs.com | 8639953505 #vulnerabilitymanagement #cyberrisk #riskscore

VAPT is not the same as Red Teaming. Red Teaming is not the same as Attack Simulation. Attack simulation has nothing to do with VAPT cycles. A confusion on the nature of these exercise, causes challenges .. 1. Not being clear on what to expect from project 2. Not provisioning enough budget for project 3. Selecting an unfit vendor partner This grid captures a basic comparative between A. VAPT B. Offensive Security C. Red Teaming D. Attack Simulation reach@castellumlabs.com | 8639953505 #redteaming #vapt #offensivesecurity #attacksimulation

Incident Response is the place, where most of the mistakes take place. Almost all the times, incident is not as damaging, as these mistakes. In a six step incident response model, lets talk about Step 1, Triage When an alert is categorized as incident, one of the first things to do, is to conduct a triage for the incident. Without triaging, your team members & stakeholders will not come on the same page. 1. Get clear representation of the incident from monitoring team 2. Get all stakeholders/participants to agree on severity 3. Define communication extent for the incident 4. Get containment going on parallel track 5. Decide about escalation needs A well done triage, eases the rest of the response path. Lack of triage, mostly results into botched up response process. Do you have a triage done, in the event of incident ? Things to remember ... A. Incident response process is separate from monitoring B. It should be in control of your organization, not a provider C. A document on incident management, does not mean response D. Activated incident response process needs design & training E. Regular incident exercises (simulations) help responses #mdr #incidentresponse #cyberincident #cyber

GRC today has two wide gaps ... 1. It is done in isolation of the security operations 2. A lot of it is manual, with tracking in sheets For GRC to transform, from a mere routine exercise or a hygiene A. Process changes/adoption need to be in conjunction with ops B. Risk data needs to roll back into security operations C. Threat intelligence needs to play a crucial role in risk D. Data gathering from systems needs to be fully automated E. Controls evaluation need to have automated support model Enterprises need to spend significant sums on replacing age old manual GRC practices, with new age model based on above 5 points ... GRC needs to be seen as robust support to security operations Not, a necessary burden which need to be carried by org #castellumlabs #grc #automation #strategy

Defining security strategy around potential attack vectors .. 7 points ! 1. Can you detect attack stage/event at all layers? 2. Do you have strong defense against all attack events? 3. Will it be possible to respond in time, if event is detected? 4. Do you have all defenses mapped to controls for each layer? 5. Can you apply intelligence to detection tech/model? 6. Have you tested all defenses against all scenarios? 7. Is security operation, prioritized on scenarios? MITRE is one of the best thing to happen to cyber security. Unfortunately, most places, it is still only an academic reference. Define a cyber security strategy, creating security ops model, running all security processes, around MITRE can create a very resilient org ... Is your cysec strategy designed around MITRE? Do you have MITRE adopted, beyond monitoring metrics? Are you using MITRE for its full potential, across cysec functions? reach@castellumlabs.com | 8639953505 #mitre #cybersecurity