Monday Cyber Ops sync

Person #45: So, can you hear me okay? I think my mic was acting up. Hello? Person #36: Yes, we hear you. Let's start. It's 11:02. We have the usual agenda, but I want to keep it tight today. Cyber ops update, threat intel, pen testing priorities, and the SOC tooling contract. Let's go around. Threat intel first. Saadat, please. Person #38: Yes, thank you. From a threat perspective, the last ten days have been relatively stable, but we've seen a spike in phishing campaigns targeting the education sector—ADEK and the universities, specifically. We've flagged three domains that are impersonating the Abu Dhabi School of Government's login portal, and we've already coordinated with GovDigital to have them taken down. One of them was still live as of this morning, actually. We're monitoring. Person #36: Exposure? How many users clicked? Person #38: The data we have from the proxy logs suggests about forty-one unique users entered credentials before the takedown. We've notified the affected entities, and we're doing a forced password reset on the ADSG accounts. But the issue is, some of those users are on personal devices, so we can't guarantee full containment. Person #36: Forty-one is not negligible. Make sure the entities report back. I want confirmation by end of week. Next, pen testing. Person #44: Yeah, so, we've got the quarterly TAMM assessment done. We submitted the report last Tuesday, ya3ni, the full thing. There's one critical that I want to highlight: the new journey for the commercial license renewal, the one they launched at GITEX, the auth flow is leaking the session token in the URL. It's a simple fix, but the developer team at TAMM has been non-responsive. The remediation deadline was Friday. Person #45: Yeah, the token appears in the referrer header too, actually. So, basically, if you share the URL on Slack or whatever, the token is sitting right there. It's not even a complicated exploit. I wrote a PoC in like twenty minutes. It's all in the report, section 2.1. Person #36: Who owns it on their side? Person #44: The TAMM platform team, but the lead, he's been on leave since Thursday. And his backup doesn't seem to know we exist. I've sent two emails and a ping on the channel. Nothing. Person #36: Fine. I'll raise it at the executive meeting tomorrow. What about the second finding—the one on the entity portals? Person #44: That's a medium. The file upload on the DMT portal doesn't sanitize the filename properly. It's not exploitable in a practical sense without other conditions, but it's sloppy. And the third one is a low on the DoH app, something about the error messages exposing stack traces. I'm not going to lose sleep over it. Person #45: The DMT one is interesting though, because it's the same pattern we saw in the ADEK portal last cycle. So maybe it's a shared component. I was looking at the code, it's like, the same library being used across three or four entities. So— Person #38: From a threat perspective, that's worth noting. If it's a common dependency, then fixing it once could solve multiple instances. The other entities might be exposed even if we haven't tested them yet. Person #36: Good observation. Put that in a separate note for the enterprise architecture team. I don't want it lost in the pen test report. Now, the SOC tooling contract. Where do we stand? Person #44: That's the thing. The renewal was due on Friday. We sent the signed PDF to the vendor on Wednesday, and then they came back and said the pricing table in the appendix doesn't match the one in the original RFP. So they're asking for a re-issue. I forwarded it to procurement, but I don't think anyone's looked at it yet. Person #36: The pricing table. We went through that in the last meeting. The original RFP had the license count at one thousand two hundred endpoints. The vendor is claiming we added three hundred more in the appendix. Person #45: I mean, we did, technically. We added the new endpoints from the TAMM 4.0 rollout. But I thought that was already agreed upon. There was an email from the ADDA side, I think, or maybe it was the GovDigital team, confirming the addition. I can dig it up. Person #36: I don't want a "I think". I need confirmation. If we added endpoints, we need to pay for them. That's fine. But I don't want a contract that's held hostage because someone forgot to update a spreadsheet. Who's the vendor contact? Person #44: The usual guy, the account manager. He's been pretty responsive, but he's also on leave next week. So if we don't get this sorted by Thursday, it's going to slide into the middle of September, and we'll be running on an expired contract. Which, from a governance perspective, is not ideal. Person #36: It's not ideal, it's a problem. We have no coverage if something happens and we're out of contract. What's the exposure in the gap? We're talking about the SOC, the monitoring, the threat hunting, the whole thing. If the vendor pulls support, we're blind. Person #38: Well, we have the internal tools, and the incident response retainer with the Indian vendor. So we're not completely without support. But the SIEM monitoring would be degraded, and we'd lose the threat intel feed integration. That's a significant gap from a threat perspective. Person #36: Exactly. So let's not have a gap. I'll call the procurement director this afternoon. But I need someone to own the document fix. Who can do that? Person #45: I can. I'll get the correct pricing table from the original RFP, cross-reference it with the TAMM 4.0 addition, and send it to the vendor for confirmation. But I need the authority to communicate directly with them. Otherwise, I'll have to go through procurement, and that's a two-day loop. Person #44: I've already got the correspondence. I'll send it to you after this call. The vendor's email is in there. You can reply all and copy me. That should be fine. Person #36: Good. Do it today. I don't want this dragging past Wednesday. What else? Anything from the entities side? Any complaints or issues? Person #38: We had a report from the Department of Finance about unusual traffic from a third-party contractor. It turned out to be a misconfigured backup script, but the entity was quite concerned. We've given them guidance on tightening their network segmentation. It's not a major issue, but it's worth noting for the awareness program. Person #45: Also, the bug bounty thing, we're still waiting on the legal approval. I know we discussed it last month, but I think it's stuck in the review process at the Department of Justice. Or maybe it's with the legal team here. I'm not sure which layer is holding it up. Person #36: That's been stuck for two months. I'm not chasing that today. We have bigger fish. The SOC contract is the priority. So, on the contract, what's the actual timeline if we don't fix it by Thursday? Does the vendor just stop? Or is there a grace period? Person #44: Based on the terms, there's a thirty-day grace period. But the problem is, if we're not in a signed contract by then, the vendor can negotiate new terms. And their standard rate is about fifteen percent higher. So the longer we wait, the more it's going to cost us. Person #36: Fifteen percent. That's not small. For a contract this size, that's—what—the numbers, yaar? Person #45: The contract value is somewhere around four million eight hundred thousand for the year. Fifteen percent is roughly seven hundred and twenty thousand dirhams. So, yeah, it's not trivial. Person #36: Seven hundred and twenty thousand. Okay. So this is not just an administrative annoyance. This is a real cost if we don't act. I'll make the call to procurement today. But I want you two to get the document fixed and send it to the vendor by close of business. Is that clear? Person #44: Yes. I'll draft the corrected appendix and send it to you for review before we send anything out. Maybe by two o'clock. Person #36: Fine. Now, moving on. Anything else from the threat side? Any new tools or tactics we should be thinking about? Person #38: We're seeing more usage of QR code phishing. It's been a trend globally, and we've seen a few attempts in the region. The problem is our email gateway doesn't catch it, because there's no URL to scan. We've had two cases in the last month where employees scanned a QR code from what looked like a legitimate notice, and it led to a credential harvesting page. We've done awareness sessions, but I think we need to think about a more technical solution. Maybe something in the mobile device management or the browser isolation layer. Person #36: That's a nice idea in theory, but we're not going to deploy new tools right now. The focus is on the contract and the existing infrastructure. We can note it for the strategy review next month. Person #45: I can write a quick script that detects QR codes in image attachments and blocks them. It's not too hard. We already have something similar for malware detection. I could have it ready for testing in a week. Person #44: The detection part is easy. The hard part is deciding what to do with false positives. If you block every image with a QR code, you're going to break legitimate business processes. Like, half the office uses QR codes for the internal cafeteria menu. So, it's not a straightforward solution. Person #36: We don't have time for that today. Note it for later. Anything else? Let's go back to the pen test results. The critical on the TAMM journey—how long did it take you to find it? I want to understand if this is a systemic issue or just a one-off mistake by the developer. Person #44: It took me about an hour to find. The token was in the URL, which is a classic mistake. It's not systemic, but it's a recurring pattern. We saw the same thing in the Health Authority portal last year. I think it's a training issue. The developers who work on the integration layer don't always understand the security implications of how the session is managed. Person #45: To be fair, the TAMM team has a lot of pressure to ship fast. The GITEX demo was a big deal, and they probably cut corners to meet the deadline. Not excusing it, but that's probably what happened. Person #36: I don't care why it happened. I care about the fix. So, the remediation is simple, right? Move the token to the header and update the server-side validation. That's it? Or is there more? Person #44: That's the core of it. But we also need to make sure the existing tokens are invalidated, and that the session timeout is properly enforced. I've put all of that in the report. It's a day of work for their team, maybe two. It's not a huge lift. Person #36: Then why hasn't it been done? They had the report on Tuesday. It's Monday. That's four business days. The deadline was Friday. I'm going to have to raise this at the executive meeting. I don't like going to the execs with unresolved criticals. Person #45: I can draft a quick summary for you to share. Like, a one-page thing that explains the risk and the fix. That way, you don't have to read the whole report. It's, like, fifty pages, and most of it is appendix. Person #36: Do that. Send it to me by tonight. I'll review it in the morning. Person #38: From a threat perspective, I'd also suggest we highlight the fact that this is a public-facing service. The exposure is not just to internal users, but to anyone with an internet connection. That might make the case more compelling at the executive level. Person #36: Good point. Include that in the summary. Now, let me ask—do we have any update on the red team exercise that was planned for September? I haven't seen anything since the last sync. Person #44: It's scheduled for the second week. The scope is the same as before: TAMM, the HR portal, and the finance system. But we're waiting on the go-ahead from the Data Office. They've been slow to approve the test accounts. I've pinged them twice. I'm not sure what the holdup is. Person #45: I think it's the new data classification policy. The Data Office is being extra cautious because of the merger. They want to make sure that test data doesn't accidentally touch any of the migrated systems. I've had a couple of calls with their team, and they're, like, very risk-averse right now. Person #36: The merger was two years ago. We can't keep using that as an excuse. I'll talk to the Data Office director after the procurement call. We need to get this moving. The red team exercise is a key part of our year-end assessment. Person #38: It's also a good opportunity to test the new SOC playbooks. We've updated a few of them based on last quarter's incidents, but we haven't had a chance to exercise them in a live scenario. The red team exercise would be a perfect test. Person #36: Right. So, priorities for this week: one, fix the contract—non-negotiable. Two, get the TAMM critical remediated. Three, unblock the red team exercise. Four, follow up on the phishing campaign. Anything else? What about the hiring? We're still short two analysts in the SOC, correct? Person #38: Yes. We've shortlisted some candidates, and the interviews are scheduled for Thursday. But we're having trouble finding people with the right certifications. The job market is competitive, and we're losing candidates to the private sector. The salary band is not quite where it needs to be. Person #36: The salary band is set by the HR Law. I'm not going to reopen that. But if you find a good candidate, let me know, and I'll see if we can push the hiring through faster. The processing time is the bottleneck. Person #44: We could also look at the Mawaheb program. I know they work with the cyber academy, and they might have some fresh graduates who are ready to start. It's not ideal to hire juniors, but better than being understaffed. Person #36: I'll keep that in mind. I don't want to compromise on quality, but we need bodies in the SOC. Okay. I think we're done. Let's do a quick round-robin on any blockers or anything else I missed. Person #45: Can I just say one thing? On the automation of the pen test pipeline—I've been working on a demo that integrates our scanner with the ticketing system. It automatically creates a ticket for each finding, with the severity and the remediation steps. I think it could save us a lot of time. It's, like, a proof of concept, but it works. I can show it to you later if you want. Person #36: Nice in theory, but we have enough on our plate. Put it in the backlog. I don't want to be running a pilot while the main contract is unresolved. Person #44: For what it's worth, I've seen the demo, and it's actually decent. But I agree, this isn't the week for it. Person #38: I'll send out a summary of the phishing campaign analysis this afternoon. Also, if anyone has any thoughts on the awareness program for October—cybersecurity awareness month—I'd like to start planning soon. We need to get the materials approved by the communications team, and that usually takes a while. Person #36: We can discuss that in two weeks. Right now, the contract is the only thing that matters. So, on the contract, you'll have the corrected appendix by two o'clock. I'll call procurement at three. And we'll do a quick check-in tomorrow at the same time. Any objections? Person #44: Not from me. Person #45: I'm good. Person #38: No objections. I'll be here. Person #36: Good. Last point—the TAMM summary. Send it to me tonight. And let's make sure we're not sitting on a critical next week. Yeah, that's it. Let's get it done. Person #44: Actually, wait. I want to clarify something about the vendor contract. The pricing table—are we sure it's only the endpoint count that's the issue? Because I had a look at the original RFP, and I noticed the maintenance rate is listed as a flat fee. But the vendor is now asking for a percentage-based rate, which would increase the cost by another eight percent. So, even if we fix the endpoints, we might have a second issue. Person #36: Eight percent? That's another—what's that in numbers? Person #45: About three hundred and eighty thousand. So, combined, we're looking at over a million if we don't get this right. Person #36: A million. Okay. This is getting more serious. Who flagged this change? Was it in the vendor's email? Person #44: It wasn't in the email. I noticed it when I was reviewing the contract draft. The original RFP said "flat fee," but the renewal draft says "percentage of the contract value." It could be a copy-paste error, but I doubt it. The vendor knows what they're doing. Person #36: So, we have two issues now. The endpoint count and the maintenance rate. I'm not going to call procurement until I have the full picture. Can you draft a comparison of the original terms and the renewal terms? I want to see all the changes, not just the ones we've found. Person #45: That's actually a good idea. I'll pull the original RFP, the signed contract from last year, and the renewal draft. I'll mark up the differences. Might take me a couple of hours, but I can have it by end of day. Person #36: Do it. Send it to me and to the procurement director. I don't want any surprises in the meeting tomorrow. Is there anything else that's changed in the renewal that we should know about? Person #44: Not that I've seen. But I'll do a line-by-line review with the mark-up. If there's anything else, I'll flag it in the document. Person #38: From a threat perspective, I'd also suggest we check the service level agreement. I recall the original SLA had a response time of fifteen minutes for critical incidents. If the renewal has changed that, we need to know. It could affect our own reporting to the Executive Council. Person #36: Good catch. Include that in the mark-up as well. So, revised plan: get the comparison document by end of day. We'll have a call with procurement tomorrow at ten. And the fix for the TAMM critical—that still needs to happen. Don't let that slip while we're dealing with the contract. Person #45: I'll take care of it. I'll also send the TAMM summary tonight. So you'll have two emails from me. Is that okay? Person #36: Fine. Anything else? No? Okay. Let's get moving. I'll talk to the Data Office after the procurement call. And I'll talk to the TAMM team directly about the critical. They might listen better if I'm the one asking. Person #44: Good luck with that. They're pretty defensive. But if you mention that it's going to the Executive Council, they'll snap into shape. Person #36: Noted. That's it for today. We're done. I'll see you tomorrow at ten. Person #45: Uh, before we go—quick one. The TAMM critical, the auth flow one. I said I'd send the summary tonight, but the actual fix, we're waiting on the entity's dev team to deploy. They said Wednesday. If they slip again, it's not on me, I just want that on record. Person #44: It's always Wednesday with them. Last month it was "Monday for sure." I've got the evidence trail if we need it. Person #36: Keep the evidence. I'll mention it when I talk to them directly. If they push back, I have the report and the dates. Anything else? Person #38: Just one small thing, on the SLA point—the original had a fifteen-minute response for critical, but I think there was also a clause about monthly uptime reporting. If that's dropped in the renewal, we lose visibility. It's worth checking. Person #36: Add it to the mark-up. Every clause changed, every clause dropped, I want it in that document. Person #45: Yep, got it. I'll be careful with the tables, make it readable. Not just a wall of text. Person #44: And I'll sanity-check it before you send. Two sets of eyes on the contract stuff. Person #36: Good. That's the plan. Unless there's something urgent, we're done here. Person #38: Actually, one more thing, and I'm sorry for bringing it up at the last minute. The vendor's threat intel feed renewal, it's bundled into the same contract, right? I just want to make sure we're not losing the daily briefings. They were a bit spotty in July. Person #36: Same contract, yes. But if it's in the mark-up, we'll see if they changed the delivery frequency. If they did, we'll push back. That's part of the full picture. Person #38: Perfect, thank you. That's all from me. Person #45: Okay, so I'll send the TAMM summary tonight around eight, and the contract mark-up by end of day tomorrow. Wait, no—you said end of day today for the mark-up. So, TAMM summary tonight, mark-up tonight, too. Two emails. Got it. Person #36: Two emails, before midnight. Don't make me chase you. Person #45: Wallah, you won't have to. I'll set a reminder now. Person #44: [chuckles] He says that every time. Person #45: And I deliver every time. Mostly. Just let me send it. Person #36: Enough. Good work today. The contract is the priority. TAMM is the priority. Everything else can wait. I'll see you tomorrow at ten, procurement meeting, and we'll go from there. Inshallah, it goes smoothly. Person #44: Inshallah. See you then. Person #38: Thank you, everyone. Bye. Person #45: Bye boss, take care.