What is a PowerShell Profile?

There is so much information to provide on PowerShell profiles that really a blog post dedicated to this question would be better, and is something I will probably do. For now however here is a shorter more basic answer. A PowerShell Profile is a PowerShell script that runs when you open either the PowerShell console or the PowerShell ISE. As your PowerShell profile is a PowerShell script you need to define your script execution policy. There are actually 6 PowerShell profiles which are easiest to explain as a table. For reference "current user" refers to the person who has created the profile for their account only as the PowerShell profile is actually stored within the user's Windows Profile. Profile Description Path Current User, Current Host (ISE) This script will run when the current user opens their PowerShell ISE C:\Users\[USERNAME]\Documents\WindowsPowerShell\Microsoft.PowerShellISE_profile.ps1 Current User, Current Host (Console) This script will run when the current user opens their PowerShell Console C:\Users\[USERNAME]\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 Current User, All Hosts This script will run when the current user opens either their PowerShell ISE or PowerShell Console C:\Users\[USERNAME]\Documents\WindowsPowerShell\profile.ps1 All Users, Current Host (ISE) This script will run for all users when they open their PowerShell ISE C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShellISE_profile.ps1 All Users, Current Host (Console) This script will run for all users when they open their PowerShell Console C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 All Users, All Hosts This script will run for all users when they open either their PowerShell ISE or PowerShell Console C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 For current user profiles you will need to replace [USERNAME] in the path with your Windows Username. Trying to edit one of these profiles but it's not there? You need to create these profiles to start using them (you can simply create the specified file in the appropriate path as per the above table). As I said at the beginning of this answer, PowerShell profiles deserve their own blog post as the above is just a brief answer there is still much more to cover.

Government Events: Effectively Building Defences, Resilience And Capabilities Against Online Threats

Event: Government Events: Effectively Building Defences, Resilience And Capabilities Against Online Threats
Event Type: Conference
Organiser: Government Events (https://www.governmentevents.co.uk)
Date: Wednesday 25th September 2019
Location: Hallam Conference Centre

Online threats are such a hot topic these days, so much so that Government Events organised a conference which included many guest speakers from across different industries. Whilst I always try to keep my articles to a reasonable length so you are not put off reading them, I have to apologise in advance for this one. There was so much information provided at this event with so many guest speakers that although I have tried to cut this down as much as possible I’m afraid it is a long article! If you can bring yourself to read it, I’m sure you’ll find at least some of the information useful even if you don’t find it interesting!

Guest Speakers

The guest speakers included:

Professor Jeremy Watson, Professor of Engineering Systems and Vice-Dean of Engineering Sciences, UCL (Chair of the event)
Detective Superintendent Andrew Gould, National Cybercrime Programme Lead, National Police Chiefs’ Council
Mike Hulett, Head of Operations, National Cyber Crime Unit, National Crime Agency
Dmitriy Ayrapetov, Vice President of Platform Architecture, Sonicwall
Dan Jeffrey, Head of Cyber Security Programme and Innovation, NHS Digital
Ryan Manyika, Privacy Consultant, OneTrust
Nikola Howard, Data Centre Manager, London Borough of Camden
Linda McCormack, Head of Internal Communications, Anglian Water Services
Noel Slane, Regional Vice President, European and Middle Eastern, Tekenable/Opswat
David Cowan, IT Manager, Copeland Borough Council
Dr Emma Williams, Lecturer, University of Bristol
Dr Robert Nowill, Chair, Cyber Security Challenge UK
Mathew Critchley, Head of Security and Resilience, Manchester City Council

These speakers shared experiences to help raise awareness of the Cyber Security threats organisations face on a daily basis as well as guidance on how to mitigate the damage these threats can cause. Like many of the events I have attended the message from these speakers was that “it’s not if an attack will happen, it’s when” and emphasis was on protecting ourselves as much as possible before it happens.

Experiences

One speaker shared their experience of their workplace being being hit by a Cyber Attack a few years ago that completely destroyed their digital systems and over 2 years later they were still rebuilding. Emphasis was put on making sure regular backups are kept secure and regularly tested, to ensure recovery is possible should the worst happen. Backups should be kept off the network so they cannot be accessed from a security breach and ideally a copy should also be kept off-site to help protect from a physical attack, whether it is malicious or natural.

Another speaker shared their experience of how easy it was to social engineer the staff at their organisation. They explained how they created fake LinkedIn accounts pretending to be an employee at their organisation and sending connection requests to other employees of the organisation. The employees gladly accepted the connection requests and one colleague event went as far as asking the fake female account that had been created out on date! This was a very easy and very successful way of social engineering.

Cyber Security Awareness Training

There was a discussion regarding educating our users of Cyber Security Threats and what techniques can be utilised to encourage our users to take an interest in helping the organisation stay secure. Making the training interactive and also personalising the training were effective ways of significantly improving the interest of the company employees.

An organisation created stickers which were distributed to staff and when a staff member walked away from their computer leaving it unlocked a colleague would put one of the stickers on their machine for the staff member to see when they returned. This simple idea created a little game between the employees where nobody wanted the shame of being “caught” for leaving their computers unlocked therefore this improved the rate of staff members locking their machines when they walked away from it.

Another useful consideration when providing Cyber Security Awareness to employees was to also tailor the training for the different departments. Whilst all employees tend to face the same common security risks, different departments also have their own Cyber Seucrity risks they would be more susceptible to. For example, a finance department is more likely to be targeted to hand over financial information such as credit card information. The VIPs of the organisation are more likely to be impersonated with their emails being spoofed or tricked into handing over their login details. It is important these departments are made aware of how they are likely to be targeted.

Psychology in Cyber Security

The psychology involved in Cyber Security Awareness training was discussed and useful tips were shared on how to engage our users with Cyber Security. A useful technique was to personalise the Cyber Security awareness training. Helping the end-user to understand that the Cyber Security best practises they were being taught at work could help keep them and their families safe at home immediately gained their interest. As well as personalising the Cyber Security Awareness training the organisation also created education videos which were appealing to a younger audience so they would also be interested in watching and learning.

Other psychological impacts to be considered when providing Cyber Security awareness training was the environment in which the training was being provided. If staff members felt overly comfortable and safe naturally their guard would be dropped and the amount of attention they dedicate to the training being provided to them with be lower than if they were taken slightly out of their comfort zone. This doesn’t mean all staff members should be taken taken to unknown location surrounded by strangers and forced to listen to Cyber Security training on repeat. It simply means that training should cater for the fact that if staff members feel “I am at work so I am safe from a Cyber Attack as our IT department will protect us” they are less likely to accept the role they are required to play in order to help keep the organisation secure.

Similarly, the time of the Cyber Security training should be taken into consideration. Staff members are much less likely to fully concentrate on the training at 3PM on a Friday afternoon than they are at 10:00am on a Tuesday morning (in a typical 9-5 working week). Training sessions should also be of a reasonable length, especially considering that Cyber Security is not really the top interest of most staff members there is no point spending hours and hours on a particular training session. It would be far more effective to provide shorter and more regular training sessions.

Cyber Security Threats

An interesting statistic was that traditional malware attacks were decreasing as other types of attacks were on the increase, such as Ransomware, IOT targeting and watering hole attacks (infecting a website that company employees may visit and become infected, before spreading the infection through the company network). This is largely due to the fact that Antivirus vendors have become quite effective and preventing traditional malware attacks. This has all resulted in malicious users now spending more time on working to evade capture with these new techniques.

DeepFake is a type of Ransomware that I have mentioned before in my CloudSec Event article and was mentioned again at this event has it continues to become more infamous. DeepFake is definitely a Cyber Security Threat that all companies and their employees need to be made aware of. It consists of pictures and/or voice recordings of an individual being manipulated to impersonate them. This can include videos being made of them and even phone calls being made using the compromised person’s voice.

A prime example of DeepFake Ransomware (which has actually happened to a company), was for a senior member of the finance department at an energy company being impersonated to a more junior member requesting they immediately transfer funds another account. It’s easy to be reading this thinking “how did the person get tricked into this? I’d never fall for it.” but the reality is that the impersonation seems so real and it is therefore extremely important employees are made aware of such malicious threats.

Conclusion

Well, I did warn you this was a long article. This event was extremely informational and there is honestly so much more that could be included from this event into this article but let’s not convert this article into a book. If you are serious when it comes to Cyber Security and you get the opportunity to attend a future event like this I would recommend you grasp it with both hands.

One of the parts I found so interesting from this event and highly advise Cyber Security professionals to take on board is just how much of an impact psychology has on Cyber Security awareness training. There is no point providing Cyber Security awareness training if you are not optimising the impact it has.