#CommandAndControl

[operationalinsights]

A New Era of Collaboration: Participative Management and Strategic HRM in the 20th Century

The early 20th century witnessed significant developments in how companies approached Human Resource Management (HRM), culminating in a shift from tactical personnel management to a more strategic and participative approach. The emergence of participative management, the professionalization of HRM, and the alignment of human resources with overarching corporate goals were driven by the need to address labor unrest, employee turnover, and the rapidly evolving industrial environment. This essay delves deeper into the origins of these developments, examining the move toward strategic HRM, participative management, and the supporting infrastructure that helped solidify HRM’s role in modern business.

The Strategic Nature of HRM in the 1920s

One of the key shifts during this era was the recognition that HRM could no longer be confined to the lower ranks of corporate management, where personnel staff managed day-to-day issues such as recruitment, wages, and employee welfare. Instead, companies began to realize that HRM needed to be aligned with the company’s strategic goals and overseen at the highest executive levels. This shift was articulated in influential articles of the time, such as Hotchkiss's 1923 piece in the Harvard Business Review, where HRM was described as a function that pervades all departments, rather than being siloed in a single unit. Hotchkiss argued that successful HRM must serve as an integrating force across the entire business, rather than a segregated or reactive department.

This strategic vision for HRM reflected the growing understanding among business leaders that labor relations and employee management were critical to long-term business success. For instance, during the 1920s, companies such as General Electric (GE) and Western Electric implemented wide-reaching HRM programs designed not only to manage labor unrest but to foster employee involvement and commitment. GE, in particular, began to integrate employee feedback mechanisms and shop committees to give workers a voice in operational decisions. This participative management model was an early form of what would later be termed "employee involvement," reflecting a shift towards collaborative labor-management relations rather than the top-down models of earlier periods.

Participative Management and Employee Involvement

Participative management, as it developed in the 1920s, was a response to the increasing complexity of industrial organizations and the need for companies to stabilize their workforces amidst growing labor militancy. By allowing employees to participate in decisions that affected their work, companies aimed to reduce the likelihood of strikes, boost productivity, and improve morale.

One notable example of participative management in action during this period was at Western Electric, where the famous Hawthorne Studies were conducted between 1924 and 1932. These studies, led by Elton Mayo, examined the effects of workplace conditions on employee productivity and morale, but they also revealed the importance of social relations and employee involvement in the workplace. The results demonstrated that when workers felt that their opinions and well-being were valued, productivity improved, a finding that laid the foundation for the human relations movement in management. Western Electric’s decision to implement worker committees and provide employees with a greater say in operational matters marked a shift from the traditional authoritarian model of management towards a more participative one.

The strategic implementation of HRM programs was not limited to the United States. In the UK, for example, companies like Rowntree's and Cadbury were early adopters of participative management techniques. Both companies had a long history of paternalistic welfare practices, but by the 1920s, they were experimenting with employee representation schemes. Cadbury’s introduced workers’ councils where employees could discuss grievances and suggest improvements, a practice designed to foster a sense of inclusion and mitigate the adversarial relationship between labor and management.

The Development of HRM Infrastructure

The 1920s also saw the growth of an infrastructure that supported the professionalization of HRM. Journals, associations, consulting firms, and university programs dedicated to HRM began to emerge, reflecting the increasing recognition of HRM as a critical component of corporate strategy.

In the United States, the foundation of the National Personnel Association in the early 1920s (which would later become the American Management Association) signaled the growing importance of HRM as a professional field. This association, along with others such as the American Society for Personnel Administration (founded in 1948), provided a forum for HR professionals to share best practices, develop new theories, and advocate for the role of HRM in business.

University programs in HRM also began to proliferate during this time. Institutions such as Harvard University and the University of Chicago introduced courses on industrial relations, labor economics, and personnel management, helping to create a cadre of trained professionals who could bring a more scientific approach to managing human resources. Consulting firms specializing in labor relations, such as A.T. Kearney, also began offering their services to businesses seeking to improve their HR practices.

In Europe, similar developments were taking place. In the UK, for example, the Institute of Labor Management was founded in 1931, reflecting the growing professionalization of HRM. This institute played a crucial role in promoting research and education in HRM, helping to create a more formalized and strategic approach to labor relations across British industry.

The Influence of Economic and Social Factors

The shift towards strategic HRM and participative management in the 1920s was not purely a business-driven phenomenon. It was also influenced by broader economic and social factors, particularly the labor unrest that characterized the post-World War I period. The Bolshevik Revolution in Russia in 1917 had raised fears of a similar worker uprising in capitalist countries, and this concern was exacerbated by the wave of strikes and labor unrest that swept through the United States, the UK, and other industrialized nations in the years following the war.

Companies recognized that if they were to maintain industrial peace and avoid government intervention, they needed to address the underlying causes of worker discontent. This led to the development of HRM programs that went beyond mere welfare work to include mechanisms for employee involvement and participation. At the same time, the growing influence of trade unions, particularly in industries such as steel, coal, and automobiles, pressured companies to take a more strategic approach to labor relations.

For example, the U.S. Steel Corporation, one of the largest employers in the United States at the time, faced significant labor unrest throughout the 1920s. In response, the company developed a comprehensive HRM strategy that included not only improved wages and working conditions but also employee representation on shop committees and other decision-making bodies. This approach helped to reduce strikes and improve labor-management relations, demonstrating the value of a strategic approach to HRM.

Conclusion

The development of HRM in the 1920s marked a critical turning point in the evolution of modern labor management practices. Companies began to recognize that managing labor relations required more than just tactical, day-to-day interventions; it needed to be integrated into the broader strategic goals of the organization. Participative management, employee involvement, and the professionalization of HRM through the creation of associations, journals, and university programs were all part of this shift.

The real-world examples of companies like Western Electric, GE, Cadbury, and U.S. Steel demonstrate how these new approaches to HRM were implemented in practice, often with significant benefits in terms of employee productivity, morale, and labor peace. As HRM continued to evolve throughout the 20th century, the foundations laid in the 1920s helped shape the strategic, participative, and professional nature of HRM today.

[wemhall]

Russian Command and Control

Command and Control (C2), along with Command Centers, are phrases you might hear with regard to the Russians in Ukraine these days. In my military career, I worked all levels of C2 from Infantry Brigade to Presidential, and I can see that the Russians are shockingly missing, or ignoring some C2 fundamentals. There are other reasons for Russia’s initial bad performance in the first 100+ days of…

[brumes4k]

Nightmare playthrough of Assassin’s Creed Odyssey quests with Ultra High graphics quality, 4k@60fps. This Legacy of the First Blade DLC: Command and Control In a desperate attempt to lure Amorges out of hiding, Kassandra sought to kill one of his prized commanders.

0:00 Intro 0:21 Legacy of the First Blade DLC: Command and Control ▬ #AssassinsCreed #AssassinsCreedOdyssey #Nightmare #CommandandControl ▬ Buy me a coffee? https://www.paypal.com/paypalme/brumes4k/5EUR Help me grow? https://www.patreon.com/brumes4k Web: https://brumes4k.eu Twitter: https://twitter.com/Brumes4kV

Hardware used for this Assassin’s Creed Odyssey playthrough: CPU: i7700k @ 4.2GHz RAM: 32GB DDR4 @ 2400MHz GPU: MSI RTX 3070 8Gb SSD: WD Black SN750

[notiseg]

Las paredes de pantalla de Mitsubishi Electric están diseñadas para entornos de misión crítica que requieren rendimiento y confiabilidad. El monitor DiamondView™ 100" aborda las exigentes necesidades de alta confiabilidad de los entornos de comando y control donde se requiere el cumplimiento de TAA, lo que lo convierte en una solución ideal para aplicaciones del gobierno de Los Estados Unidos. Más https://bit.ly/2yvfkQz #videowalls #videodisplaywalls #MitsubishiElectric #LCD #LCDmonitor información: #commandandcontrol #controlroom #EOC #TAAcompliant #missioncritical https://www.instagram.com/p/CAS-SqMhpsf/?igshid=1b723mt2ljobu

[akdbuiltperformance]

So blessed to have so many people love what we do! The love and support they were received from all of you is what keeps us moving forward and we appreciate you all both business and consumer alike! We will continue our rise and momentum into 2019 and we are proud to be among you shops movers, and shakers out here on the floor boards making a happen! Nearing the completion and the last corner of our Premier product bolt on all wheel drive system! As well as a lot of components of we have designed and partnership with shops and world renowned racers! We will continue to strive for greatness in 2019 and we hope to do more collaboration work with shops just like you and the future designing amazing products and making fast cars! #somuchlove #shop2shop #2019 #automotiveinnovations #mechanicalengineering #electricalengineering #softwareengineering #commandandcontrol #modularbuilt #collaborations #blessed #humbled (at Automotive Koncepts & Designs INC) https://www.instagram.com/p/Br9Xy9hggo6/?utm_source=ig_tumblr_share&igshid=1usf4y2wnnldx

[inhvmed]

Just finished this book. It’s a must read if you’re even remotely interested in the history of nuclear weapons or the conflicts taking place during the Cold War from the end of WWII to its collapse in 1991. #commandandcontrol (at איזאקאיה סושי בר)

[hiddenincommand]

“Only the strong endure. Only the disciplined prevail. Beneath the weight of tradition and the glare of history, a single truth stands eternal: command is taken, never given. The temple looms as a monument to order, built by the hands of men who understood that greatness is forged through will, not granted through weakness. I stand here, the living embodiment of that eternal creed—unyielding, unbroken, unstoppable.”

Look upon this image and understand: this is not a reflection of mere ambition—it is the reflection of destiny fulfilled.

[pbrstreetgang73]

Now watching:- #CommandAndControl #232 Scary stuff

[laprogressive]

LA Progressive has a new post on http://bit.ly/2oTKl6R

The Threat of Nuclear Weapons to America

On more the one occasion, the U.S. has come close to nuking itself Did you know the U.S. has built nearly 70,000 nuclear weapons since 1945? Did you know the U.S. Air Force lost a B-52 and two hydrogen bombs in an accident over North Carolina in 1961, and that one of those H-bombs was a single...

[recomonkey]

Il-80 Maxdome (Il-86VKP) #ilyushin #il86vkp #il80 #il80maxdome #maxdome #commandandcontrol #commandpost #aircraft #ильюшин #окбильюшина #ил86вкп #ил80 #вкп #самолет #командныйпункт #взпу #ил86взпу #ra86147 #airforce #ruaf #ввс #combatid #recomonkey #recognition #militaryphoto https://t.co/bSrvOOWLvC

[mrhackerco]

DeimosC2 – Golang Command & Control Framework For Post-Exploitation #command #commandandcontrol #control #deimosc2 #framework #hacker #hacking #cybersecurity #hackers #linux #ethicalhacking #programming #security #mrhacker

[terabitweb]

Original Post from Microsoft Secure Author: Eric Avena

Our experience in detecting and blocking threats on millions of endpoints tells us that attackers will stop at nothing to circumvent protections. Even one gap in security can be disastrous to an organization.

At Microsoft, we don’t stop finding new ways to fill in gaps in security. We go beyond strengthening existing defenses by introducing new and innovative layers of protection. While our industry-leading endpoint protection platform stops threats before they can even run, we continue improving protections for instances where sophisticated adversarial attacks manage to slip through.

Multiple layers of protection mean multiple hurdles that attackers need to overcome to perpetrate attacks. We continuously innovate threat and malware prevention engines on the client and in the cloud to add more protection layers that detect and block sophisticated and evasive threats before they can even run.

In recent months, we introduced two machine learning protection features within the behavioral blocking and containment capabilities in Microsoft Defender Advanced Threat Protection. In keeping with the defense in depth strategy, coupled with the “assume breach” mindset, these new protection engines specialize in detecting threats by analyzing behavior, and adding new layers of protection after an attack has successfully started running on a machine:

Behavior-based machine learning identifies suspicious process behavior sequences and advanced attack techniques observed on the client, which are used as triggers to analyze the process tree behavior using real-time machine learning models in the cloud

AMSI-paired machine learning uses pairs of client-side and cloud-side models that integrate with Antimalware Scan Interface (AMSI) to perform advanced analysis of scripting behavior pre- and post-execution to catch advanced threats like fileless and in-memory attacks

The figure below illustrates how the two behavior-based machine learning protections enrich post-breach detections:

Figure 1. Pre and post-execution detection engines in Microsoft Defender ATP’s antivirus capabilities

The pre-execution and post-execution detection engines make up two important components of comprehensive threat and malware prevention. They reflect the defense in depth principle, which entails multiple layers of protection for thorough, wide-range defense.

In detecting post-execution behavior, using machine learning is critical. Many attack techniques are also used by legitimate applications. For example, a very common, documented method used by both clean applications and malware is creating a service for persistence.

To distinguish between malicious and clean applications when an attack technique is observed, Windows Defender Antivirus monitors and sends suspicious behaviors and process trees to the cloud protection service for real-time classification by machine learning. Cloud-based post-execution detection engines isolate known good behaviors from malicious intent to stop attacks in real time.

Within milliseconds of an attack technique or suspicious script execution being observed, machine learning classifiers return a verdict and the client blocks the threat. The pre-execution models then learn from these malicious blocks afterwards to protect Microsoft Defender ATP customers before attacks can begin executing new cycles of infection.

How behavioral blocking and containment protected 100 organizations from credential theft

In early July, attackers launched a highly targeted credential theft attack against 100 organizations around the world, primarily in the United Arab Emirates, Germany, and Portugal. The goal of the attack was to install the notorious info-stealing backdoor Lokibot and to exfiltrate sensitive data.

Behavioral blocking and containment capabilities in Microsoft Defender ATP detected and foiled the attack in its early stages, protecting customers from damage.

Spear-phishing emails carrying lure documents were sent to the target organizations; in one instance, three distinct highly targeted emails with the same lure document were delivered to a single pharmaceutical ingredient supplier. The attacker used pharmaceutical industry jargon to improve the credibility of the email and in one case requested a quote on an ingredient that the target company was likely to produce.

Figure 2. Multiple spear-phishing emails attempted to deliver the same lure document to the same target

The lure document itself didn’t host any exploit code but used an external relationship to a document hosted on a compromised WordPress website. If recipients opened the attachment, the related remote document, which contained the exploit, was also automatically loaded. This allowed the remote document to take advantage of the previously fixed CVE-2017-11882 vulnerability in Equation Editor and execute code on the computer.

Figure 3. The lure document contains an external reference to the exploit document is hosted on a compromised WordPress website.

Upon successful exploitation, the attack downloaded and loaded the Lokibot malware, which stole credentials, exfiltrated stolen data, and waited for further instructions from a command-and-control (C&C) server.

The behavior-based machine learning models built into Microsoft Defender ATP caught attacker techniques at two points in the attack chain. The first detection layer spotted the exploit behavior. Machine learning classifiers in the cloud correctly identified the threat and immediately instructed the client to block the attack. In cases where the attack had proceeded past this layer of defense to the next stage of the attack, process hollowing would have been attempted. This, too, was detected by behavior-based machine learning models, which instructed the clients to block the attack, marking the second detection layer. As the attacks are blocked, the malicious processes and corresponding files are remediated, protecting targets from credential theft and further backdoor activities.

Figure 4. Credential theft attack chain showing multiple behavior-based protection layers that disrupted the attack

The behavior-based blocking raised an “Initial Access” alert in Microsoft Defender Security Center, the console for SecOps teams that gives complete visibility into their environments and across the suite of Microsoft Defender ATP tools that protect their endpoints:

Figure 5. Alert and process tree on Microsoft Defender Security Center for this targeted attack

This attack demonstrates how behavior-based machine learning models in the cloud add new layers of protection against attacks even after they have started running.

In the next sections, we will describe in detail the two machine learning protection features in behavioral blocking and containment capabilities in Microsoft Defender ATP.

Behavior-based machine learning protection

The behavior engine in the Windows Defender Antivirus client monitors more than 500 attack techniques as triggers for analyzing new and unknown threats. Each time one of the monitored attack techniques is observed, the process tree and behavior sequences are constructed and sent to the cloud, where behavior-based machine learning models classify possible threats. Figure 4 below illustrates a more detailed view of our process tree classification path:

Figure 6. Process tree classification path

Behavior-based detections are named according to the MITRE ATT&CK matrix to help identify the attack stage where the malicious behavior was observed:

  Tactic Detection threat name Initial Access Behavior:Win32/InitialAccess.*!ml Execution Behavior:Win32/Execution.*!ml Persistence Behavior:Win32/Persistence.*!ml Privilege Escalation Behavior:Win32/PrivilegeEscalation.*!ml Defense Evasion Behavior:Win32/DefenseEvasion.*!ml Credential Access Behavior:Win32/CredentialAccess.*!ml Discovery Behavior:Win32/Discovery.*!ml Lateral Movement Behavior:Win32/LateralMovement.*!ml Collection Behavior:Win32/Collection.*!ml Command and Control Behavior:Win32/CommandAndControl.*!ml Exfiltration Behavior:Win32/Exfiltration.*!ml Impact Behavior:Win32/Impact.*!ml Uncategorized Behavior:Win32/Generic.*!ml

Since deployment, the behavior-based machine learning models have blocked attacker techniques like the following used by attacks in the wild:

Credential dumping from LSASS

Cross-process injection

Process hollowing

UAC bypass

Tampering with antivirus (such as disabling it or adding the malware as exclusion)

Contacting C&C to download payloads

Coin mining

Boot record modification

Pass-the-hash attacks

Installation of root certificate

Exploitation attempt for various vulnerabilities

These blocked behaviors show up as alerts in Microsoft Defender Security Center.

Figure 7. Alert for malicious behavior in Microsoft Defender Security Center

Machine learning protection for scripting engines with AMSI

Through the AMSI integration with scripting engines on Windows 10 and Office 365, Windows Defender Antivirus gains rich insight into the execution of PowerShell, VBScript, JavaScript and Office Macro VBA scripts to cut through obfuscation, protect against fileless attacks, and provide robust defenses against malicious script behavior.

To assist with fileless and evasive script attacks, scripting engines are instrumented to provide both behavior calls and dynamic content calls to the antivirus product. The type of integrations available varies based on the scripting engine. Table 1 below illustrates the current support with the Windows 10 and Office 365, and Figure 5 illustrates an example of the scripting engine dynamic script content and behavior calls for malicious scripts.

  Microsoft AMSI integration point Dynamic script content calls Behavior calls PowerShell Y VBScript Y Y JavaScript Y Y Office VBA macros Y WMI Y MSIL .NET Y

Figure 8. Example dynamic script content and behavior calls for malicious scripts monitored by AMSI

Our scripting machine learning protection design can be seen in Figure 6 below. We deployed paired machine learning models for various scripting scenarios. Each pair of classifiers is made up of (1) a performance-optimized lightweight classifier that runs on the Windows Defender Antivirus client, and (2) a heavy classifier in the cloud. The role of the client-based classifier is to inspect the script content or behavior log to predict whether a script is suspicious. For scripts that are classified as suspicious, metadata describing the behavior or content is featurized and sent up to the cloud for real-time classification; the metadata that describes the content includes expert features, features selected by machine learning, and fuzzy hashes.

Figure 9. AMSI-paired models classification path

The paired machine learning model in the cloud then analyzes the metadata to decide whether the script should be blocked or not. If machine learning decides to block the file, the running script is aborted. This paired model architecture is used to offload the overhead of running intensive machine learning models to the cloud, and to make use of the global information available about the content through the Microsoft Intelligent Security Graph.

Malicious scripts blocked by AMSI-paired machine models are reported in Microsoft Defender Security Center using threat names like the following:

Trojan:JS/Mountsi.A!ml

Trojan:Script/Mountsi.A!ml

Trojan:O97M/Mountsi.A!ml

Trojan:VBS/Mountsi.A!ml

Trojan:PowerShell/Mountsi.A!ml

Behavioral blocking and containment for disrupting advanced attacks

The two new cloud-based post-execution detection engines we described in this blog are part of the behavioral blocking and containment capabilities that enabled Microsoft Defender ATP to protect the 100 organizations targeted in the credential theft attack we discussed earlier. Recently, we also documented how behavior-based protections are important components of the dynamic protection against the multi-stage, fileless Nodersok campaign.

These engines add to the many layers of machine learning-driven protections in the cloud and add protection against threats after they have begun running. To further illustrate how these behavior-based protections work, here’s a diagram that shows the multiple protection layers against an Emotet attack chain:

Figure 10. Multiple layers of behavior-based protection in Windows Defender Antivirus while executing an Emotet attack (SHA-256: ee2bbe2398be8a1732c0afc318b797f192ce898982bff1b109005615588facb0)

As part of our defense in depth strategy, these new layers of antivirus protection not only expand detection and blocking capabilities; they also provide even richer visibility into malicious behavior sequences, giving security operations more signals to use in investigating and responding to attacks through Microsoft Defender ATP capabilities like endpoint detection and response, threat and vulnerability management, and automated investigation and remediation.

Within milliseconds of an attack technique or suspicious script execution being observed, machine learning classifiers return a verdict and the client blocks the threat. Our pre-execution models then learn from these malicious blocks afterwards to protect Microsoft Defender ATP customers before the threats even begin executing.

Figure 11. Multiple layers of malware and threat prevention engines on the client and in the cloud

The impact of the continuous improvements in antivirus capabilities further show up in Microsoft Threat Protection, Microsoft’s comprehensive security solution for identities, endpoints, email and data, apps, and infrastructure. Through signal-sharing across Microsoft services, the richer machine learning-driven protection in Microsoft Defender ATP is amplified throughout protections for various attack surfaces.

  Geoff McDonald with Saad Khan Microsoft Defender ATP Research

The post In hot pursuit of elusive threats: AI-driven behavior-based blocking stops attacks in their tracks appeared first on Microsoft Security.

#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: Eric Avena In hot pursuit of elusive threats: AI-driven behavior-based blocking stops attacks in their tracks Original Post from Microsoft Secure Author: Eric Avena Our experience in detecting and blocking threats on millions of endpoints tells us that attackers will stop at nothing to circumvent protections.

[securitynewswire]

VB2017 video Turning Trickbot decoding an encrypted commandandcontrol channel

SNPX.com : http://dlvr.it/Pz59by

[laprogressive]

The Threat of Nuclear Weapons to America https://t.co/zsMg0bgku5 #Commandandcontrol #Hydrogenbombslost… https://t.co/fYZQkCKXNk

The Threat of Nuclear Weapons to America https://t.co/zsMg0bgku5 #Commandandcontrol #Hydrogenbombslost #Nucleararsenal http://pic.twitter.com/lud1G6AYmn

— Sharon Kyle (@SharonKyle00) April 28, 2017

via Twitter https://twitter.com/SharonKyle00 April 28, 2017 at 12:28PM