CloudTalk

Category: Security

  • GCE/GKE Security: New Dashboards Enhance Google Cloud Protection

    Google Enhances Cloud Security for GCE and GKE with New Dashboards

    The cloud has become indispensable, driving unprecedented growth. Businesses are increasingly choosing Google Cloud for its scalability, cost-effectiveness, and agility. However, as adoption surges, so do the threats. To address this, Google has enhanced the security of Google Compute Engine (GCE) and Google Kubernetes Engine (GKE) with new dashboards, powered by Security Command Center, making cloud security more accessible and effective.

    The Problem: A Fragmented Security Landscape

    Managing cloud security can be complex. Traditionally, security and development teams often operate in silos, leading to communication breakdowns, overlooked vulnerabilities, and delayed incident responses. The new dashboards address this by integrating critical security insights directly into the development workflow within GCE and GKE. This unified approach, as highlighted by Christopher Perry on LinkedIn, aims to create a seamless experience where security becomes an integral part of the development process.

    Key Features: Integrated Insights, Simplified Security Management

    These new dashboards offer a consolidated view of security findings, including vulnerabilities and misconfigurations, providing developers with immediate visibility into potential issues. This direct access fosters collaboration, accelerates incident response times, and significantly strengthens the overall security posture. This represents a game-changing improvement.

    • Faster Vulnerability Detection: Quickly identify and address security weaknesses.
    • Improved Teamwork: Bridging the gap between security and operations teams.
    • Enhanced Security Posture: Reduce the risk of breaches and incidents, safeguarding valuable data.

    The Competitive Advantage of Google Cloud

    In the competitive cloud market, differentiation is crucial. By deeply integrating security into GCE and GKE, Google is making a strategic move to simplify security management, making Google Cloud a more attractive option. This seamless user experience gives Google Cloud a significant competitive edge, allowing it to effectively compete with other leading cloud providers. For example, the dashboards can help developers identify and remediate misconfigured storage buckets that could expose sensitive customer data, or detect vulnerabilities in container images before deployment.

    Looking Ahead: The Future of Cloud Security

    The trend is clearly towards greater integration, automation, and user-friendly tools. AI-powered security solutions, such as the CryptoGuard prototype, and model-driven dashboards, like those enabled by the Mod2Dash framework, are paving the way for enhanced security capabilities. Google is positioned to lead this evolution by continuously innovating and integrating security seamlessly into its product offerings.

    Strategic Implications for Your Business

    Adopting these new dashboards is a strategic imperative for businesses operating in the cloud. The benefits are clear: reduced security incident costs, improved regulatory compliance, and increased customer trust. This approach empowers developers to proactively address security concerns, creating a more secure and resilient cloud environment. By proactively identifying and mitigating threats within GCE and GKE, businesses can minimize downtime and protect their reputations.

    The Bottom Line

    Cloud security is no longer a secondary concern; it is a core business function. With Google’s new GCE and GKE dashboards, businesses can move towards a more proactive and integrated security strategy. Stay vigilant, adapt your security plans, and leverage the power of these tools to build a strong, secure cloud foundation.

  • UNC1549 Telecom Hacks: LinkedIn Lures & MINIBIKE Malware Analysis

    UNC1549 Targets Telecoms with LinkedIn Phishing & MINIBIKE Malware: 34 Devices Breached

    Subtle Snail: A Deep Dive into UNC1549’s Telecom Attacks

    In a sophisticated cyberattack campaign dubbed “Subtle Snail,” the Iran-linked group UNC1549 targeted European telecommunications companies, successfully breaching 34 devices across 11 firms. This campaign, detailed by Swiss cybersecurity firm PRODAFT, highlights the increasing sophistication of state-sponsored attacks. UNC1549’s goal: long-term access to sensitive data and strategic espionage. This report explores the attack’s mechanics, the malicious tools used, and the implications for the telecommunications sector.

    Why Telecoms? Understanding the Target

    The telecommunications sector is a critical piece of infrastructure, making it a prime target for espionage and cybercrime. Its complex networks, vast data stores, and reliance on sensitive information create many vulnerabilities that attackers can exploit. UNC1549 focused on gaining a foothold in key systems to steal sensitive data and maintain persistent access. The targeting of companies in the United States, the United Kingdom, Canada, France, and the United Arab Emirates suggests a broad strategic objective, likely tied to intelligence gathering.

    LinkedIn as a Weapon: The Attack Chain Unveiled

    UNC1549 employed a well-crafted social engineering strategy, leveraging LinkedIn to initiate the attacks. Posing as HR representatives from legitimate companies, attackers engaged employees of target organizations, successfully compromising 34 devices across 11 telecom firms. Beyond immediate access, the group aimed to maintain long-term persistence within telecommunications, aerospace, and defense organizations, exfiltrating sensitive data for strategic purposes. The following is a breakdown of the attack chain:

    • Reconnaissance: The attackers meticulously scouted LinkedIn to identify key personnel within targeted organizations. They specifically targeted researchers, developers, and IT administrators with privileged access to critical systems.
    • Spear-Phishing: They sent spear-phishing emails to validate email addresses and gather additional information, laying the groundwork for the main attack.
    • Fake Recruitment: UNC1549 set up convincing HR profiles on LinkedIn and reached out to potential victims with fake job opportunities. These profiles were designed to build trust.
    • Malware Delivery: Interested targets received an email to schedule an interview. Clicking a fraudulent domain mimicking companies like Telespazio or Safran Group triggered the download of a ZIP archive.
    • MINIBIKE Deployment: Inside the ZIP file was an executable that, when launched, used DLL side-loading to launch the malicious DLL, MINIBIKE. This is the primary payload.

    MINIBIKE: A Modular Backdoor with Extensive Capabilities

    The MINIBIKE backdoor is a sophisticated and modular piece of malware, equipped with 12 distinct commands to facilitate command-and-control (C2) communication. This allows the attackers to:

    • Enumerate files and directories.
    • List and terminate running processes.
    • Upload files in chunks.
    • Run EXE, DLL, BAT, or CMD payloads.

    MINIBIKE’s capabilities extend to:

    • Gathering system information.
    • Logging keystrokes and clipboard content.
    • Stealing Microsoft Outlook credentials.
    • Collecting web browser data from Google Chrome, Brave, and Microsoft Edge.
    • Taking screenshots.

    The malware also incorporates several advanced techniques to evade detection and analysis. It utilizes a publicly available tool to bypass app-bound encryption, employs anti-debugging and anti-sandbox methods, and uses control flow flattening and custom hashing algorithms. Additionally, the malware blends its C2 traffic with legitimate cloud services and uses Virtual Private Servers (VPSes) as proxy infrastructure. It also makes Windows Registry modifications to ensure automatic loading after system startup.

    Expert Analysis and Industry Insights

    Cybersecurity experts have noted the sophistication and persistence of UNC1549’s operations. PRODAFT’s assessment, linking the group to Iran’s Islamic Revolutionary Guard Corps (IRGC), adds a layer of strategic importance. The use of LinkedIn as the initial attack vector is particularly effective, exploiting the inherent trust associated with professional networking platforms. The meticulous tailoring of the attacks for each victim shows a high degree of planning and execution.

    The Competitive Threat Landscape

    The cyber threat landscape is intensely competitive, with various state-sponsored and criminal groups vying for access to sensitive data and critical infrastructure. UNC1549’s focus on telecommunications and aerospace aligns with the strategic interests of the Iranian government. Other Iranian hacking groups, like MuddyWater, are also active in this space, indicating a broader, concerted effort to compromise critical infrastructure and gather intelligence.

    Emerging Trends and Future Developments

    Social engineering, especially through professional networking platforms, is a rising trend. Attackers are becoming increasingly adept at impersonating legitimate entities. The creation and deployment of custom malware, such as MINIBIKE, further demonstrate the sophistication of these attacks. The growing use of cloud services for C2 infrastructure also makes detection and attribution more challenging. These trends highlight the need for vigilance and proactive security measures.

    Strategic Implications and Business Impact

    The UNC1549 campaign presents significant risks for the telecommunications sector. Data breaches can lead to:

    • Loss of sensitive customer data.
    • Disruption of essential services.
    • Damage to a company’s reputation.
    • Significant financial losses.

    Companies must prioritize cybersecurity, including employee training, robust network security, and proactive threat detection. Moreover, the potential for strategic espionage poses a serious threat to national security. The consequences of a successful attack can be far-reaching, including economic damage, disruption of critical services, and erosion of trust in the telecommunications infrastructure.

    Staying Ahead: Proactive Security Measures

    The threat from UNC1549 and similar groups is likely to persist. Telecommunications companies must adopt a multi-layered security approach, including:

    • Enhanced Employee Training: Educate employees about social engineering tactics and phishing attempts. Regular training is essential.
    • Network Segmentation: Isolate critical systems to limit the impact of a breach.
    • Endpoint Detection and Response (EDR): Implement EDR solutions to detect and respond to malicious activity in real time.
    • Threat Intelligence: Stay informed about emerging threats, vulnerabilities, and attack methods. Subscribe to threat intelligence feeds.
    • Regular Security Audits: Conduct regular security audits and penetration testing to identify and address weaknesses.

    By implementing these measures, telecommunications companies can significantly reduce the risks posed by sophisticated cyberattacks, safeguarding their critical infrastructure, protecting sensitive data, and maintaining operational resilience. A proactive and adaptive approach to cybersecurity is essential in today’s evolving threat landscape.

  • Agent Factory: Secure AI Agents for Businesses & Trust

    In the ever-evolving world of Artificial Intelligence, the rise of autonomous agents is undeniable. These AI agents, capable of complex tasks, promise to revolutionize industries. But with this progress comes a critical question: how do we ensure these agents are safe and secure? The Agent Factory is a framework designed to build and deploy secure AI agents, ensuring responsible AI development. This article explores the challenges of securing AI agents and how the Agent Factory is paving the way for a trustworthy future.

    Building Trust in AI: The Agent Factory and the Security Challenge

    Multi-agent systems, where AI agents collaborate, face a unique security challenge. The “Multi-Agent Security Tax” highlights a critical trade-off: efforts to enhance security can sometimes hinder collaboration. Think of it as the cost of ensuring a team works together without sabotage. A compromised agent can corrupt others, leading to unintended outcomes. The research, accepted at the AAAI 2025 Conference, revealed that defenses designed to prevent the spread of malicious instructions reduced collaboration capabilities.

    The Agent Factory aims to address this “Multi-Agent Security Tax” by providing a robust framework for secure agent creation. This framework allows developers to balance security and collaboration, fostering a more reliable and productive environment for AI agents.

    Securing the Generative AI Revolution

    Generative AI agentic workflows, or the specific tasks and processes performed by AI agents, introduce new weaknesses that need to be addressed. The paper “Securing Generative AI Agentic Workflows: Risks, Mitigation, and a Proposed Firewall Architecture” identifies potential vulnerabilities like data breaches and model manipulation. The proposed “GenAI Security Firewall” acts as a shield against these threats, integrating various security services and even leveraging GenAI itself for defense.

    Agent Factory: The Blueprint for Secure AI Agents

    While the specifics of the Agent Factory’s internal workings are still being developed, the core concept is straightforward: create a system for designing and deploying AI agents with built-in security. Microsoft’s Azure Agent Factory is already leading the way, providing a platform to build and deploy safe and secure AI agents. This platform incorporates data encryption, access controls, and model monitoring, aligning perfectly with the research. It emphasizes the critical importance of security in all AI workflows.

    Strategic Implications: Building Trust and Value

    The ability to create secure AI agents has significant implications for businesses. By prioritizing security, companies build trust with stakeholders, protect sensitive data, and ensure responsible AI deployment. The Agent Factory concept could significantly reduce the risks of AI adoption, enabling organizations to reap the benefits without compromising security. This also ensures that businesses remain compliant with industry regulations.

    The future of AI agent security rests on comprehensive, adaptable solutions. Businesses must prioritize robust security measures, stay informed about emerging threats, and adapt their strategies accordingly. The Agent Factory represents a significant step toward a future where AI agents are not just powerful, but also trustworthy.

  • Securing Remote MCP Servers on Google Cloud: Best Practices

    Securing Remote MCP Servers on Google Cloud: Best Practices

    The Rise of MCP and the Security Tightrope

    The Model Context Protocol (MCP), a universal translator for AI, is rapidly becoming the cornerstone for integrating Large Language Models (LLMs) with diverse systems. MCP allows different tools and data sources to “speak” the same language, standardizing API calls and streamlining workflows. For example, MCP might enable a sales bot to access both CRM and marketing data seamlessly. This interoperability simplifies the creation of automated systems driven by LLMs. However, this increased interconnectedness presents a significant security challenge.

    As research consistently demonstrates, a more connected system equates to a larger attack surface – the potential points of vulnerability. An academic paper, “MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits,” highlights how industry-leading LLMs can be manipulated to maliciously utilize MCP tools. This could lead to severe consequences, from malicious code execution to credential theft. This potential necessitates a proactive approach to security.

    Google Cloud’s Proactive Approach: A Best Practices Guide

    Recognizing these escalating risks, Google Cloud has published a detailed guide: “How to Secure Your Remote MCP Server on Google Cloud.” The core recommendation centers around leveraging Google Cloud services, such as Cloud Run, to host your MCP servers. This approach minimizes the attack surface and provides a scalable, robust foundation for AI-driven operations. Given these potential security challenges, Google Cloud offers specific guidance and tools to help developers and organizations build secure and resilient systems.

    The guide emphasizes the importance of strong security fundamentals. This includes stringent access controls, robust encryption protocols, and the implementation of advanced authentication methods, such as Google OAuth, to safeguard deployments. Further, it recommends using proxy configurations to securely inject user identities, adhering to zero-trust principles. This layered approach is akin to constructing a multi-layered castle to protect valuable data.

    Advanced Defenses: AI-Driven Security Enhancements

    Google Cloud also emphasizes the integration of AI-native solutions to bolster MCP server resilience. Collaborations with companies like CrowdStrike enable real-time threat detection and response. Security teams can now leverage LLMs to analyze complex patterns that might evade traditional monitoring systems, enabling faster responses to potential breaches. This capability provides a crucial advantage in the dynamic threat landscape.

    The guide further highlights the necessity of regular vulnerability assessments. It suggests utilizing tools announced at Google’s Security Summit 2025. Addressing vulnerabilities proactively is critical in the rapidly evolving AI landscape. These assessments help identify and remediate potential weaknesses before they can be exploited.

    Deployment Strategies and the Future of MCP Security

    Google Cloud provides step-by-step deployment strategies, including building MCP servers using “vibe coding” techniques powered by Gemini 2.5 Pro. The guide also suggests regional deployments to minimize latency and enhance redundancy. Moreover, it advises against common pitfalls, such as overlooking crucial network security configurations. These practices are essential for ensuring both performance and security.

    Another area of concern is the emergence of “Parasitic Toolchain Attacks,” where malicious instructions are embedded within external data sources. Research underscores that a lack of context-tool isolation and insufficient least-privilege enforcement in MCP can allow adversarial instructions to propagate unchecked. This highlights the need for careful data validation and access control.

    Google’s acquisition of Wiz demonstrates a commitment to platforms that proactively address emerging threats. Prioritizing security within AI workflows is crucial to harnessing MCP’s potential without undue risk. This proactive approach is key as technology continues to evolve, setting the stage for a more secure digital future. The focus on robust security measures is critical for enabling the benefits of LLMs and MCP while mitigating the associated risks.

  • GhostRedirector: Windows Servers Under Siege – Cybersecurity Threat

    GhostRedirector: Website Hijacking with Stealthy Backdoors

    Web servers are constantly under attack, and a new threat, dubbed GhostRedirector, is actively targeting Windows servers. This isn’t just about data theft; it’s about cybercriminals hijacking your web presence for financial gain by manipulating search engine results. Let’s explore this evolving threat.

    The Attackers’ Arsenal: Rungan and Gamshen

    GhostRedirector relies on two custom-built tools: Rungan, a stealthy backdoor, and Gamshen, a malicious IIS module. Working together, they aim to manipulate search engine results and redirect traffic to a website controlled by the attackers. The goal is to profit from SEO fraud, boosting the target website’s ranking and generating revenue, often through affiliate marketing or ad revenue.

    Key Components of the Attack

    • Rungan: This backdoor, written in C++, provides attackers with remote access to execute commands, create user accounts, and more. Its use of AES encryption makes it difficult to detect.
    • Gamshen: This malicious IIS module intercepts requests from search engine crawlers. It then modifies the server’s responses, injecting content or redirecting users to boost the ranking of a chosen website.

    Geographic Scope and Impact

    Researchers at ESET discovered GhostRedirector actively compromising servers. While initially observed in Brazil, Thailand, and Vietnam, with at least 65 compromised servers, the attacks have expanded to multiple countries. This highlights the widespread nature of the threat and the urgent need for proactive security measures.

    What’s the Business Risk?

    The GhostRedirector campaign underscores the importance of a strong security posture. If your web server is compromised, your business could suffer significant consequences:

    • Reputational Damage: Manipulating search results can severely harm your brand’s credibility and online reputation.
    • Financial Loss: Redirecting your website traffic to malicious sites can lead to lost revenue and potential financial scams.
    • Operational Disruption: Attackers can leverage your server’s resources for other malicious activities, slowing down your website or even causing it to crash.

    Protecting Your Business: Staying Ahead of GhostRedirector

    How can you protect your business from GhostRedirector? A multi-layered approach is critical:

    1. Regular Vulnerability Assessments: Conduct frequent security audits to identify and patch weaknesses in your systems.
    2. Intrusion Detection Systems (IDS): Implement IDS to monitor network traffic and detect malicious activity.
    3. Web Application Firewall (WAF): Utilize a WAF to protect against common web attacks like SQL injection and cross-site scripting (XSS).
    4. Employee Security Awareness Training: Educate employees about phishing scams, social engineering tactics, and safe online practices.

    The cybersecurity landscape demands constant vigilance. By staying informed about threats like GhostRedirector and adopting a proactive security strategy, businesses can mitigate risks and protect their valuable digital assets.

  • Automation’s Impact on Pentest Delivery: Boost Security

    In today’s evolving cybersecurity landscape, penetration testing remains crucial for identifying vulnerabilities. However, the way organizations deliver and utilize the results is undergoing a significant shift. Automation is emerging as a critical component of this evolution.

    The Inefficiencies of Traditional Reporting

    Traditionally, penetration tests often culminate in lengthy, static reports. These documents, while valuable for record-keeping, can hinder swift action. Findings are sometimes buried within the report, requiring security teams to manually extract data. This process can lead to creating tickets, assigning them, and tracking progress through disconnected workflows. This lag introduces significant risk. As highlighted by The Hacker News in September 2025, vulnerabilities left unaddressed for extended periods can have severe consequences.

    Automation: A Strategic Imperative

    Automation is no longer just a technological upgrade; it’s a strategic move. As organizations adopt initiatives like Continuous Threat Exposure Management (CTEM), the volume of findings inevitably increases. Automation becomes essential to manage this influx and deliver real-time results effectively.

    According to recent research, the core benefits of automated penetration testing result delivery include:

    • Real-time actionability: Findings are delivered to the appropriate teams immediately.
    • Faster response times: Issues are addressed and remediated before they escalate.
    • Standardized operations: Consistent processes enhance predictability.
    • Reduced manual workload: Security teams can focus on higher-priority tasks.
    • Improved focus: Automation streamlines data handling and reduces distractions.

    For service providers, automation represents a means of becoming an indispensable partner. For businesses, it translates to operational maturity and a lower Mean Time to Remediation (MTTR), ultimately improving the bottom line.

    Key Components of Automated Penetration Testing Delivery

    To successfully implement automated penetration testing delivery, consider these five crucial components:

    1. Centralized Data Ingestion: Consolidate all findings – both manual and automated – into a single repository.
    2. Automated Real-time Delivery: Automatically route findings to the relevant teams and individuals.
    3. Automated Routing & Ticketing: Automatically assign findings and generate tickets.
    4. Standardized Remediation Workflows: Implement consistent processes for addressing identified issues.
    5. Triggered Retesting & Validation: Automatically retest and validate that issues have been resolved.

    Best Practices for Implementation

    When implementing automated penetration testing delivery, it is important to avoid overcomplicating initial efforts. Start with a few key workflows and gradually introduce more complex processes. Automation should also evolve with the business, requiring ongoing iteration to maintain effectiveness. Failing to adapt can lead to outdated and inefficient processes.

    Conclusion: Embracing the Future of Penetration Testing

    Automation is no longer a luxury; it’s a necessity for modern security teams. Automation enables teams to move faster, collaborate more effectively, and reduce risk. As research by Brinztech emphasizes, penetration testing is too important to be stuck in the past. Embracing automation allows organizations to unlock the full value of their security efforts, leading to measurable and positive outcomes. Contact us today to learn more.

  • Data Leak Detection: Proactive Cybersecurity for Your Business

    Data Leak Detection: Proactive Cybersecurity for Your Business

    Data Leak Prevention: A Proactive Guide to Protecting Your Business

    In today’s digital landscape, the constant threat of data leakage looms large. Imagine a scenario where sensitive customer information, financial records, or proprietary trade secrets are accidentally exposed. The consequences can be devastating, leading to financial losses, reputational damage, and legal repercussions. Just like a slow leak in a pipe, these exposures can start small but quickly escalate into a catastrophic flood. The key to survival? Early detection and proactive prevention. This guide delves into the essential steps businesses must take to safeguard their critical data and mitigate the risks associated with data leaks.

    The Escalating Threat of Data Breaches

    Data breaches are no longer a rare occurrence; they’re a growing epidemic. Fueled by the rapid expansion of cloud services, remote work environments, and the increasing sophistication of cybercriminals, the attack surface for businesses is constantly widening. According to recent reports from The Hacker News, the frequency and severity of these attacks are on the rise. The shift is undeniable: businesses must move beyond reactive measures and embrace a proactive approach to data leak detection and prevention. It’s a constant arms race, and staying ahead requires vigilance and a robust defense strategy.

    Understanding the Nuances: Data Leaks vs. Data Breaches and Data Leak Detection Methods

    It’s crucial to understand the distinction between data leaks and data breaches. A data leak is often accidental, stemming from vulnerabilities in security systems, while a data breach is a deliberate, malicious attack. Both pose significant threats, but understanding their origins is essential for effective mitigation. Consider the DeepSeek incident, as reported on The Hacker News, where a Chinese AI specialist suffered a data leak due to misconfigured systems, exposing sensitive information. This example underscores how even seemingly minor errors, such as misconfigured cloud storage, endpoint vulnerabilities, or weaknesses in email systems, can have devastating consequences. Even simple oversights, like default passwords, can create open doors for attackers. The Cloud Security Alliance consistently highlights these risks, emphasizing the need for proactive security measures.

    Taking Action: Implementing Data Leak Detection and Prevention Strategies

    Experts strongly advocate for proactive measures to protect sensitive data. A multi-layered approach is essential. This includes: enforcing the principle of least-privilege access, which limits user access to only the data they need; implementing robust Data Loss Prevention (DLP) strategies to monitor and control data movement; meticulously classifying sensitive data to prioritize protection efforts; conducting regular security audits to identify vulnerabilities; and providing comprehensive employee training to foster a culture of security awareness, as detailed on The Hacker News. Think of it as building a fortress: you need strong walls, vigilant guards, and a comprehensive defense plan. This includes adopting the right tools, such as the Digital Risk Protection solutions offered by companies like Outpost24.

    The Future of Data Leak Detection

    The future of data leak detection is promising, with exciting advancements on the horizon. Artificial intelligence (AI) and machine learning (ML) are becoming invaluable tools, analyzing vast datasets to identify subtle anomalies that might indicate a data leak. The trend toward Zero Trust architecture is also gaining momentum, emphasizing a “never trust, always verify” approach. This holistic strategy underscores the importance of continuous vigilance and a proactive mindset. Data leak detection and prevention are no longer optional; they are essential for safeguarding your business.

    Strategic Implications and Business Impact of Data Leak Prevention

    Businesses that prioritize data leak prevention are better positioned to protect their assets and maintain a strong reputation. Proactive measures enhance customer trust, protect the brand from reputational damage, and mitigate the risk of costly fines and legal battles. The ability to act swiftly and effectively can minimize damage and prevent breaches from escalating into full-blown crises. As The Hacker News has consistently reported, the financial and legal ramifications of data breaches can be severe. Data leak prevention is not merely a best practice; it’s a fundamental business imperative.

    Final Thoughts: Building a Resilient Data Security Strategy

    Organizations must cultivate a culture of security awareness, invest in cutting-edge data leak detection tools, and cultivate the necessary expertise. Prioritize data security at all levels, proactively implement preventative measures, and foster a security-minded culture throughout your organization. Remember, the ultimate goals are early detection and rapid response. It’s about building long-term data security and ensuring business resilience in the face of evolving threats. For further reading on specific data leak detection methods, explore our related articles on [link to related article 1] and [link to related article 2].