Latest CISA guidance and directives on SolarWinds Orion software supply chain compromise
The Cybersecurity and Infrastructure Protection Agency (CISA) released another Joint Statement on January 5, along with the Federal Bureau Of Investigation (FBI), the Office Of The Director Of National Intelligence (ODNI), and the National Security Agency (NSA). The statement officially acknowledges that the incident is “likely Russian in origin” and likely “an intelligence gathering effort.” Approximately 18,000 customers of the Solar Winds’ Orion product are impacted, but a much smaller number have been compromised by follow-on activity. CISA is identified as the lead agency for asset response and is focused on sharing information about this incident quickly with government and private sector partners.
The significance of this breach has compelled many government agencies to take immediate mitigation measures. CISA has released a CISA Insight, offering concise guidance to leaders of any organization impacted, entitled What Every Leader Needs to Know About the Ongoing APT Cyber Activity.
Microsoft has also been assisting with this cyber incident. Microsoft has created the Solorigate Research Center for information and resources on the SolarWinds compromise. This information may be useful to IT administrators who are mitigating this cyber incident in their organizations. Microsoft’s blog, Using Microsoft 365 Defender to protect against Solorigate, will also be of interest to cybersecurity professionals.
Visit CISA’s website for the latest official directives and guidance on this significant and ongoing cyber incident.
(Source: CISA)
Recent swatting attacks target residents with camera and voice-capable smart devices
The Federal Bureau of Investigation (FBI) issued this public service announcement to warn users who own smart home devices with cameras and voice capabilities to use complex, unique passwords and enable two-factor authentication to help protect against “swatting” attacks. Swatting is a term used to describe a hoax call made to emergency services, typically reporting an immediate threat to human life, to draw a response from law enforcement and the S.W.A.T. team to a specific location.
Recently, offenders have been using victims’ smart devices, including video and audio capable home surveillance devices, to carry out swatting attacks. Smart home device manufacturers recently notified law enforcement that offenders have been using stolen e-mail passwords to access smart devices with cameras and voice capabilities. The offenders then log into the smart device and hijack features, including the live-stream camera and device speakers.
(Source: Security Week)
Ten benefits of running cybersecurity exercises
There may be no better way to ascertain your organization's strengths and weaknesses than by running regular security drills. While most organizations understand the need to build defenses and develop policies to reduce the risk and potential impact of a successful cyberattack, many fail to rigorously test those defenses.
Cybersecurity exercises are simulations of specific cyberattack scenarios that organizations can play through to put their defenses to a real-world test. Organizations can gain valuable insights into what their real-world response capabilities to such an attack would be. Consider these ten opportunities for achieving greater resilience to cyberattacks that can come from practicing these types of exercises as an organization:
- Identify your strengths.
- Improve your response.
- Train people.
- Define costs and timescales.
- Determine external needs.
- Collect metrics.
- Identify your weaknesses.
- Update your policies.
- Find non-compliance risks.
- Increase threat awareness.
(Source: DarkReading)
Declaring war against cyber negligence
The recent significant cyberattack involving federal government networks first disclosed in December 2020 by FireEye highlight how critical it is that American businesses and government agencies alike take a drastically different approach to cybersecurity.
Cybersecurity professionals need to shift their focus from “indicators of compromise” to data protection, which will limit how widespread the impact of these vicious digital attacks can be. It is far easier for cybersecurity manufacturers to deliver services from their own cloud. It may be less expensive for the vendor but relying on a “trusted 3rd party” for your security is a foundational vulnerability that has been proven to be disastrous for the customer. Firewalls, antivirus and network monitoring tools still have their place, but a shift must be taken to provide more independence between the owner of data and its protectors.
(Source: ehackingnews)
|
