President issues Executive Order to bolster Nation’s cybersecurity
The President of the United States, on Wednesday, May 12, signed a much-anticipated executive order aimed at strengthening the protection of computer networks and systems across the federal government and the nation. It comes as the United States grapples with multiple ongoing cybersecurity incidents.
The order had been in the works since the early days of the administration but deemed urgently needed in light of recent cybersecurity incidents. The exploited SolarWinds and Microsoft Exchange flaws and the Colonial Pipeline ransomware attack have been damaging to various agencies and U.S. critical infrastructure.
Among many inclusions, the order calls for the modernization and implementation of stronger cybersecurity standards across the federal government for information and operational technology. It aims to help move agencies to “secure cloud services and a zero-trust architecture, and mandates deployment of multifactor authentication and encryption [within] a specific time period,” a fact sheet the White House published on the order notes.
The administration also calls for the making of a standardized playbook and sets definitions for cyber incident responses that government entities will be expected to employ.
(Source: NextGov)
Montana focuses on ransomware defense, shifting to zero trust
As the recent ransomware attack against a vital oil and gas pipeline operator, Colonial Pipeline, makes clear, such attacks are not going away and are becoming more persistent and targeting higher-profile entities.
Even before the attack, the state of Montana’s Chief Information Security Officer (CISO) worried about precisely this kind of a ransomware attack targeting the state’s data and systems. Continuing to combat ransomware remains one of Montana’s top cybersecurity objectives.
In addition to taking steps to guard against ransomware, Montana is also moving toward a zero-trust cybersecurity architecture and implementing an enterprise governance, risk and compliance approach. Although there have been indications recently that state and local governments are interested in adopting a zero-trust approach to cybersecurity, it is much more widely discussed (and deployed) at the federal level right now.
Zero-trust cybersecurity departs from traditional network-centric security, in which users are trusted once they have gained access to an agency’s network. In a zero-trust architecture, which is based on data security, no user or endpoint is trusted, access controls are granular and users and devices are continuously required to authenticate themselves — enabling a motto of “never trust, always verify.”
(Source: StateTech Magazine)
Cybercriminals scanned for vulnerable Microsoft Exchange servers within five minutes of news going public
According to a review of threat data from enterprise companies that was compiled between January and March this year, threat actors began searching the web for vulnerable Microsoft Exchange Servers within five minutes of Microsoft’s security advisory going public. When critical vulnerabilities in popular software are announced to the public, a race often occurs between threat actors and IT admins, with one group looking for suitable targets and the other performing risk assessments and implementing patches. The attackers gain the upper hand when a proof-of-concept is available or when a bug is relatively easy to exploit.
The announcement of zero-day vulnerabilities can attract attackers’ scans within 15 minutes of public disclosure, says the report. Attackers were able to work faster on the Microsoft Exchange flaws than IT admin, with the first scans detected in no more than five minutes. The incident occurred on March 2 when Microsoft went public with the existence of four zero-day vulnerabilities in its Exchange Server. The flaws were targeted by the Chinese APT group Hafnium and other APTs such as Tick, Winnti Group, and LuckyMouse.
(Source: OODALoop)
Center for Internet Security (CIS) releases CIS Controls v8 to reflect evolving technology, threats
On May 18, the Center for Internet Security (CIS) announced the release of CIS Controls v8. The CIS Controls are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are mapped to and referenced by multiple legal, regulatory, and policy frameworks, and have recently been included in state cybersecurity statutes in Ohio and Utah. The updated Controls have been enhanced to keep up with modern systems and software, and the ever-changing cyber ecosystem, and includes cloud and mobile technologies.
Physical devices, fixed boundaries, and discrete islands of security implementation are less important in the new version; this is reflected through revised terminology and grouping of Safeguards (formerly Sub-Controls), resulting in a decrease of the number of Controls from 20 to 18. The 18 top-level Controls contain 153 Safeguards that provide a prioritized path to improve an enterprise’s cybersecurity posture.
The v8 release is not just an update to the Controls; the whole ecosystem surrounding the Controls has been (or soon will be) updated as well.
CIS is home to the Multi-State Information Sharing and Analysis Center (MS-ISAC), the trusted resource for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial (SLTT) government entities.
(Source: Center for Internet Security)
|
