NIST getting outside help for National Vulnerability Database
The National Institute for Standards and Technology (NIST) informed the cybersecurity community in February that it should expect delays in the analysis of Common Vulnerabilities and Exposures (CVE) identifiers in the NVD, saying that it was working to establish a consortium to improve the program.
In an update shared in April, NIST admitted that there was a growing backlog of vulnerabilities submitted to the National Vulnerability Database (NVD) that required analysis, blaming the issue on an increase in the number of vulnerabilities, as well as “change in interagency support”.
While looking for long-term solutions to this problem, the agency has been prioritizing the analysis of the most serious vulnerabilities. In its latest update, shared on May 29, NIST said it has awarded a contract for additional processing support for the NVD.
Regarding the backlog of unprocessed CVEs, NIST noted that it’s also working with CISA to add the unprocessed vulnerabilities to the database. The organization expects to clear the backlog by the end of the fiscal year. The government’s fiscal year ends on September 30.
(Source: Security Week)
FCC vote on tap for rules to secure fundamental component of the internet
The Federal Communications Commission is set to vote Thursday on advancing a proposal to improve security for a key component of the modern internet, a rule that eases some — but not all — of the criticisms of the agency’s previously stated plans for strengthening the Border Gateway Protocol.
Under the proposed rule, broadband internet providers would have to develop and maintain secure internet routing plans. The nine largest providers would be required to file quarterly reports with the FCC on their efforts.
“Whether you’re banking online, using telemedicine to see the doctor, or attending school remotely, you rely on a set of technical rules called the Border Gateway Protocol (BGP) to route your data efficiently,” FCC Chairwoman Jessica Rosenworcel said in May when announcing the rule. “This protocol was designed for expediency, not security. Accordingly, it lacks explicit security features, which has allowed criminals to ‘hijack’ online traffic.”
(Source: Cyberscoop)
HC3 Analyst Note: Healthcare Sector DDoS Guide
A Distributed-Denial-of-Service (DDoS) attack is a type of cyber attack in which an attacker uses multiple systems, often referred to as a botnet, to send a high volume of traffic or requests to a targeted network or system, overwhelming it and making it unavailable to legitimate users. With the number of attacks increasing every year, they can come at any time, impact any part of a website’s operations or resources, and lead to massive amounts of service interruptions and huge financial losses.
In the health and public health (HPH) sector, they have the potential to deny healthcare organizations and providers access to vital resources that can have detrimental impact on the ability to provide care. Disruptions due to a cyberattack may interrupt business continuity by keeping patients or healthcare personnel from accessing critical healthcare assets such as electronic health records, software based medical equipment, and websites to coordinate critical tasks.
As such, this comprehensive DDoS guide is intended for target healthcare audiences to understand what DDoS attacks are; what causes them; types of DDoS attacks with timely, relevant examples; and mitigations and defenses against a potential attack.
(Source: HHS HC3)
FBI cyber lead urges potential LockBit Victims to contact Internet Crime Complaint Center
FBI Cyber Division Assistant Director Bryan Vorndran on June 5 highlighted the Bureau’s “ongoing disruption” of the LockBit ransomware group and its affiliates, and urged potential victims to contact the Bureau’s Internet Crime Complaint Center (IC3).
The Bureau now has more than 7,000 LockBit decryption keys in its possession, Vorndran said in a keynote at the 2024 Boston Conference on Cyber Security. We can use these keys to help victims get their data back, he noted. Potential victims can contact IC3 by visiting our LockBit Victim Reporting Form at lockbitvictims.ic3.gov.
The LockBit ransomware variant has been utilized in over 2,400 cyberattacks around the world—more than 1,800 of which impacted victims in the U.S.—he said. These attacks have targeted various sectors and racked up “billions of dollars in damages,” Vorndran said. A recent international “operation to disrupt and seize” LockBit infrastructure and to sanction the group and its affiliates revealed that the group and its affiliates retained victim data, even after victims had paid them ransoms.
(Source: FBI)
White paper: Public water and wastewater sector face mounting cyber threat
The Center for Internet Security, Inc. (CIS®) Cyber Threat Intelligence (CTI) team assesses that U.S. State, Local, Tribal, and Territorial (SLTT) government-operated U.S. water and wastewater systems (WWS) will likely continue to face a mounting threat from cyber threat actors (CTAs) over the next year, largely driven by recent global conflicts. This assessment is based on CTAs’ demonstrated ability and intention to exploit vulnerable WWS to achieve geopolitical, financial, or data-collection goals.
SLTT entities operating WWS must confront an increasing number of cyber threats including ransomware, insider threats, hacktivism, state-sponsored CTAs, and attacks exploiting unpatched legacy systems. Cyberattacks targeting WWS also threaten significant downstream impacts due to factors including inhibiting access to safe drinking water, wastewater function, and strains on the supply chain.
Refer to the end of CIS’ white paper for tailored guidance and resources for better securing WWS and operational technology (OT) against the spectrum of cyber threats.
(Source: CIS)
Ascension: Cybersecurity Event Update
In a June 5 statement, Ascension Health provided the following update on the cyberattack that occurred in early May:
Restoring Electronic Health Record (EHR) access has been among the top priorities of our recovery process. We are encouraged to report positive developments in these efforts and can announce that we have successfully restored EHR access in our Florida, Alabama, Austin, Tennessee and Maryland markets.
Based on what we have learned about this process to date, we are working toward completing EHR restoration across our entire ministry by the end of the week ending June 14.
As EHR is restored across the entirety of our networks, clinicians will be able to access patient records as they did prior to this incident. While these are promising developments in our recovery efforts, our investigation into this incident remains ongoing, along with the remediation of additional systems.
Additionally, Ascension Rx retail, home delivery and specialty pharmacy sites are now open and able to meet your prescription needs. This means that healthcare providers are able to transmit prescriptions electronically and can send prescriptions to Ascension Rx pharmacies for their patients.
(Source: Ascension Health)
|
