House Homeland releases “Cyber Threat Snapshot” highlighting rising threats to US networks, critical infrastructure
On Nov. 12, the House Committee on Homeland Security has released a new Cyber Threat Snapshot examining growing threats posed by malign nation-states and criminal networks to the homeland and the data of Americans.
Unfortunately, cyberattacks on critical infrastructure increased 30 percent globally last year.
To undermine U.S. sovereignty, Iranian hackers used spear-phishing to target campaign networks and government officials; China allegedly backed hacking group Salt Typhoon to infiltrate candidates’ phones; and Russia used a botnet to target social media feeds in an effort to spread their malign influence.
From Iran-backed intrusions into our water sector and the targeting of satellites to the Chinese Communist Party-affiliated ‘Typhoon’ intrusions into numerous facets of our critical infrastructure, nation-states see the dangerous value in disrupting, manipulating, or surveilling the operational and information technology that supports the daily lives of Americans.
Cyber insecurity also impacts the health and wellness of Americans, as cybercriminals increasingly target hospitals and other healthcare entities for ransom. The intrusions into the Ascension Health hospital system and Change Healthcare, a UnitedHealth subsidiary, showcase the damage that can be done to patient care and privacy when the IT that is foundational to emergency response is undermined by cyber criminals.
Read the full Nov. 12 release and Snapshot at Homeland.House.Gov.
(Source: U.S. House of Representatives, Homeland Security Committee)
NIST Invites comments on Enhanced Security Requirements for Protecting Controlled Unclassified Information
The initial public draft (ipd) of the National Institute of Standards and Technology’s (NIST’s) Special Publication (SP) 800-172r3 (Revision 3), Enhanced Security Requirements for Protecting Controlled Unclassified Information (CUI), is available for comment.
SP 800-172r3 provides recommended security requirements to protect the confidentiality, integrity, and availability of CUI when it is resident in a nonfederal system and organization and is associated with a high value asset or critical program. The enhanced security requirements give organizations the capability to achieve a multidimensional, defense-in-depth protection strategy against advanced persistent threats (APTs) and help to ensure the resiliency of systems and organizations.
The enhanced security requirements in SP 800-172r3 supplement the security requirements in SP 800-171r3 and are intended for use by federal agencies in contractual vehicles or other agreements between those agencies and nonfederal organizations.
The public comment period is open through January 10, 2025.
(Source: NIST)
Center for Internet Security: The Scariest Malware of 2024
In episode 109 of the Center for Internet Security’s (CIS’) podcast, Cybersecurity Where You Are, CIS’ Vice President of Security Operations & Intelligence and Director of Intelligence & Incident Response examine the scariest malware of 2024. It discusses what makes certain malware strains “scarier” than others, what trends shaped the cyber threat landscape in 2024, and how malware tactics and techniques from 2024 will continue to evolve.
The podcast shares recommendations for how organizations can keep up with the changing cyber threat landscape, including how individuals and organizations can proactively defend themselves and how national strategies are shaping malware defense and incident response.
(Source: CIS)
State and local security adjusting to shifting cyber threats, insurance requirements
Although security has always been taken seriously, many governments didn’t consider going as far as taking out cybersecurity insurance because they didn’t feel they were lucrative enough targets to attract the persistent attention of cyber threat actors. But any added sense of security from being perceived as relatively inconsequential targets is quickly eroding. The attacks this summer on the City of Columbus, Ohio, and the New Mexico public defender’s office were notable on their own, but they also continued a trend.
Cyberattacks on state and local governments have become both more frequent and more profitable for threat actors. The average cost of a ransomware attack on state and local governments so far this year is $2.83 million, more than double the $1.21 million average in 2023, according to Sophos’ State of Ransomware in State and Local Government 2024 report.
In addition to becoming more expensive, cyber insurance is also harder to get. Insurance providers increasingly demand that organizations meet a minimum set of security standards to qualify for coverage. State and local governments must adopt a proactive approach to cybersecurity, both to mitigate increasingly active threats and to improve their eligibility for cyber insurance coverage.
(Source: Route Fifty)
UN Security Council meeting discusses impact of ransomware attacks on hospitals
A United Nations Security Council meeting the week of Nov. 4 discussed ransomware and the severe impacts that cyberattacks can have on hospitals and health systems. During the meeting, the president of Ascension Healthcare, shared insights from a cyberattack in May that disrupted operations across the health system's 120 hospitals.
"As we have been loudly advocating for years, these cross-border ransomware attacks are conducted by ransomware gangs who enjoy safe harbor provided primarily by Russia, China, North Korea and Iran. It is an international threat that can only be solved through international cooperation and a will from aligned nations to effectively increase risk and consequences for those who commit and support these despicable acts," said the American Hospital Association’s (AHA’s) national advisor for cybersecurity and risk.
(Source: AHA)
Local cybersecurity expert weighs in on City of Sheboygan ransom attack
The City of Sheboygan, Wisconsin, is investigating a cyberattack on its network and a ransom message.
There was a potential network issue a week and a half ago. There was an external, unauthorized access to the network. The network has since been secured, and a forensic review is underway. Now, it’s a matter of figuring out “Who got in, how long have they been there, what have they done and what do they want to do?” according to cybersecurity expert Brian Collins.
The mayor’s office released a statement: “Public safety services are responding to all emergent and nonemergent requests for service with limited interruptions. The phone system and radio network are fully functional. This issue is not affecting safety in any way. City of Sheboygan employees with internet access can communicate with each other online as all cloud-based services are up and working.”
(Source: WTMJ-TV Milwaukee)
|
