Cisco Identity Services Engine (ISE): Cybersecurity Heroes

| May 21, 2018

article image
Cisco's Identity Services Engine (ISE) is the foundation that strengthens your network security architecture to handle any cybersecurity attack. Learn more at www.cisco.com/go/ise.

Spotlight

SECNAP Network Security

SECNAP Network Security develops information technology and cybersecurity solutions that enable business to be conducted securely on the Internet, leveraging the award-winning CloudJacket platform to deliver industry-leading network security, information security, email security and email encryption services in the cloud at lower total cost of ownership. An extensive suite of security audit services includes external penetration testing, internal vulnerability assessments, HITECH, HIPAA, GLBA and other compliance assessments, web application and wireless assessments and more.

OTHER ARTICLES

Wormable, Unpatched Microsoft Bug Threatens Corporate LANs

Article | March 11, 2020

Microsoft is warning on a wormable, unpatched remote code-execution vulnerability in the Microsoft Server Message Block protocol – the same protocol that was targeted by the infamous WannaCry ransomware in 2017.The critical bug (CVE-2020-0796) affects Windows 10 and Windows Server 2019, and was not included in Microsoft’s Patch Tuesday release this week. The bug can be found in version 3.1.1 of Microsoft’s SMB file-sharing system. SMB allows multiple clients to access shared folders and can provide a rich playground for malware when it comes to lateral movement and client-to-client infection. This was played out in version 1 of SMB back in 2017, when the WannaCry ransomware used the NSA-developed EternalBlue SMB exploit to self-propagate rapidly around the world.

Read More

3 Trends in Data Privacy Breach Laws That Will Carry Over to 2020

Article | February 12, 2020

During 2019, new privacy laws were introduced, and many current laws evolved in the United States and across the global landscape. With the General Data Protection Regulation (GDPR) in full effect, we saw expensive fines levied upon companies that fell victim to data privacy breaches. As we move into a new year, probably the biggest takeaway from 2019 is that being proactive and having a data privacy strategy in place is important to help mitigate the risk of a data privacy breach. The regulatory landscape continues to evolve as states and countries actively pass new expanded requirements for privacy and cybersecurity regulations. While laws in the U.S., like the California Consumer Privacy Act (CCPA), are getting significant attention, many other states and countries are actively amending their breach notification laws to include tighter restrictions.

Read More

As Ransomware Surge Continues, Where Next for Government?

Article | August 30, 2021

Global leaders want to carve out specific areas of critical infrastructure to be protected under international agreements from cyber-attacks. But where does that leave others? There are ‘four or five steps you could take that could significantly mitigate this risk,’ Falk said. These are patching, multifactor authentication and all the stuff in the Australian Signals Directorate's Essential Eight baseline mitigation strategies. …” Back in April of this year, a BBC News headline read, "The ransomware surge ruining lives." And that was before the cyber-attacks on critical infrastructure sectors like Colonial Pipeline, meat-processing giant JBS, the Irish Health Service and so many others. And when President Biden met with Russian President Putin last month in Geneva, he declared that certain critical infrastructure should be “off-limits” to cyber-attacks. “We agreed to task experts in both our countries to work on specific understandings about what is off-limits,” Biden said. “We’ll find out whether we have a cybersecurity arrangement that begins to bring some order.” As an initial positive step forward, this cyber defense policy makes sense. In fact, most global experts applaud these moves and efforts to better protect and clarify international crimes in cyberspace. Previous administrations going back to George W. Bush have taken aggressive steps to ensure critical infrastructure is protected in the U.S. and around the world through actions involving people, process and technology, both offline and online. The 16 critical infrastructure sectors identified by DHS/CISA can be found here. Still, many questions remain regarding this new policy: Will all global governments actually agree on the wording? More importantly, even if they do agree, how will the agreements be enforced? Also, what happens if some countries continue to allow criminals to attack these critical infrastructure sectors from their soil? And my main question goes further: Even if all of these agreements and actions are 100 percent agreed upon and enforced, which most people don’t believe will happen, does this imply that every organization not covered under these 16 critical infrastructure sectors can be openly attacked without a response? Is this giving into cyber criminals for everyone else? For example, would K-12 schools or small businesses be “fair game” and not off limits? Could this actually increase attacks for any organization not considered on the CISA list? No doubt, some will say that schools are a part of government, and yet there are private schools. In addition, if we do cover all others somehow, perhaps as a supplier of these 16 sectors, doesn’t that make the “off-limits” list essentially meaningless? Essentially, where is the line? Who is included, and what happens when some nation or criminal group crosses the line? These questions became more than an intellectual thought exercise recently when the Kaseya ransomware attack impacted more than 1,500 businesses, without, in their words, impacting critical infrastructure. CBS News reports, “Still, Kaseya says the cyber-attack it experienced over the July 4th weekend was never a threat and had no impact on critical infrastructure. The Russian-linked gang behind the ransomware had demanded $70 million to end the attack, but CNBC reported that the hackers reduced their demands to $50 million in private conversations. "The Miami-based company said Tuesday that it was alerted on July 2 to a potential attack by internal and external sources. It immediately shut down access to the software in question. The incident impacted about 50 Kaseya customers.” OTHER RECENT RANSOMWARE NEWS Meanwhile, in a bit of a surprise, ransomware group REvil disappeared from the Internet this past week, when its website became inaccessible. As Engadget reported, “According to CNBC, Reuters and The Washington Post, the websites operated by the group REvil went down in the early hours of Tuesday. Dmitri Alperovitch, former chief technology officer of the cyber firm CrowdStrike, told The Post that the group's blog in the dark web is still reachable. However, its critical sites victims use to negotiate with the group and to receive decryption tools if they pay up are no longer available. Visitors to those websites now see a message that says ‘A server with the specified host name could not be found.’" CNBC reported: “There are 3 main possibilities for the criminal gang’s disappearance — each of which carries good and bad news for U.S. efforts to combat the ransomware scourge emanating from Russia. The Kremlin bent under U.S. pressure and forced REvil to close up shop. U.S. officials tired of waiting for Kremlin cooperation and launched a cyber operation that took REvil offline. REvil’s operators were feeling the heat and decided to lay low for a while. "This situation may send a message to some of the players that they need to find a less-aggressive business model, which could mean avoiding critical infrastructure, or it could mean avoiding U.S. targets.” Also, the Biden administration announced several other measures to combat ransomware: “The Biden administration will offer rewards up to $10 million for information leading to the identification of foreign state-sanctioned malicious cyber activity against critical U.S. infrastructure — including ransomware attacks — and the White House has launched a task force to coordinate efforts to stem the ransomware scourge. "It is also launching the website stopransomware.gov to offer the public resources for countering the threat and building more resilience into networks, a senior administration official told reporters.” And yet, many experts are still predicting that ransomware will continue to grow in the near future. For example, TechHQ wrote that “identifying the culprits often isn't as big an obstacle as apprehending them.” To show recent growth of ransomware attacks, Fox Business offered details on a Check Point report this past week that “ransomware attacks surge, growing 93 percent each week.” Also: “'The ransomware business is booming. We’re seeing global surges in ransomware across every major geography, especially in the last two months,' said Lotem Finkelstein, head of threat intelligence at Check Point Software. 'We believe the trend is driven by scores of new entrants into the ransomware business.'" For more background on this hot topic, a few weeks back I appeared on MiTech News to discuss the ransomware crisis. FINAL THOUGHTS I’d like to close with this article which offers a slightly different perspective on ransomware from ZDNet Australia: “The threat of ransomware dominates the cyber news right now, and rightly so. But this week Rachael Falk, chief executive officer of Australia's Cyber Security Cooperative Research Centre, made a very good point. Ransomware is ‘Totally foreseeable and preventable because it's a known problem," Falk told a panel discussion at the Australian Strategy Policy Institute (ASPI) on Tuesday. ‘"It's known that ransomware is out there. And it's known that, invariably, the cyber criminals get into organisations through stealing credentials that they get on the dark web [or a user] clicking on a link and a vulnerability," she said. ‘We're not talking about some sort of nation-state really funky sort of zero day that's happening. This is going on the world over, so it's entirely foreseeable.’" Article Orginal Source: https://www.govtech.com/blogs/lohrmann-on-cybersecurity/as-ransomware-surge-continues-where-next-for-government

Read More

The Coronavirus is Already Taking Effect on Cyber Security– This is How CISOs Should Prepare

Article | March 18, 2020

Cynet has revealed new data, showing that the Coronavirus now has a significant impact on information security and that the crisis is actively exploited by threat actors. The Coronavirus is hitting hard on the world’s economy, creating a high volume of uncertainty within organizations. Cynet has revealed new data, showing that the Coronavirus now has a significant impact on information security and that the crisis is actively exploited by threat actors. In light of these insights, Cynet has shared a few ways to best prepare for the Coronavirus derived threat landscape and provides a solution (learn more here) to protect employees that are working from home with their personal computers, because of the coronavirus. Cynet identifies two main trends – attacks that aim to steal remote user credentials, and weaponized email attacks:

Read More

Spotlight

SECNAP Network Security

SECNAP Network Security develops information technology and cybersecurity solutions that enable business to be conducted securely on the Internet, leveraging the award-winning CloudJacket platform to deliver industry-leading network security, information security, email security and email encryption services in the cloud at lower total cost of ownership. An extensive suite of security audit services includes external penetration testing, internal vulnerability assessments, HITECH, HIPAA, GLBA and other compliance assessments, web application and wireless assessments and more.

Events