MISCELLANEOUS CYBERSECURITY NEWS:

BYOD should stand for bring your own disaster, according to Microsoft ransomware data - Microsoft research says that 80-90 percent of ransomware attacks over the past year originated from unmanaged devices. https://www.theregister.com/2023/10/05/microsoft_byod_ransomware/

NSA and CISA reveal top 10 cybersecurity misconfigurations - The National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) revealed today the top ten most common cybersecurity misconfigurations discovered by their red and blue teams in the networks of large organization. https://www.bleepingcomputer.com/news/security/nsa-and-cisa-reveal-top-10-cybersecurity-misconfigurations/

CYBERSECURITY ATTACKS, INTRUSIONS, DATA THEFT & LOSS:

Nearly 100,000 Industrial Control Systems Exposed to the Internet - Thousands of organizations around the world are using industrial control systems (ICS) exposed to the public internet, new analysis from Bitsight has found. https://www.infosecurity-magazine.com/news/industrial-control-systems-exposed/

Your Cheap Android TV Streaming Box May Have a Dangerous Backdoor - WHEN YOU BUY a TV streaming box, there are certain things you wouldn’t expect it to do. It shouldn’t secretly be laced with malware or start communicating with servers in China when it’s powered up. https://www.wired.com/story/android-tv-streaming-boxes-china-backdoor/

MGM Resorts attackers hit personal data jackpot, but house lost $100M - MGM Resorts has admitted that the cyberattack it suffered in September will likely cost the company at least $100 million.MGM Resorts has admitted that the cyberattack it suffered in September will likely cost the company at least $100 million. https://www.theregister.com/2023/10/06/mgm_resorts_cyberattack_cost/

Datacenter cabling biz Volex confirms digital break-in - Volex, the British integrated maker of critical power and data transmission cables, confirmed this morning that intruders accessed data after breaking into its tech infrastructure. https://www.theregister.com/2023/10/09/volex_confirms_cyber_attack/

Social media scams cost victims $2.7B since 2021 - Emma Fletcher, senior data researcher with the FTC, said 25% of people who reported that they lost money to fraud since 2021 said social media is where the scam began. https://www.scmagazine.com/news/2-7-billion-lost-to-social-media-scams-since-2021

Florida circuit court compromised by ALPHV/BlackCat ransomware - Florida's First Judicial Circuit Court has been compromised in an attack by the ALPHV/BlackCat ransomware operation, which claimed to have stolen employees' Social Security numbers and curricula vitae, as well as the court systems' network map and local and remote service credentials. https://www.scmagazine.com/brief/florida-circuit-court-compromised-by-alphv-blackcat-ransomware

Return to the top of the newsletter

WEB SITE COMPLIANCE - We continue our review of the FDIC paper "Risk Assessment Tools and Practices or Information System Security." 
    
    Host-Versus Network-Based Vulnerability Assessment Tools
    
    As in intrusion detection systems, which are discussed later in this appendix, there are generally two types of vulnerability assessment tools: host-based and network-based.  Another category is sometimes used for products that assess vulnerabilities of specific applications (application-based) on a host.  A host is generally a single computer or workstation that can be connected to a computer network.  Host-based tools assess the vulnerabilities of specific hosts.  They usually reside on servers, but can be placed on specific desktop computers, routers, or even firewalls. 
    
    Network-based vulnerability assessment tools generally reside on the network, specifically analyzing the network to determine if it is vulnerable to known attacks.  Both host- and network-based products offer valuable features, and the risk assessment process should help an institution determine which is best for its needs.  Information systems personnel should understand the types of tools available, how they operate, where they are located, and the output generated from the tools.
    
    Host-based vulnerability assessment tools are effective at identifying security risks that result from internal misuse or hackers using a compromised system.  They can detect holes that would allow access to a system such as unauthorized modems, easily guessed passwords, and unchanged vendor default passwords.  The tools can detect system vulnerabilities such as poor virus protection capabilities; identify hosts that are configured improperly; and provide basic information such as user log-on hours, password/account expiration settings, and users with dial-in access.  The tools may also provide a periodic check to confirm that various security policies are being followed.  For instance, they can check user permissions to access files and directories, and identify files and directories without ownership.
    
    Network-based vulnerability assessment tools are more effective than host-based at detecting network attacks such as denial of service and Internet Protocol (IP) spoofing.  Network tools can detect unauthorized systems on a network or insecure connections to business partners.  Running a host-based scan does not consume network overhead, but can consume processing time and available storage on the host.  Conversely, frequently running a network-based scan as part of daily operations increases network traffic during the scan.  This may cause inadvertent network problems such as router crashes.

Return to the top of the newsletter

FFIEC IT SECURITY - We continue our review of the OCC Bulletin about Infrastructure Threats and Intrusion Risks. This week we review Testing.
   
   Management should ensure that information system networks are tested regularly. The nature, extent, and frequency of tests should be proportionate to the risks of intrusions from external and internal sources. Management should select qualified and reputable individuals to perform the tests and ensure that tests do not inadvertently damage information systems or reveal confidential information to unauthorized individuals. Management should oversee the tests, review test results, and respond to deficiencies in a timely manner. In accordance with OCC's "Technology Risk Management: PC Banking," management should ensure that an objective, qualified source conducts a penetration test of Internet banking systems at least once a year or more frequently when appropriate.

Return to the top of the newsletter

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY - We continue the series on the National Institute of Standards and Technology (NIST) Handbook.
 
 Chapter 6 - COMPUTER SECURITY PROGRAM MANAGEMENT
 
 6.6 Central and System-Level Program Interactions
 
 A system-level program that is not integrated into the organizational program may have difficulty influencing significant areas affecting security. The system-level computer security program implements the policies, guidance, and regulations of the central computer security program. The system-level office also learns from the information disseminated by the central program and uses the experience and expertise of the entire organization. The system-level computer security program further distributes information to systems management as appropriate.
 
 Communications, however, should not be just one way. System-level computer security programs inform the central office about their needs, problems, incidents, and solutions. Analyzing this information allows the central computer security program to represent the various systems to the organization's management and to external agencies and advocate programs and policies beneficial to the security of all the systems.
 
 6.7 Interdependencies
 
 The general purpose of the computer security program, to improve security, causes it to overlap with other organizational operations as well as the other security controls discussed in the handbook. The central or system computer security program will address most controls at the policy, procedural, or operational level.
 
 Policy. Policy is issued to establish the computer security program. The central computer security program(s) normally produces policy (and supporting procedures and guidelines) concerning general and organizational security issues and often issue-specific policy. However, the system-level computer security program normally produces policy for that system. Chapter 5 provides additional guidance.
 
 Life Cycle Management. The process of securing a system over its life cycle is the role of the system-level computer security program. Chapter 8 addresses these issues.
 
 Independent Audit. The independent audit function should complement a central computer security program's compliance functions.
 
 6.8 Cost Considerations
 
 This chapter discussed how an organization wide computer security program can manage security resources, including financial resources, more  effectively. The cost considerations for a system-level computer security program are more closely aligned with the overall cost savings in having security.
 
 The most significant direct cost of a computer security program is personnel. In addition, many programs make frequent and effective use of consultants and contractors. A program also needs funds for training and for travel, oversight, information collection and dissemination, and meetings with personnel at other levels of computer security management.