IT Security RSS Feed for 2024-10-27

Dutch critical infrastructure at risk despite high leadership confidence

Read more

Published: Fri, 25 Oct 2024 07:11:00 GMT

Dutch Critical Infrastructure at Risk Despite High Leadership Confidence

Despite high confidence expressed by Dutch leaders in the security of the country’s critical infrastructure, a report from the National Coordinator for Security and Counterterrorism (NCTV) has revealed significant vulnerabilities that could be exploited by attackers.

Key Findings of the Report:

• Outdated Systems: Many critical infrastructure systems in the Netherlands are outdated and vulnerable to cyberattacks.
• Limited Cyber Security Expertise: There is a shortage of qualified cyber security professionals to protect critical infrastructure from threats.
• Lack of Coordination: Coordination between critical infrastructure operators, government agencies, and security services is insufficient.
• Inadequate Crisis Response Plans: Plans for responding to critical infrastructure incidents are inadequate and need to be improved.

Confidence vs. Reality:

While Dutch leaders expressed confidence in the security of critical infrastructure, the NCTV report highlights a significant gap between perception and reality. This disconnect could lead to complacency and increase the risk of successful attacks.

Potential Impacts:

A successful attack on critical infrastructure could have severe consequences for the Netherlands, including:

• Disruption of vital services, such as power, water, and transportation
• Economic losses
• Public safety concerns
• Loss of trust in government

Call for Action:

The NCTV report recommends several actions to address the vulnerabilities identified, including:

• Investing in modernizing infrastructure systems
• Increasing cyber security expertise
• Improving coordination between stakeholders
• Developing robust crisis response plans

Conclusion:

While Dutch leaders may express confidence in the security of critical infrastructure, the NCTV report reveals that significant vulnerabilities remain. Urgent action is needed to address these weaknesses and mitigate the risks of successful attacks that could have devastating consequences.

Government hails Cyber Essentials success

Read more

Published: Wed, 23 Oct 2024 11:00:00 GMT

Government Hails Cyber Essentials Success

The UK government has welcomed the success of the Cyber Essentials scheme, which has seen over 50,000 organizations achieve the certification since its launch in 2014.

Cyber Essentials is a government-backed cybersecurity accreditation that recognizes organizations that have taken the necessary steps to protect themselves against common cyber threats.

According to the government, the scheme has helped to raise awareness of cybersecurity among businesses and has led to a decrease in the number of cyber incidents that have been reported.

“I am delighted that over 50,000 organizations have now achieved Cyber Essentials certification,” said Digital Infrastructure Minister Matt Warman. “This is a testament to the hard work of our businesses and organizations in protecting themselves against cyber threats.”

“The government is committed to supporting businesses in their efforts to protect themselves online,” Warman added. “Through the Cyber Essentials scheme, we are providing businesses with the tools and guidance they need to stay safe in the digital age.”

The Cyber Essentials certification is available to organizations of all sizes and sectors. It is based on five key security controls:

• Firewalls and intrusion detection systems
• Secure configuration
• Access control
• Malware protection
• Patch management

Organizations that achieve Cyber Essentials certification are eligible for a number of benefits, including:

• Reduced insurance premiums
• Improved access to finance
• Increased customer confidence

The government has also announced that it is working on a new version of Cyber Essentials that will be more rigorous and will include additional security controls.

“We are committed to ensuring that the Cyber Essentials scheme remains relevant and effective in the face of evolving cyber threats,” Warman said. “The new version of Cyber Essentials will build on the success of the current scheme and will help to protect organizations from the latest threats.”

The government’s commitment to cybersecurity is a welcome development. The Cyber Essentials scheme is a valuable tool that can help organizations protect themselves against cyber threats.

Detect ransomware in storage to act before it spreads

Read more

Published: Wed, 23 Oct 2024 09:52:00 GMT

Detection Techniques:

1. Anomaly Detection:

• Monitor storage activity for unusual patterns, such as sudden bursts of file encryption or file deletions.
• Use machine learning algorithms to identify deviations from normal behavior.

2. File Signatures:

• Scan files for known ransomware signatures or encrypted file patterns.
• Maintain an up-to-date database of known ransomware variants.

3. Behavior Analysis:

• Monitor processes and system calls associated with ransomware, such as encryption operations or command-and-control communication.
• Use behavioral heuristics to detect suspicious activities.

4. Metadata Analysis:

• Examine file metadata for evidence of tampering or encryption, such as changed timestamps or corrupted headers.
• Use forensic tools to recover deleted or hidden files that may contain ransomware artifacts.

Actionable Responses:

1. Real-Time Blocking:

• Trigger automated alerts and block suspicious file operations, such as encryption or deletion.
• Quarantine infected files and prevent them from spreading.

2. System Isolation:

• Isolate infected devices or storage volumes to contain the ransomware and prevent it from accessing other systems.
• Shut down the affected systems and disconnect them from the network.

3. Data Recovery:

• Implement a data recovery plan that allows administrators to restore unaffected files or roll back to a previous system state.
• Backup data regularly and store it in an offline or cloud-based location.

4. Investigation and Remediation:

• Conduct forensic analysis to determine the source and extent of the ransomware attack.
• Identify vulnerabilities and implement security measures to prevent future infections.
• Report the incident to relevant authorities or security agencies.

Best Practices:

• Implement robust access controls and user awareness training to prevent initial infection.
• Use firewalls, intrusion detection systems (IDS), and anti-malware software to block incoming ransomware threats.
• Regularly patch software and firmware to address vulnerabilities.
• Monitor storage activity and implement anomaly detection tools to detect ransomware early.
• Maintain offline or cloud-based backups to minimize data loss in the event of a ransomware attack.

How AI helps junior programmers and senior managers

Read more

Published: Wed, 23 Oct 2024 08:22:00 GMT

How AI Helps Junior Programmers

• Code Generation and Autocompletion: AI-powered tools can automatically generate code snippets or suggest code based on context, reducing time spent on writing redundant code.
• Bug Detection and Debugging: AI algorithms analyze code to identify potential bugs, saving time spent debugging manually.
• Code Quality Analysis: AI tools can assess code quality, identify code smells, and suggest improvements, helping to maintain high code standards.
• Learning and Training: AI-based platforms provide personalized learning experiences, tailored to the needs of junior programmers, helping them develop their skills.
• Documentation and Knowledge Management: AI assists in generating documentation, extracting insights from code, and organizing knowledge bases, making it easier for junior programmers to understand and maintain code.

How AI Helps Senior Managers

• Code Review Automation: AI algorithms can perform automated code reviews, freeing up senior managers for more complex tasks.
• Risk Assessment and Management: AI tools analyze code to identify potential risks and vulnerabilities, helping managers make informed decisions.
• Resource Planning and Allocation: AI can predict project timelines, estimate resource requirements, and optimize resource allocation.
• Team Performance Monitoring: AI algorithms track team performance, identify bottlenecks, and suggest improvements.
• Strategic Decision-Making: AI provides insights into project progress, code quality, and team dynamics, informing strategic decisions.
• Talent Management: AI-powered tools assist in identifying and developing talent, matching employees with suitable responsibilities.
• Improving Communication: AI can analyze code and extract high-level insights, enabling senior managers to communicate effectively with technical teams.

Additional Benefits for Both Junior Programmers and Senior Managers

• Increased Productivity: AI eliminates repetitive tasks, allowing both junior programmers and senior managers to focus on high-value activities.
• Improved Code Quality: AI helps ensure code meets high standards, reducing the likelihood of bugs and maintenance issues.
• Faster Development Cycles: AI automation accelerates code development and testing, reducing project timelines.
• Reduced Costs: Automated processes and improved efficiency lower development and maintenance costs.
• Increased Job Satisfaction: AI frees up time for more challenging and rewarding tasks, improving job satisfaction for both junior programmers and senior managers.

Democracy campaigner to sue Saudi Arabia over Pegasus and QuaDream spyware in UK court

Read more

Published: Wed, 23 Oct 2024 05:00:00 GMT

Saudi Arabia to Face Lawsuit in UK Court over Pegasus and QuaDream Spyware

A prominent democracy campaigner is set to file a lawsuit in the UK against Saudi Arabia, accusing the kingdom of using Pegasus and QuaDream spyware to target and harass opponents.

Details of the Lawsuit:

• The lawsuit will be filed by Saudi dissident Yahya Assiri, who alleges that he was surveilled by Saudi authorities using the spyware.
• Assiri claims that his iPhone was hacked using the Pegasus spyware, developed by the Israeli company NSO Group.
• He also alleges that QuaDream, another Israeli spyware company, provided software used in the surveillance.

Allegations against Saudi Arabia:

• The lawsuit alleges that Saudi Arabia has been using Pegasus and QuaDream spyware to target dissidents, journalists, and human rights activists.
• It claims that the spyware has been used to monitor communications, track movements, and access private information.
• Assiri argues that the use of spyware violates his privacy rights and is part of a wider pattern of repression in Saudi Arabia.

Implications for Saudi Arabia:

• The lawsuit could have significant implications for Saudi Arabia, which has been under international scrutiny over its human rights record.
• It could potentially lead to sanctions or other punitive measures against the kingdom.
• The case could also raise questions about the use of spyware by governments and the responsibility of companies that develop and sell such technologies.

Legal Basis:

• Assiri’s lawsuit will be based on the UK’s Data Protection Act 2018 and the Regulation of Investigatory Powers Act 2000.
• These laws protect individuals’ privacy and regulate the use of surveillance powers by authorities.
• Assiri argues that Saudi Arabia has violated these laws by illegally accessing and using his personal information.

Timeline:

• The lawsuit is expected to be filed in the High Court in London in the coming weeks.
• A hearing date has yet to be set.

Danish government reboots cyber security council amid AI expansion

Read more

Published: Tue, 22 Oct 2024 08:00:00 GMT

Danish Government Reboots Cyber Security Council Amid AI Expansion

Copenhagen, Denmark - The Danish government has announced the relaunch of its National Cyber Security Council (NCSR) to address the evolving challenges posed by artificial intelligence (AI) and emerging technologies.

The NCSR, originally established in 2018, aims to strengthen Denmark’s national cyber resilience and provide strategic guidance on cyber security matters. The rebooted council will focus on emerging threats, such as the use of AI in cyber attacks, ransomware, and disinformation campaigns.

“The rapidly changing technological landscape has introduced new challenges to our national cyber security,” said Minister of Justice Nick Hækkerup. “The relaunched NCSR will play a crucial role in ensuring that Denmark remains at the forefront of cyber defense.”

The NCSR will be led by a select group of experts from academia, industry, law enforcement, and the public sector. The council’s responsibilities include:

• Identifying and assessing cyber threats and vulnerabilities
• Developing and implementing cyber security strategies
• Fostering collaboration between different stakeholders
• Raising awareness about cyber security among the population and businesses

The council’s expanded focus on AI reflects the growing recognition of its potential impact on cyber security. AI can be used to enhance cyber defenses and automate detection and response processes, but it can also be exploited by malicious actors to develop more sophisticated attacks.

“AI has the potential to transform the cyber security landscape, both for good and for ill,” said Professor Jens Højgaard Jensen, a member of the NCSR. “The council will work to ensure that Denmark is equipped to harness the benefits of AI while mitigating its risks.”

The relaunched NCSR is part of a broader effort by the Danish government to strengthen its cyber security posture. Other initiatives include the development of a national cyber security strategy, increased investment in cyber defense capabilities, and public awareness campaigns.

By addressing the evolving threats posed by AI and other emerging technologies, the Danish government aims to maintain a high level of cyber security and protect its citizens, businesses, and infrastructure.

Labour’s 10-year health service plan will open up data sharing

Read more

Published: Tue, 22 Oct 2024 05:18:00 GMT

Labour’s 10-Year Health Service Plan: Opening Up Data Sharing

Labour’s comprehensive 10-year health service plan aims to transform the healthcare system in the United Kingdom. One crucial aspect of the plan is its focus on enhancing data sharing to improve patient care and streamline healthcare delivery.

Key Features of the Data Sharing Initiative:

• National Data Platform: The plan proposes the creation of a central National Data Platform that will securely collect and aggregate data from various health and care settings.
• Consent and Transparency: Patients will have clear and informed consent over the use of their data, with transparency on how it is shared and used.
• Interoperability and Standardization: The platform will ensure data is standardized and interoperable, allowing for seamless sharing between different systems.
• Data Analytics and Insights: The plan includes investments in data analytics and artificial intelligence to identify patterns, predict outcomes, and improve decision-making.

Benefits of Data Sharing:

• Improved Patient Care: Access to more comprehensive and timely patient data will enable clinicians to make more informed and personalized treatment decisions, leading to better patient outcomes.
• Efficient System Navigation: Patients will have faster access to the right services and specialists, reducing waiting times and improving the overall patient experience.
• Population Health Management: By aggregating data at a population level, the platform can identify healthcare trends, inform public health interventions, and track disease patterns.
• Research and Innovation: Researchers will have access to a vast and rich data repository, facilitating advancements in medical knowledge and the development of new treatments.

Safeguards and Privacy:

The plan emphasizes the utmost importance of data privacy and security. Robust measures are in place to protect patient information, including:

• Strong Encryption: All data will be encrypted in transit and at rest.
• Access Controls: Access to data will be strictly limited based on specific roles and responsibilities.
• Independent Oversight: An independent body will monitor and review the data sharing processes to ensure compliance and protect patient rights.

Implementation Timeline:

The full implementation of the data sharing initiative is expected to take place over several years. However, Labour’s plan outlines clear milestones and targets for each stage of the process.

Conclusion:

Labour’s 10-year health service plan recognizes the transformative potential of data sharing. By creating a central National Data Platform and implementing robust safeguards, the plan aims to improve patient care, optimize healthcare delivery, and accelerate research and innovation in the UK’s healthcare system.

What is tailgating (piggybacking)?

Read more

Published: Thu, 17 Oct 2024 18:01:00 GMT

How to build an incident response plan, with examples, template

Read more

Published: Wed, 16 Oct 2024 11:00:00 GMT

How to Build an Incident Response Plan

An incident response plan is a detailed guide outlining the steps to take in the event of a security incident. It helps organizations prepare for and respond to incidents in a coordinated and timely manner.

Steps to Build an Incident Response Plan

1. Define Incident Scope and Severity

• Determine what constitutes an incident, including breaches, malware attacks, or system outages.
• Establish severity levels (e.g., low, medium, high) based on impact and urgency.

2. Establish Incident Response Team

• Form a team of individuals from relevant departments (IT, security, legal, communications).
• Define roles and responsibilities for each team member.

3. Develop Incident Response Procedures

• Define clear procedures for:
  • Incident detection, reporting, and triage
  • Containment and eradication of threats
  • Evidence collection and preservation
  • Recovery and restoration of systems
  • Communication and coordination with stakeholders

4. Establish Notification and Escalation Processes

• Outline how incidents will be reported within the team and externally to appropriate authorities.
• Define escalation paths for severe incidents or when additional resources are needed.

5. Determine Resource Availability

• Identify necessary resources, such as software, hardware, and personnel, for incident response.
• Ensure availability of backups, recovery tools, and vendors for support.

6. Conduct Training and Exercises

• Train team members on incident response procedures and use of tools.
• Conduct regular exercises to test the plan’s effectiveness and identify areas for improvement.

7. Establish Communication Channels

• Create a communication plan for internal and external stakeholders.
• Establish protocols for media inquiries and public outreach.

8. Document and Monitor

• Document the incident response plan in writing and keep it up to date.
• Monitor incidents and review the plan’s effectiveness regularly. Make adjustments as necessary.

Sample Incident Response Plan Template

A. Incident Definition and Severity Levels

• Incident: Any unauthorized access, data breach, or system outage that disrupts business operations.
• Severity Levels:
  • Low: Minimal impact, can be resolved by internal teams within 24 hours.
  • Medium: Moderate impact, requires external support or extended remediation time.
  • High: Significant impact, requiring immediate action and escalation to senior management.

B. Incident Response Team

• Incident Commander: IT Security Manager
• Technical Team: Network Administrator, Security Analyst
• Legal Counsel: Legal Department Head
• Communications Manager: Public Relations Director

C. Incident Response Procedures

1. Incident Detection and Reporting

• Monitor security logs and alerts for suspicious activity.
• Employees report incidents via email or phone to the Incident Commander.

2. Containment and Eradication

• Isolate affected systems from the network.
• Run anti-malware scans and remove infected files.
• Identify and patch vulnerabilities.

3. Evidence Collection and Preservation

• Collect logs, network traffic, and other relevant data for forensic analysis.
• Preserve hardware and software for potential legal proceedings.

4. Recovery and Restoration

• Restore affected systems from backups.
• Reconfigure systems and implement security enhancements.
• Verify functionality and ensure data integrity.

5. Communication and Coordination

• Notify stakeholders (e.g., employees, customers, partners) as appropriate.
• Coordinate with external authorities (e.g., law enforcement, regulators) as necessary.

6. Post-Incident Analysis

• Review incident logs to identify root causes and lessons learned.
• Update incident response plan and procedures based on analysis.
• Conduct training to address identified gaps or weaknesses.

Cato further expands SASE platform for ‘complete’ UK delivery

Read more

Published: Wed, 16 Oct 2024 04:22:00 GMT

Cato Networks Expands SASE Platform for Enhanced UK Delivery

Cato Networks, a leading provider of cloud-based networking and security solutions, has announced the expansion of its Secure Access Service Edge (SASE) platform to deliver comprehensive connectivity and protection services in the United Kingdom.

Improved UK Coverage

The expansion includes the deployment of Cato Points of Presence (PoPs) in key UK locations, such as London, Manchester, and Edinburgh. These PoPs will provide customers with low-latency, direct access to Cato’s global network, enabling faster and more reliable connections to cloud and on-premises applications.

Enhanced Security Capabilities

In addition to improved connectivity, Cato’s expanded platform also offers enhanced security features tailored to the UK market. These include:

• Compliance with UK data protection regulations, including the General Data Protection Regulation (GDPR).
• Integration with UK-based security providers and threat intelligence services.
• Dedicated security teams focused on UK-specific security threats and regulatory compliance.

Complete SASE Solution

Cato’s expanded SASE platform provides UK businesses with a comprehensive solution that combines secure SD-WAN, cloud-native firewall, Zero Trust Network Access (ZTNA), and Cloud Access Security Broker (CASB) capabilities. This approach enables organizations to consolidate multiple security and networking solutions into a single, cloud-delivered service, reducing complexity and improving efficiency.

Benefits for UK Customers

• Improved performance: Reduced latency and increased reliability for cloud and on-premises connections.
• Enhanced security: Tailored security measures to meet UK regulatory requirements and protect against local threats.
• Simplified operations: Consolidated security and networking management through a single platform.
• Cost savings: Reduced infrastructure and maintenance costs compared to traditional on-premises solutions.

Quote from Cato Networks

“Our expanded UK presence demonstrates our commitment to providing organizations with a secure and reliable networking solution,” said Shlomo Kramer, CEO and co-founder of Cato Networks. “With our comprehensive SASE platform, UK businesses can now benefit from the latest cloud-based networking and security technologies, empowering them to achieve their business objectives.”

NCSC expands school cyber service to academies and private schools

Read more

Published: Tue, 15 Oct 2024 09:55:00 GMT

NCSC Expands School Cyber Service to Academies and Private Schools

The National Cyber Security Centre (NCSC) has extended its school cyber service to academies and private schools in England and Wales.

What is the School Cyber Service?

The School Cyber Service is an online platform that provides:

• Training resources: Guidance on cyber security best practices, online safety, and incident reporting.
• Cyber security advice: Tips and support on protecting systems and data from cyber threats.
• Incident reporting: A secure portal for reporting cyber security incidents and seeking assistance.

Why Expand the Service?

The NCSC recognizes that academies and private schools are facing similar cyber threats as state-funded schools. By expanding the service, the NCSC aims to:

• Increase awareness of cyber security risks and best practices.
• Empower schools to protect themselves against cyber attacks.
• Provide a consistent level of cyber security support across all educational institutions.

How to Access the Service

Eligible schools can register for the School Cyber Service by visiting the NCSC website: https://www.ncsc.gov.uk/topics/education/school-cyber-security-service

Benefits of the Service

• Enhanced cyber security knowledge: Training resources and advice help schools develop a strong understanding of cyber security.
• Improved incident response: Incident reporting tools facilitate quick and effective response to cyber threats.
• Protection of school data: Guidance on data protection and privacy helps schools safeguard student and staff information.

NCSC Commitment to Education

The expansion of the School Cyber Service reflects the NCSC’s commitment to protecting the education sector from cyber threats. By partnering with academies and private schools, the NCSC aims to create a more secure and resilient cyber environment for all students and staff in England and Wales.

Telefónica and Halotech integrate post-quantum encryption into IoT devices

Read more

Published: Tue, 15 Oct 2024 05:46:00 GMT

Telefónica and Halotech Integrate Post-Quantum Encryption into IoT Devices

Telefónica Tech and Halotech DNA have collaborated to integrate post-quantum encryption (PQC) into IoT devices, enhancing their security against future threats.

Post-Quantum Encryption

PQC is a set of encryption algorithms designed to secure data against attacks from quantum computers, which have the potential to break current encryption standards.

Integration into IoT Devices

Telefónica and Halotech have integrated PQC into Halotech’s IoT Edge X1 gateways, which connect and manage IoT devices and sensors. By implementing PQC, the gateways can now encrypt data securely, even against quantum attacks.

Enhanced Security

The integration of PQC significantly improves the security of IoT devices and networks. Traditional encryption algorithms used in IoT devices are vulnerable to quantum computers, but PQC ensures that data remains protected even against these advanced computational threats.

Benefits

• Protects IoT devices and networks from future quantum attacks
• Enhances data confidentiality and integrity
• Ensures compliance with emerging security standards
• Prepares IoT ecosystems for the advent of quantum computing

Collaboration

Telefónica Tech’s expertise in cybersecurity and Halotech DNA’s leadership in IoT hardware and software enabled this collaboration. Together, they have created a solution that meets the evolving security needs of IoT deployments.

Conclusion

The integration of PQC into IoT devices by Telefónica and Halotech DNA is a significant step towards securing the Internet of Things against future threats. By leveraging PQC, IoT networks and data can remain protected, even in the face of quantum computing advances. This collaboration demonstrates the importance of innovation and collaboration in safeguarding the digital future.

Robust cloud IAM should align to zero-trust principles

Read more

Published: Fri, 11 Oct 2024 13:26:00 GMT

Robust Cloud IAM Aligns with Zero-Trust Principles

Zero-trust security assumes that all users and devices are untrustworthy and requires continuous verification. Cloud Identity and Access Management (IAM) plays a crucial role in cloud security by implementing zero-trust principles, ensuring strong authentication, authorization, and access control.

Authentication:

• Multi-Factor Authentication (MFA): IAM requires MFA for accessing sensitive resources, adding an extra layer of protection beyond passwords.
• Certificate Authority (CA): IAM supports the use of CAs to issue digital certificates, verifying the identity of devices and applications.

Authorization:

• Role-Based Access Control (RBAC): IAM grants permissions to access resources based on roles, reducing the risk of unauthorized access.
• Least Privilege Principle: IAM assigns the minimum necessary privileges to users and applications, minimizing the potential impact of a compromised account.
• Conditional Access: IAM supports conditional access policies that restrict access based on factors such as device type, location, or time of day.

Access Control:

• Audit Logging: IAM logs all access requests and actions, enabling administrators to detect and investigate suspicious activity.
• Resource Permissions: IAM controls permissions for specific resources, ensuring that only authorized users can perform operations.
• Cloud Identity Federation: IAM allows integration with external identity providers, enabling single sign-on and centralized access management.

Benefits of Zero-Trust IAM:

• Enhanced Security: Requires continuous verification, reducing the risk of unauthorized access.
• Reduced Risk of Breaches: Limits the potential impact of compromised credentials by minimizing privileges and access.
• Improved Compliance: Aligns with industry best practices and regulations, ensuring compliance with data protection and security standards.
• Increased Visibility: Provides audit logging and centralized access tracking, enhancing security monitoring and incident response.

Best Practices for Robust Cloud IAM:

• Enable MFA: Require MFA for all sensitive resources and privileged accounts.
• Use RBAC and Conditional Access: Define clear roles and permissions, and restrict access based on relevant conditions.
• Implement Audit Logging: Monitor all access requests and actions for suspicious activity.
• Review Access Regularly: Regularly review user and application permissions to ensure they are up to date and appropriate.
• Use Cloud Identity Federation: Integrate IAM with external identity providers for centralized and secure access management.

By implementing these principles, organizations can significantly enhance the security of their cloud environments and protect their critical data and applications.

What is the Mitre ATT&CK framework?

Read more

Published: Fri, 11 Oct 2024 00:00:00 GMT

The MITRE ATT&CK framework is a structured taxonomy of adversary tactics, techniques, and common knowledge (TTPs). It provides a rich and free knowledge base for the cybersecurity community. By understanding the capabilities of adversaries, defenders can prioritize resources and develop effective defenses.

The framework is organized into 11 tactics and 181 techniques, which describe how adversaries can compromise systems and networks. Each tactic and technique is assigned a unique identifier, such as T1059 (Command and Control), which helps defenders identify and mitigate threats.

The framework is constantly evolving, as new techniques and tactics are discovered. It is used by a wide range of organizations, including government agencies, private companies, and academic institutions. The framework has been adopted by many security vendors and tools, which makes it easier for defenders to detect and respond to threats.

NCSC issues fresh alert over wave of Cozy Bear activity

Read more

Published: Thu, 10 Oct 2024 12:37:00 GMT

NCSC Issues Fresh Alert Over Wave of Cozy Bear Activity

The National Cyber Security Centre (NCSC) of the United Kingdom has released a new alert warning of an ongoing wave of malicious activity attributed to Cozy Bear, a Russian state-sponsored hacking group.

What is Cozy Bear?

Cozy Bear, also known as APT29 or The Dukes, is a well-known threat actor with a history of targeting government, diplomatic, and private sector organizations. They have been active since at least 2014 and are suspected of being responsible for several high-profile cyberattacks, including the 2016 Democratic National Committee hack and the 2018 SolarWinds supply chain attack.

The Current Wave of Activity

According to the NCSC, Cozy Bear has been targeting organizations in the UK and its allies since at least January 2022. The attacks typically involve:

• Spear phishing emails with malicious attachments
• Exploitation of vulnerabilities in software and network infrastructure
• Planting of malware to steal credentials and sensitive data

Targets and Objectives

The targets of Cozy Bear’s current campaign are primarily government and foreign policy organizations, as well as defense contractors and technology companies. The attackers’ objectives appear to be cyberespionage, collecting intelligence on foreign policy and national security issues.

Mitigation Measures

The NCSC advises organizations to take the following steps to protect themselves from Cozy Bear attacks:

• Implement strict email security measures to detect and block malicious attachments
• Patch software and network devices promptly
• Use strong passwords and two-factor authentication
• Monitor network traffic for suspicious activity
• Conduct regular security assessments and penetration tests

Importance of Information Sharing

The NCSC emphasizes the importance of sharing information about malicious activity with relevant authorities and trusted partners. By collaborating, organizations can better track and respond to such threats.

Conclusion

The ongoing wave of activity by Cozy Bear poses a significant threat to national security and critical infrastructure. Organizations must remain vigilant and take proactive steps to protect themselves from these sophisticated attacks. By adhering to best practices and collaborating with security agencies, we can minimize the impact of such threats.

What is threat intelligence?

Read more

Published: Thu, 10 Oct 2024 12:00:00 GMT

Threat intelligence is the knowledge and insights into the threats that an organization or individual is facing. It is collected from a variety of sources, such as security logs, intelligence reports, and open source information, and is used to inform security decisions and strategies.

Threat intelligence can be used to:

• Identify potential threats to an organization or individual
• Assess the severity of threats
• Develop and implement countermeasures to mitigate threats
• Track the evolution of threats
• Share threat information with others

Threat intelligence is a critical part of cybersecurity, and it can help organizations and individuals to protect themselves from a wide range of threats, including:

• Malware
• Phishing attacks
• DDoS attacks
• Insider threats
• Social engineering attacks

By leveraging threat intelligence, organizations and individuals can stay ahead of the curve and take proactive steps to protect themselves from the latest threats.

Government launches cyber standard for local authorities

Read more

Published: Thu, 10 Oct 2024 11:55:00 GMT

Government Launches Cyber Standard for Local Authorities

The government has launched a new cyber security standard specifically designed for local authorities. The standard, known as the Cyber Essentials for Local Government (CELG), is intended to help councils protect themselves from cyber threats and improve their overall cyber resilience.

Key Features of CELG

• Five key controls: CELG is based on the five key controls from the National Cyber Security Centre (NCSC)’s Cyber Essentials scheme:

  • Firewalls and Internet Gateways
  • Secure Configuration
  • Access Control and User Authentication
  • Malware Protection
  • Patch Management

• Tailored for local authorities: CELG includes additional guidance and resources specific to the challenges faced by local authorities, such as the protection of sensitive data and the need to meet regulatory requirements.

• Self-assessment tool: CELG provides a self-assessment tool that allows local authorities to assess their current cyber security posture and identify areas for improvement.

Benefits of CELG

• Improved cyber security: By implementing CELG, local authorities can significantly improve their cyber security defenses and reduce the risk of cyber attacks.

• Enhanced resilience: CELG helps local authorities build a more resilient cyber security infrastructure that can withstand and recover from cyber incidents.

• Compliance with regulations: CELG aligns with relevant regulations and standards, such as the General Data Protection Regulation (GDPR) and the Network and Information Systems (NIS) Directive.

• Easier insurance coverage: Some insurance providers may offer more favorable terms to local authorities that have implemented CELG.

Adoption and Support

CELG is voluntary, but local authorities are strongly encouraged to adopt it. The government has provided funding to support local authorities that need assistance with implementing CELG.

The NCSC and the Local Government Association (LGA) will provide ongoing support and guidance to local authorities through webinars, workshops, and other resources.

Conclusion

The launch of the Cyber Essentials for Local Government standard is a significant step towards improving the cyber security of local authorities and protecting the sensitive data they hold. By implementing CELG, councils can enhance their cyber resilience, meet regulatory requirements, and ultimately provide better services to their communities.

Internet Archive web historians target of hacktivist cyber attack

Read more

Published: Thu, 10 Oct 2024 11:00:00 GMT

Internet Archive Web Historians Target of Hacktivist Cyber Attack

San Francisco, CA - March 8, 2023

The Internet Archive, a non-profit organization dedicated to preserving the web and making digital content accessible, has become the target of a significant hacktivist cyber attack.

The attack, which began on March 6, has targeted the Archive’s Wayforward Machine, a tool that allows users to access archived versions of websites. Hackers have exploited a known vulnerability in the tool to gain access to user data, including IP addresses and search history.

In a statement released today, the Archive confirmed the attack and said it was working to address the vulnerability. The organization also urged users to change their passwords and be cautious of phishing emails.

“We take the security of our users’ data very seriously,” said Brewster Kahle, the Archive’s founder and executive director. “We are working around the clock to resolve this issue and protect the privacy of our users.”

The hacktivists responsible for the attack have not yet been identified. However, they are believed to be motivated by the Archive’s support for Ukraine and its decision to archive Russian propaganda websites.

The attack on the Internet Archive is the latest in a series of cyber attacks targeting organizations that support Ukraine. In recent weeks, the Russian government has been accused of launching cyber attacks against the Ukrainian government, banks, and media outlets.

The Internet Archive is a critical resource for researchers, journalists, and historians. The organization’s vast collection of websites and other digital content provides a unique and irreplaceable record of the web’s history.

The attack on the Archive is a reminder of the importance of cybersecurity and the need to protect our digital infrastructure from malicious actors.

About the Internet Archive

The Internet Archive is a non-profit organization dedicated to preserving the web and making digital content accessible. The organization’s mission is to provide universal access to knowledge and culture, and to keep the internet’s history available for future generations.

Contact:

Internet Archive
press@archive.org

How Recorded Future finds ransomware victims before they get hit

Read more

Published: Thu, 10 Oct 2024 11:00:00 GMT

Preemptive Detection Framework

Recorded Future’s Insikt Group employs a comprehensive framework to identify potential ransomware victims before they become targets. This framework leverages the following capabilities:

• Threat Intelligence Monitoring: Insikt Group continuously monitors a vast network of intelligence sources, including dark web forums, security blogs, and law enforcement databases.
• Machine Learning and AI: Advanced algorithms analyze threat data to detect patterns and identify suspicious activity that could indicate ransomware preparation.
• Human Analysis: A team of experienced threat analysts manually verifies and interprets the data to provide context and assess the severity of potential threats.

Indicators of Compromise (IOCs)

Insikt Group tracks and analyzes a wide range of IOCs associated with ransomware attacks, including:

• Phishing Campaigns: Email addresses and URLs used in phishing emails that distribute ransomware payloads.
• Malware Infrastructure: IP addresses and domains used by ransomware operators to host command-and-control servers, data exfiltration tools, and payment portals.
• Vulnerabilities: Exploitable software vulnerabilities that ransomware actors commonly target.
• Targeted Industries and Organizations: Specific industries and organizations facing elevated ransomware threats.

Data Enrichment

Recorded Future enriches the collected threat data with additional information to provide a comprehensive view of potential victims:

• Organizational Data: Industry, revenue, employee count, and other relevant information about potential targets.
• Cybersecurity Posture: Information about the victim’s cybersecurity defenses, such as antivirus software and incident response plans.
• Insurance Coverage: Data on the victim’s ransomware insurance policies and premiums.

Victims Identification

By combining IOCs, threat intelligence, and data enrichment, Insikt Group identifies organizations that exhibit a combination of the following risk factors:

• Exposure to specific vulnerabilities or known ransomware campaigns.
• Suspicious activity related to phishing or malware distribution.
• Weak or outdated cybersecurity defenses.
• High financial value or sensitive data assets.
• Lack of sufficient ransomware insurance coverage.

Notification and Mitigation

Once potential victims are identified, Recorded Future:

• Notifies the affected organizations directly or through trusted third parties.
• Provides specific details about the potential threats, including the IOCs involved and the recommended mitigation steps.
• Collaborates with victims to assist with incident response and remediation efforts.

By proactively identifying potential ransomware victims, Recorded Future empowers organizations to take defensive measures, strengthen their cybersecurity posture, and reduce their risk of becoming victims of a ransomware attack.

MoneyGram customer data breached in attack

Read more

Published: Wed, 09 Oct 2024 10:48:00 GMT

MoneyGram data breach

MoneyGram, a global money transfer company, has suffered a data breach that exposed the personal and financial information of its customers. The breach was discovered in January 2023 and affected customers who made transactions between 2013 and 2023.

Exposed data

The exposed data includes:

• Names
• Addresses
• Phone numbers
• Email addresses
• Transaction details
• Bank account numbers

MoneyGram has stated that there is no evidence that the data has been used for fraudulent purposes. However, the company is urging customers to be vigilant and to monitor their accounts for any suspicious activity.

MoneyGram’s response

MoneyGram has taken the following steps in response to the breach:

• Notified affected customers
• Set up a dedicated website and phone number for customers to get more information
• Offering free credit monitoring and identity theft protection services to affected customers

Recommendations for affected customers

MoneyGram recommends that affected customers take the following steps:

• Change their passwords for all online accounts
• Monitor their credit reports for any suspicious activity
• Be wary of phishing emails or phone calls that appear to be from MoneyGram

Impact of the breach

The MoneyGram data breach is a major security incident that could have a significant impact on affected customers. The exposed data could be used for identity theft, financial fraud, and other criminal activities.

Conclusion

The MoneyGram data breach is a reminder of the importance of protecting personal and financial information. Customers should be vigilant about their online security and should take steps to protect themselves from identity theft and other cybercrimes.