2021 Week 17-18 Security Roundup
Summary
Spent a week driving around the western US then had to get caught up with work and school, so didn't have the time nor ability to post an update. Here is what has happened over that time frame.
For such a long time period there really is not too much actual news. In my scanning of sites, it appears that the focus has returned to financial sectors and work from home attacks. One of the things I have noted over the years is that these things tend to be cyclic, which could indicate that there is some dark web coordination that security practitioners are not yet privy to (though nation-state experts might be).
News
Washington D.C. police server hacked by Russian group
A Russian hacking group named Babuk posted screenshots that seek to prove that they have accessed several databases by the Washington D.C. police department. The group left a text document on their network outlining how to pay the ransom to get locked files back and to bribe them not to release the data to the gangs that were the subject of one of the databases. It appears that the D.C. police department is working with the Federal Bureau of Investigations (FBI) to investigate the breach.
https://therecord.media/ransomware-gang-threatens-to-expose-police-informants-if-ransom-is-not-paid/
Illinois Office of the Attorney General (OAG) hack
From the threat of release of data to an actual release, the DoppelPaymer ransomware gang release a collector of files from the Illinois OAG which was hacked by the gang previously. Since DoppelPaymer is a sanctioned entity, it is illegal to pay them, so the OAG opted not to pay the ransom.
Pulse Connect Secure hack
Pulse Secure, a common remote access tool used in government and industry, has been compromised by a group of Chinese actors. Cybersecurity firm Mandiant made the announcement the week of the 20th. Since then CISA and other government groups have posted bulletins warning government and critical infrastructure operators to scan their networks using the Pulse Connect Secure integrity Tool (https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44755) and if evidence of a breach is found to engage in mitigation efforts immediately. It appears that this had has allowed the Chinese government to have direct access to critical systems for months, but this does not seem as widespread as other attacks that have recently made the news. It was also announced in another bulletin that Russian actors (namely SVR/Cozy Bear have used a suite of 5 vulnerabilities in common software used by government and industry that include Pulse Secure.
It should be noted that Pulse Secure claims that they have fixed the issue and that everyone should upgrade to the newest version (currently Connect Secure 9.1R11.4).
https://securityaffairs.co/wordpress/116891/cyber-warfare-2/russia-svr-actively-targets-5-flaws.html
Government Bulletins:
Guilderland Central School District ransomware attack
A school district near Albany found some of its systems encrypted in a ransomware attack. The school moved students in 7th through 12th grades to all remote learning, They indicated that they were working with local law enforcement to investigate.
NSA has guidance on security IT-OT interconnectivity
The NSA released another cybersecurity advisory on the need to secure the connections between Operational Technology (OT) networks and Information Technology (IT) networks. Nothing really new for those working in the industry, but it is a reminder that we have to eliminate as many touchpoints to OT networks as we can. Opening them to the IT networks only increases the attack surface that has to be defended.
Government Advisory:
Legislative actions
The Civilian Cyber Security Reserve Act
The United States House of Representatives and the Senate have jointly released legislation to create a system molded after the Army Reserves or National Guard that focuses on cybersecurity. The goals will be to create a corps that can be called on to shore up our nation's defenses in the cyber realm.
Breach Notification Bill
The United States Senate Intelligence Committee is working on a bill to create a mandatory breach notification if companies lose access to your data. As previously mentioned this is tricky to get right as you have to balance a companies right to conduct business with people's ability to know the fate of their sensitive information. A lot of this was driven by the fact that several agencies and companies were infiltrated over the last couple of years and little to no public statements were made until someone else came forward.
Jobs
Oklahoma Municipal Assurance Group is looking for a security analyst. I know Keven personally and would work for him in an instant. Beyond that, as with a lot of insurance companies, pay and benefits are way above average for the size of the entity. Lastly, they are in a great part of the Oklahoma City metro area. It is safe and progressive (in more ways than just politically) so great local government and schools. While overall property costs are high in the area, within a 5-mile radius of the main office houses can be found at really reasonable prices.
Comments
Post a Comment