2022 Week 29 Security News Roundup
Summary
Almost all tracked areas had some news this week. It appears that there is again an uptick in activity targeting infrastructure at all levels.
News
SLTT
Puerto Rico partnered with the Multi-State Information Sharing and Analysis Center (MS-ISAC) to get 24/7 Security Operations Center (SOC) monitoring of its networked assets. This will supplement the SOC they staffed in 2021 after a string of cyber attacks.
Sophos reports that ransomware attacks on education institutions rose in the last year. Some key points are that 56% of lower education respondents had been victims, 64% for higher education. and 60% of all education institutions had some kind of successful attack which is 44% higher than last year.
A ransomware attack disrupted flood monitoring systems in the Indian state of Goa during life-threatening. The state says their 3rd party firm did not have security configurations and software up to date. On a personal note, I would say that even if you have 3rd party contractors, you as the owner, have the responsibility to ensure that vendors are living up to their responsibilities.
https://www.govinfosecurity.com/ransomware-locks-indian-flood-monitors-during-monsoon-season-a-19541
Deakin University in the Australian state of Victoria reports that nearly 47,000 students and alumni have had their personal data compromised. The university says that the Office of the Victorian Information Commissioners and a 3rd party are helping them recover from the breach.
SCADA General
Barracuda released their That of Industrial Security in 2022 report. It found that more than half of respondents rely on manual patching and few have dual-factor log-on services. More alarmingly, it found that 94% of respondents had some form of attack on their IoT systems.
Power
Ignitis Group was the victim of what is being described as their "biggest cyber-attack in a decade." The nature of the attack seems to be a very massive Distributed Denial of Service (DDoS) attack which disrupted its digital services and its website. A pro-Russian group named Killnet has claimed responsibility for this and a series of attacks against other Lithuania in response to their support for Ukraine in the war with Russia.
Water
Rhode Island sewer-system was hit with a cyber incident that affected operations in Providence and Blackstone Valley. At this time they are only saying that data on some systems was encrypted.
A subcontractor of the Colorado Springs water service was evidently the victim of a data breach. Roughly 200,000 accounts were in the file that was accessed. They indicate that no sensitive, proprietary, or confidential data was part of the breach.
Aerospace
Aerojet Rocketdyne settled a lawsuit for $9 from a former executive that had alleged that the company was not being responsible with sensitive rocket information. This is even after they were the victims of a Nation-State breach in 2013 and 2014.
Legislative actions
Joe Biden signed an executive order that prevents state or local governments from using information about abortion seeking against those who perform such searches.
India is vowing to crack down on cybercrime. Among the actions that were outlined were Stricter actions against cyber criminals, a committee dedicated to strategizing cybercrime efforts, and cybercrime awareness and prevention training.
The U.S. House Appropriators authorized $15.6 billion in cybersecurity funding with the largest part going to the defense department. Under the authorization, the DOD would get $11.2B and CISA another $2.9B which is $417 million more than the White House requested for the agency.
Comments
Post a Comment