2023 Week 47
Summary
Slowly trying to bring this back since I have found no other place that collects this exact information. My also add a podcast feature around the first of the year.
News
CISA is exploring becoming a managed service provider of cybersecurity services to critical infrastructure entities. This is part of the ongoing efforts by the U.S. to take an expansive approach to cybersecurity.
SLTT
The City of Long Beach, California is deciding whether to declare a state of emergency in regards to their cyber incident that struck systems on the 14th. The attack affected public-facing services as well as some business operations but appears to have spared the public safety systems.
VMware Carbon Black researchers are seeing an uptick in infections related to NetSupport RAT that is targeting government and educational institutions. This is a further continuation of threat actors using legitimate remote access software to do attacks. In this case, it is normally done as a drive-by attack from compromised WordPress sites displaying bogus web browser updates.
Clark County Washington state detected on October 21, 2023 a cyber attack. Currently, they do not believe any citizen data was stolen or disclosed. This is the second network breach of the county networks in two years. The investigators are not 100% certain at this point if the current incident is related to the previous one.
Power
An element of the Bipartisan Infrastructure Law is providing $70 million of funding to help electric cooperatives, small investor-owned, and municipal utilities strengthen their cyber security posture. The funding is managed by the Office of Cybersecurity, Energy Security and Emergency Response (CESER) and the Rural and Municipal Utility Cybersecurity (RMUC). Information can be found on the program's page linked below.
https://www.securityweek.com/us-announces-70-million-cybersecurity-boost-for-rural-municipal-utilities/?web_view=true
https://infrastructure-exchange.energy.gov/Default.aspx#FoaIdcc9bd5a9-00e0-438d-9225-873fb1f4dffa
Water
Service public de l`assainissement francilien (SIAAP) which manages 275 miles of wastewater pipes in and around Paris, France was affected by a cyberattack on the 17th of November. An emergency order was issued that allowed the team to hire outside cyber experts and purchase any hardware needed to address the situation. As of now they are not disclosing who was responsible and no group has taken credit.
https://therecord.media/paris-wastewater-agency-hit-cyberattack?&web_view=true
https://www.siaap.fr/presse-publications/publications/detail/actualites/cyberattaque-dampleur-au-siaap/
https://www.siaap.fr/fileadmin/user_upload/attaque_informatique/arrete_urgence_imperieuse.JPG
Healthcare
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a mitigation guide tailored to Healthcare and Public Health entities. It focuses on vulnerability management.
https://www.securityweek.com/cisa-releases-cybersecurity-guidance-for-healthcare-public-health-organizations/?web_view=true
Welltok posted a data breach notification with Main's attorney general that sensitive data of over 1.6 million people. the information includes name, dob, address, and health information. Once again, a vendor makes for a ripe target.
The cybersecurity researchers at SafetyDetectives discovered a data breach that affected over 2 million Turkish citizens. The data seems to be vaccination records from 2015 to 2023. It is worth noting that the same place where this database was found also had a database of over 49 million Turkish citizens, meaning that linking the two data sets should be trivial.
https://www.hackread.com/hacker-leaks-turkish-citizens-vaccination-records/?web_view=true
https://www.safetydetectives.com/news/turkish-vaccinations-leak-report/
The Chief Operating Officer of Securolytics had pleaded guilty to compromising the systems of two hospitals to create business opportunities. In this case, it was the hospital's ASCOM phone system and it rendered more than 200 phones inoperable. He also stole the personal information of over 300 patients. This just goes to underscore the need to have a good vendor policy but also that sometimes non-data systems might be the critical system that gets attacked.
https://www.infosecurity-magazine.com/news/cybersecurity-executive-guilty/
https://storage.courtlistener.com/recap/gov.uscourts.gand.291147/gov.uscourts.gand.291147.102.1.pdf
https://www.bleepingcomputer.com/news/security/cybersecurity-firm-executive-pleads-guilty-to-hacking-hospitals/?&web_view=true
Education
The US FCC is proposing a 3-year pilot program to look at how the Universal Service Fund could be used to help schools and libraries strengthen their cybersecurity posture. They are currently accepting public comment.
The GoveTech article linked below goes into much more background on the threats and links to similar initiatives that have similar goals. They also go on to explain some of the attack profiles. This includes malware but also banking trojans. They point out that employee education and creating a security culture is still the best defense as most of the threat actors get support from often uninformed insiders.
The Record has an article summarizing several attacks against schools at all levels. It hints that minority-serving schools are being specifically targeted, but my one (unprofessional) belief is that is not the case, and schools in general are being targeted more now than before 2020.
Comments
Post a Comment