Copy
Get the latest cybersecurity, privacy, and surveillance news for information security professionals

IT Security News Blast – 11-19-2020

Trump fires CISA Director Christopher Krebs by tweet
"Anytime the government loses well-respected cyber professionals like Chris Krebs, especially under these political circumstances, there’s bound to be at least a momentary downside impact on CISA’s morale," said Drex DeFord, healthcare executive strategist for CI Security, to Healthcare IT News. DeFord continued, "Healthcare clearly leans on CISA to provide insights to cybersecurity threats, and given the multiple stressors on healthcare organizations today, we can ill-afford any glitches in the capabilities of CISA, or their ability to quickly and effectively coordinate with valued cyber-partners like the FBI, HHS, and Homeland Security.
https://www.healthcareitnews.com/news/trump-fires-cisa-director-christopher-krebs-tweet
 
Analysts Warn: DDoS Attacks Likely to Surge
DDoS-style attackers who demand a ransom to stop their attacks are finding that model profitable, says Roger Barranco, vice president of global security operations at Akamai. "The simple fact that they are making profits indicates this could be a very real threat to continue into 2021, incentivizing other threat actors who also want a piece of the lucrative action via the model of 'RDDoS'," Barranco tells Information Security Media Group.
https://www.inforisktoday.com/analysts-warn-ddos-attacks-likely-to-surge-a-15365
 
A Smarter Security Strategy for Healthcare Risks
An active detection campaign is one that includes the ability to seek malicious lateral movements within the network. Deception technology is a category of security tools designed to detect attackers who are already in the network and prevent them from doing damage. It works by distributing deceptions that mimic genuine IT assets throughout the network. Instead of relying on traditional signatures, deception technology alerts are generated by real attacker movements within a network.
https://securityboulevard.com/2020/11/a-smarter-security-strategy-for-healthcare-risks/
 
Cybercriminals Target Healthcare Industry During The Pandemic
On top of this, your remord since the last Carnegie FinCyber paper on the cyber threat landscape. But a lot has happened since, most notably the largest-scale public health emergency in a century. Cyber threat actors have not stood still in this period. Many groups have been capitalizing on the turbulence in order to up their game and exploit their victims. Stepping back from this, however, the predominant motivations have not changed (see table 1).
https://carnegieendowment.org/2020/11/18/enduring-cyber-threats-and-emerging-challenges-to-financial-sector-pub-83239
 
Why Banks And Financial Institutions Must Increase Cybersecurity Measures During the Festive Season
The financial and retail sectors continue to be the primary targets of malicious threat actors who are relentless in their efforts to steal hi-rated assets, money, and valuable data. The distractions that are typical to the festive season can render financial institutions offguard, thus, soliciting an ideal time for cybercriminals to put their nefarious schemes into action.
https://www.entrepreneur.com/article/359932
 
Haste makes waste: Is your financial institution’s rushed digital transformation safe?
The acceleration of financial institutions’ digital transformations is an overall positive development, but it doesn’t come without risks. Rapid changes to established technologies and processes may leave vulnerabilities that bad actors can take advantage of. To support a streamlined, consistent digital customer experience while also ensuring security, your organization may need additional layers of protection.
https://www.itproportal.com/features/haste-makes-waste-is-your-financial-institutions-rushed-digital-transformation-safe/
 
Cyberattack could ‘sow mistrust’
The cyber-attack which leveled the Chatham County government computer network three weeks ago disconnecting phone lines and email services and prohibiting access to county records — could have been launched to sow doubt in the integrity of the elections process, according to a local cyber security expert. [...] But the intention may not have been to corrupt the elections system — just to promote distrust among the electorate, according to a local cyber security expert and former senior Homeland Security employee who spoke to the News + Record on the condition of anonymity to discuss potentially sensitive information.
https://www.chathamnewsrecord.com/stories/cyber-attack-could-sow-mistrust,7265
 
Post-Brexit UK announces largest military investment since Cold War
The government said the increased military spending will cement the United Kingdom’s position as the largest defence spender in Europe, the second largest in NATO, and allow increased investment in areas such as cyber and space. The prime minister will announce a new agency dedicated to artificial intelligence, the creation of a National Cyber Force and a new “Space Command”, capable of launching Britain’s first rocket in 2022.
https://www.reuters.com/article/us-britain-defence/post-brexit-uk-announces-largest-military-investment-since-cold-war-idUSKBN27Y317
 
IDF tests its victory concept in latest war drill
"To build a drill at the scope of the Lethal Arrow exercise means preparing for the whole of the military to take part," stated Fridman. "That means there are forces moving on foot, planes in the air, ships at sea, units from the C4i and Cyber Defense Directorate, trucks from the Logistics and Technological Directorate, and Military Intelligence – all working simultaneously.
https://www.israelhayom.com/2020/11/18/idf-tests-its-victory-concept-in-latest-war-drill/
 
Canada names China, Russia as main cyber-crime threats; sees risk to power supply
The Communications Security Establishment (CSE) signals intelligence agency, equivalent to the U.S. National Security Agency, said the four nations’ programs posed the greatest strategic threat to Canada. “State-sponsored cyber activity is generally the most sophisticated threat,” CSE said in its second national cyber threat assessment. Canada’s relations with China have soured notably over the last two years, while Ottawa is a harsh critic of Moscow.
https://www.reuters.com/article/canada-cyber/canada-names-china-russia-as-main-cyber-crime-threats-sees-risk-to-power-supply-idINL1N2I41U1
 
Bill to Secure Federal Government’s Connected Devices Heads to the President’s Desk
Cybersecurity professionals, including a senior former official, cheered unanimous passage of the bill—H.R. 1668, which the House passed in September—through the Senate Tuesday evening as it now heads to the president’s desk for a signature. The bill calls for NIST to develop guidelines with basic security features the devices should have—within 90 days of enactment—and those for disclosing security vulnerabilities—within 180 days of enactment—that agencies must follow when making their procurement decisions.
https://www.nextgov.com/cybersecurity/2020/11/bill-secure-federal-governments-connected-devices-heads-presidents-desk/170159/
 
Cyber-Espionage comes out of the shadows and into the spotlight
The top industries commonly targeted are unsurprisingly Public Sector (31 percent) followed by Manufacturing (22 percent) and Professional (11 percent), likely due to the fact that they hold the majority of secrets and priority information which are most desired by cyber espionage criminals. Where Cyber-Espionage attacks differ is in the tactics utilized and the skill and patience of the criminals. Malware (90 percent), Social (83 percent) and Hacking (80 percent) are the top tactics used by Cyber-Espionage threat actors.
https://www.verizon.com/about/news/cyber-espionage-comes-out-shadows-and-spotlight
 
Companies could face hefty fines under new Canadian privacy law
Innovation Minister Navdeep Bains introduced the Digital Charter Implementation Act today — officially called an "Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts." [...] If the bill passes, companies could face fines of up to five per cent of global revenue or $25 million — whichever is greater — for the most serious offences.
https://www.cbc.ca/news/politics/privacy-bill-bains-fines-1.5804779
 
Be Very Sparing in Allowing Site Notifications
Approving notifications from a site that uses PushWelcome allows any of the company’s advertising partners to display whatever messages they choose, whenever they wish to, and in real-time. And almost invariably, those messages include misleading notifications about security risks on the user’s system, prompts to install other software, ads for dating sites, erectile disfunction medications, and dubious investment opportunities.
https://krebsonsecurity.com/2020/11/be-very-sparing-in-allowing-site-notifications/
 
Heads up: A new strain of card-skimming Grelos malware is on the loose
Spotted in the wild as part of the compromise of US-based Boom! Mobile earlier this year, the latest Grelos strain was linked to Fullz House, a hacking crew that combined the skills of two separate criminal gangs who respectively specialised in phishing and card skimming, as RiskIQ previously explained in a separate blog post.
https://www.theregister.com/2020/11/18/magecart_grelos_research/
 
Cisco rolls out fix for Webex flaws that let hackers eavesdrop on meetings
The vulnerabilities were discovered by IBM Research and the IBM’s Office of the CISO, which analyzed Webex because it’s the company’s primary tool for remote meetings. The discovery comes as work-from-home routines have driven a more than fivefold increase in the use of Webex between February and June. At its peak, Webex hosted up to 4 million meetings in a single day.
https://arstechnica.com/information-technology/2020/11/cisco-rolls-out-fix-for-webex-flaws-that-lets-hackers-eavesdrop-on-meetings/
 
The 200 Most Common Online Passwords of 2020 Are Awful
There were some newcomers to the list this year like ‘naruto’ and ‘yugioh,’ coming in at 112 and 142 respectively. Anime fandom aside, the list shows just how lacking passwords are for the current moment. Coming in at number one is ‘123456,’ and it was used 2,543,285 times…come on, people.
https://www.vice.com/en/article/m7avx8/the-200-most-common-online-passwords-of-2020-are-awful

You are receiving this email because you are subscribed to receive the IT Security Daily Blast email from Michael Hamilton, Founder, President, and CISO of CI Security, formerly Critical Informatics.

Archived articles are available at https://ci.security/news/daily-news.

CI Security and the CI Security logo are the trademarks of CI Security, Inc. All other brand names, trademarks, service marks, and copyrights are the property of their respective owners.

© 2020 CI Security. All rights reserved.


 

CI Security

245 4th St, Suite 405  Bremerton, WA   98337

About Us   |   CI Security News   |   Contact Us 


Add this Email to Your Address Book





unsubscribe