Tag: Cybersecurity

Microsoft Urges Customers to Patch Exchange Server “Zero Day” Vulnerabilities

Posted on by BeAware4lways

In a rare sharing of information about vulnerabilities in a blog post, Microsoft this week urged customers to download software patches to Microsoft Exchange Server after it detected “multiple 0-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks.”

According to Microsoft’s Threat Intelligence Center, “[W]e are sharing this information with our customers and the security community to emphasize the critical nature of these vulnerabilities and the importance of patching all affected systems immediately.” In the attacks Microsoft has observed, “the threat actor used these vulnerabilities to access on-premises Exchange servers which enabled access to email accounts, and allowed installation of additional malware to facilitate long-term access to victim environments.”

According to the blog post, the vulnerabilities being exploited were from state sponsored actors operating out of China.

The vulnerabilities being exploited were CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. Microsoft issued a patch, which can be accessed here.

MICROSOFT STRONGLY URGES CUSTOMERS TO UPDATE ON-PREMISES SYSTEMS IMMEDIATELY.

The post includes information on the threat actor, HAFNIUM, which has been behind numerous malicious exploits against “infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.”

The vulnerabilities detected by Microsoft affect Microsoft Exchange Server 2013, 2016, and 2019. If your company is running any of these versions, please consult Microsoft’s instructions on patching.

FinCEN Alerts Banks to Pandemic Relief Payment Fraud

Posted on by BeAware4lways

The Financial Crimes Enforcement Network (FinCEN) recently issued an advisory to banks that outlined fourteen red flag indicators to be on the lookout for (and report) related to pandemic related economic relief payments. Entitled “Advisory on Financial Crimes Targeting COVID-19 Economic Impact Payments,” FinCEN issued the advisory based on its “analysis of COVID-19-related information obtained from Bank Secrecy Act (BSA) data, public reporting, and law enforcement partners.”

The types of fraud that have been detected include criminals sending fraudulent checks to potential victims, and then requesting personal information in order to cash them; altering checks and depositing them via ATMs or mobile devices; counterfeit checks; theft of economic relief payments from the U.S. mail; phishing schemes using economic relief as the subject matter; and seizure of economic relief payments inappropriately (wage garnishment or debt collection).

FinCEN outlines fourteen financial red flag indicators that include “fraudulent, altered, counterfeit, or stolen EIP checks, Automated Clearing House deposits and prepaid debit cards.”  The indicators can be accessed here.

Episode 205 – Google’s Camille Stewart: InfoSec’s Lack of Diversity is a Cyber Risk

Posted on by BeAware4lways

Podcast: Play in new window | Download (Duration: 34:33 — 47.5MB) | Embed

Subscribe: Google Podcasts | Email |

Here’s the deal with the information security industry in the United States: our country doesn’t have nearly the number of information security professionals that it needs. According to an estimate from Cybersecurity Ventures, the shortage of US cyber security workers could reach 500,000 people in 2021. The other point worth noting is that the information security professionals we do have are overwhelmingly white and male.  ISC2 data show that just 24% of cybersecurity workers are women. Just 9% of workers self-identified as African American or Black, compared with 13%of the population at large. Just 4% identified as Hispanic, compared with 18% of the overall population. 

Camille Stewart is the Head of Security Policy for Google Play and Android at Google.
Camille Stewart is the Head of Security Policy for Google Play and Android at Google

We know that the shortage of infosec pros poses a cybersecurity risk. Companies across industries struggle to find and then retain information security professionals to staff security operations centers (SOCs) and manage the security of networks in sectors like government, healthcare and retail. 

Episode 148: Joseph Menn on Cult of the Dead Cow also Veracode CEO Sam King on InfoSec’s Leaky Talent Pipeline

But what about the lack of diversity? Do infosec’s racial and gender imbalances create their own kind of security risks? Does a homogenous population of security pros potentially blind the organizations they work for  – and our society – to cyber risks? Does it shut off exploration of potentially beneficial programs, solutions or avenues of inquiry that might help solve the epidemic of cyber security threats and attacks plaguing our society? 

You and your teams are not as effective and as able to address the threat without a diverse lens. 

Camille Stewart, Google

Episode 85: Supply Chain Attacks and Hacking Diversity with Leon Johnson

According to our guest this week: it just might. Camille Stewart is the Head of Security Policy for Google Play and Android at Google. She is also a Cyber Fellow at Harvard University’s Belfer Center for Science and International Affairs. Camille is the author of the essay “Systemic Racism is a Cybersecurity Threat” which ran on the Council of Foreign Relations website back in June of 2020.

In it, Camille argues that understanding how systemic racism influences cyber security is integral to protecting the American people and defending the country from cyber adversaries. 

In this conversation, Camille and I talk about her own journey to information security as a black woman and about the barriers that men and women of color face as they seek to enter information security.

We also discuss her theory on how the information security industry’s struggles to diversify might increase cyber security risks. Camille notes that the country’s history of systemic racism and the different lived experiences of black and white Americans bears on everything from the effectiveness of public information campaigns to hiring and recruiting within the field, to the U.S.’s efforts to foster international agreement on cybersecurity norms.

“We do a disservice to ourselves as practitioners to ignore race and gender,” Camille told me. “They are a direct impediment to the work we’re doing.”

Free Ransomware Service Offered to U.S. Hospitals

Posted on by BeAware4lways

The Center for Internet Security (CIS) announced last week that it has launched the Malicious Domain Blocking and Reporting (MDBR) service to assist U.S.-based private hospitals with ransomware and cyber-attacks for free. CIS, a not-for-profit entity, “is fully funding this for private hospitals at no cost, and with no strings attached, because it’s the right thing to do, and no one else is doing it at scale.” According to the announcement, the product is designed as a ransomware protection service and a “no-cost cyber defense for U.S. hospitals.”

CIS teamed up with Akamai to offer its Enterprise Threat Protector software to proactively identify, block and mitigate targeted ransomware threats. The service was previously available (and is still) to public hospitals and health departments through the Multi-State Information Sharing and Analysis Center (MS-ISAC), and according to CIS, over 1,000 government entities have used the product through MS-ISAC. To date, MDBR has blocked almost 750 million requests for access to malicious domains. If an organization uses MDBR, the software will cross-check the request with its database of known and suspected domains and “attempts to access known malicious domains associated with malware, phishing, ransomware, and other cyber threats will be blocked and logged.” The logged data are then analyzed, aggregated reporting is made available for the benefit of the hospital community, and remediation assistance is provided as appropriate.

CIS is now offering the service for free not only to public entities and governmental agencies, but to private hospitals, multi-hospital systems, integrated health systems, post-acute facilities and specialty hospitals. Sounds like a great opportunity for hospitals and facilities to add another tool in their toolboxes to combat ransomware and other cyber-attacks. For more information and to sign up, the CIS website is available here.

Episode 204: Josh Corman of CISA on securing the Vaccine Supply Chain

Posted on by BeAware4lways

Podcast: Play in new window | Download (Duration: 32:32 — 44.7MB) | Embed

Subscribe: Google Podcasts | Email |

In this episode of the podcast (#204) we’re joined by Josh Corman of CISA, the Cybersecurity and Infrastructure Security Agency, to talk about how that agency is working to secure the healthcare sector, in particular vaccine supply chains that have come under attack by nations like Russia, China and North Korea.

Incidents like the Solar Winds hack have focused our attention on the threat posed by nation states like Russia and China, as they look to steal sensitive government and private sector secrets. But in the vital healthcare sector, nation state actors are just one among many threats to the safety and security of networks, data, employees and patients.

Joshua Corman is the Chief Strategist for Healthcare and COVID on the CISA COVID Task Force.
Joshua Corman is the Chief Strategist for Healthcare and COVID on the CISA COVID Task Force.

In recent years, China has made a habit of targeting large health insurers and healthcare providers as it seeks to build what some have described as a “data lake” of U.S. residents that it can mine for intelligence. Criminal ransomware groups have released their malicious wares on the networks of hospitals, crippling their ability to deliver vital services to patients and – more recently – nation state actors like North Korea, China and Russia have gone phishing – with a “ph” – for information on cutting edge vaccine research related to COVID 19.

How is the U.S. government responding to this array of threats? In this episode of the podcast, we’re bringing you an exclusive interview with Josh Corman, the Chief Strategist for Healthcare and COVID for the COVID Task Force at CISA, Cybersecurity and Infrastructure Security Agency.

Cryptocurrency Exchanges, Students Targets of North Korea Hackers

In this interview, Josh and I talk about the scramble within CISA to secure a global vaccine supply chain in the midst of a global pandemic. Among other things, Josh talks about the work CISA has done in the last year to identify and shore up the cyber security of vital vaccine supply chain partners – from small biotech firms that produce discrete but vital components needed to produce vaccines to dry ice manufacturers whose product is needed to transport and store vaccines.

Episode 194: What Happened To All The Election Hacks?

To start off I asked Josh to talk about CISA’s unique role in securing vaccines and how the Federal Government’s newest agency works with other stake holders from the FBI to the FDA to address widespread cyber threats.

As always,  you can check our full conversation in our latest Security Ledger podcast at Blubrry. You can also listen to it on iTunes and check us out on SoundCloud, Stitcher, Radio Public and more. Also: if you enjoy this podcast, consider signing up to receive it in your email. Just point your web browser to securityledger.com/subscribe to get notified whenever a new podcast is posted. 

Health and Personal Information of N.C. Residents Posted Online by Ransomware Group

Posted on by BeAware4lways

Becker’s Health IT reports that two batches of sensitive information of Chatham County, N.C. residents have been posted online on the dark web and light web by the ransomware group DoppelPaymer, and that the files have been accessed more than 30,000 times.

DoppelPaymer obtained the information during a cyber-attack on the County’s systems on October 28, 2020. The group then uploaded the files on November 4, 2020, and again in late January. The posting of information like this usually happens when a victim of ransomware refuses to pay the ransom demand.

The information contained in the files included “medical evaluations of children from neglect cases, personnel records of some employees and documents related to ongoing investigations with the Chatham County Sheriff’s office.”

Chatham County is working to determine its obligations “to ensure we respond in the most appropriate manner possible.”

Cyber-attacks and Cybersecurity Failure Are Top Risks of the Next Decade Says World Economic Forum

Posted on by BeAware4lways

Although somewhat obvious, the World Economic Forum, in partnership with Marsh McLennan, SK Group and Zurich Insurance Group, recently issued its 16th edition of the Global Risks Report (the Report), which analyzes “the risks from societal fractures—manifested through persistent and emerging risks to human health, rising unemployment, widening digital divides, youth disillusionment, and geopolitical fragmentation” and determined that cyber-attacks are “key threats of the next decade.”

The Report outlines severe risks, including the COVID-19 pandemic, debt crises, climate change and a host of other predicted ailments, and cybersecurity is one of the top risks. The Report has mentioned cyber-attacks as a risk since 2012, and certainly the risk today is far more widespread than it has been in the past.

Cybersecurity failure is listed as a “top risk by likelihood” over the next decade. IT infrastructure breakdown is “among the highest impact risks of the next decade.” Weaving through the Evolving Risks Landscape Chart, cyber-attacks and data fraud or theft have jumped to the top of the list as a cluster.

In preparing for the global risks outlined in the Report, the World Economic Forum, although calling the risks outlined in the report “dire,” surmised that in contemplating the next crisis after COVID-19, “[T]he response to COVID-19 offers four governance opportunities to strengthen the overall resilience of countries, businesses and the international community: (1) formulating analytical frameworks that take a holistic and systems-based view of risk impacts; (2) investing in high-profile “risk champions” to encourage national leadership and international co-operation; (3) improving risk communications and combating misinformation; and (4) exploring new forms of public-private partnership on risk preparedness.”

Although the Report is brutally honest and transparent in its predictions, it perhaps is a snapshot in the future for business leaders to consider when planning strategies for business long term, including managing top risks by likelihood and impact to the organization. This would obviously include cybersecurity preparedness and resilience.