More evidence cyber hygiene is failing during pandemic

With an increased reliance on on-line purchases, users also need to take precautions, such as enabling alerts, and possibly authorization, for card-not-present transactions; rather than depending on merchants keeping their systems patched.

Lee Neely

The current isolation and work from home activities have seen a spike in porn site use, which puts systems used for both personal and work purposes at higher risk for this attack. Providing users a secured virtual environment, rather than processing business data directly on their personal system, provides needed separations from compromise on these systems. Additionally, consider limiting or blocking the use of Internet Explorer and Adobe Flash accessing internet sites from corporate systems.

Lee Neely

Application security testing, utilizing both dynamic and static analysis and resolution of discovered issues, has to be baked into the CI-CD pipeline. The auditor should not be the first one to analyze your code for defects. If you are running regulated systems, in this case FISMA, the NIST risk management framework allows for a lot of local control and attestation of adherence to required standards as dictated by the system accreditation letter. Even so, those choices require both monitoring and regularly verified, documented adherence to requirements continue to use this lighter wait ongoing authorization.

Lee Neely

The USPS IG audit appears to be the typical document review that found missing certification/accreditation documentation, vs. any active testing. That did find mention of the "... 12 vulnerabilities related to ***** labeled as catastrophic by the CISO" but assumes all the other apps that had C&A documentation did not have vulnerabilities. Last year SANS gave Interior a SANS Difference Makers Award to Jefferson Gilkeson, the Director of IT Audit at the Department for his implementation and championing of active testing by Inspectors General.

John Pescatore

John Pescatore is correct to point to the work of Interior's Jefferson Gilkeson and his staff as the model for effective recruiting, skills development, and technical auditing that can be trusted. Gilkeson identified the skills and methods that are needed by professionals on an effective cybersecurity audit team and has shared his finding with audit leaders throughout government.

Alan Paller

While the VA is offering credit monitoring to affected veterans, as well as guidance on how to protect their information, don't wait to find out if you're impacted. If you don't already have credit monitoring from the 2006 VA breach, now is the perfect time to get it.

Lee Neely

School systems and municipalities continue to be targets of extortion attacks in part because they have access to the (taxpayers') funds to pay but lack the necessary scale, resources, and organization to resist the attacks.

William Hugh Murray

If your incident response in itself causes a Denial-of-Service (in this case an "overreacting IP block") then you inadvertently help your attackers achieve their goals. Incident response plans and procedures should be regularly tested and simulated to ensure your processes respond to an attack work as expected.

Brian Honan

Keeping services such as these updated and secured has to be a basic part of your Cyber Hygiene. A bulletin such as this can be leveraged to start the conversation about overall protections, particularly on boundary control devices. Don't limit the conversation to only the services identified; be sure to examine your overall process.

Lee Neely

There is a common thread between this item and the item on Magento vulnerabilities being exploited - these are well-known vulnerabilities with existing patches or new versions. The "state-sponsored" in the headline is click-bait - the attacks are easily avoided by basic security hygiene. I'd like to see a follow-up article on what percentage of these attacks succeed.

John Pescatore

The good news is that the distributed ledger retains all the transaction data and the blockchain preserves and protects it. The bad news is that the amount of activity, some generated for this purpose, obscures the information. What is needed are tools and services to analyze the data so as to provide transparency and accountability. Some tools and services are already in use.

William Hugh Murray

Multi-factor authentication is also a win here. Many financial institutions offer security questions as part of the authentication process; users have to be careful to choose questions and answers which cannot be readily derived via OSINT. Use of security questions or one-time-passwords in conjunction with a memorized secret (PIN or Passcode) reduces the likelihood of a successful attack. If your FI doesn't offer multi-factor authentication, ask them how they are protecting accounts from an attack like this before enabling on-line account access.

Lee Neely

Financial institutions should offer their customers Strong Authentication options and encourage their use. (Customers can use password managers and biometrics to reduce any inconvenience.)

William Hugh Murray