Interior's Wireless Network Problems (An Audit Success); Four Major Criminal Charges

This story is in "The Top of the News" not so much because the results are remarkable, but rather because the organization is remarkable; this is one of only two audit groups in government that have developed the technical skills to perform hands-on audits that go beyond checklists and questionnaires.

Alan Paller

While there are always tradeoffs between security and usability, particularly with Wi-Fi, having an independent entity perform an active test is an important component to verifying the resulting security meets expectations for protecting services available from that network. Also make sure that you are able to detect these activities, which may necessitate the deployment and integration of a Wireless IPS, which can also help detect use of wireless in areas it is not permitted, rogue networks, and unauthorized devices.

Lee Neely

This is an example of the value of active testing by auditors/IGs that I mentioned in the Newsbites 73 item about the USPS audit results. In the DoI report, the authors point out doing active testing is NOT beyond the capabilities of audit team budgets, though it definitely requires investment on the technical skills side. Here's the quote from the report: "We conducted reconnaissance and penetration testing of wireless networks representing each bureau and office. To do this, we assembled portable test units for less than $200 that were easily concealed in a backpack or purse and operated these units with smartphones from publicly accessible areas and locations open to visitors. Our attacks simulated the techniques of malicious actors attempting to break into departmental wireless networks, such as eavesdropping, evil twin, and password cracking."

John Pescatore

While the result here is terrible, the take-away is to verify the viability of your contingency plans. Over the last six months we've been made painfully aware of our limitations in supporting a 100% remote workforce, and adapted accordingly. Now that we've got the mindset, apply that sort of thinking and review to DR plans and adjust where needed.

Lee Neely

Those organizations and Cyber Insurance companies who have made extortion payments to the criminals behind ransomware attacks have enabled these criminals to become better funded, more sophisticated, and more motivated. It's a sad reality that inevitably this evolution in criminals' capabilities would result in serious consequences. If your organization becomes a victim of ransomware take a good look at the long term consequences of what paying that ransom may have. You may get your data back, but others may pay higher cost at a later stage.

Brian Honan

Not so much "negligent" as "reckless," that is unless one wants to charge the hospital with negligence. With the number of extortion attacks against the health care sector, it was only a matter of time until one would result in serious injury or death.

William Hugh Murray

Increased distance learning and rapid adoption of technologies to support that has presented both a larger attack surface and increased opportunities for adversaries. This increased remote access heightens the need for diligent application of patches and verified security configurations for new and existing capabilities. Lastly, UAT activities, such as phishing exercises, must continue. Think twice before avoiding COVID-themed items as these are being actively used by adversaries.

Lee Neely

The NCSC has a great guide on combatting malware and ransomware which was recently updated and is available at https://www.ncsc.gov.uk/blog-post/rebooting-malware-and-ransomware-guidance. Europol also has excellent resources on dealing with ransomware at their NoMoreRansom website at https://www.nomoreransom.org.

Brian Honan

Adobe gives this update a priority of 3, meaning the product is historically not a target for attackers, and that updates can be applied at your discretion. While creative cloud users are likely already being prompted to update, make sure the update is added to your minimum baseline checks. Asses your install base when weighing the risks of patching now versus waiting for your October update cycle.

Lee Neely

Previous research revealed weaknesses in the pairing activities, and impacted both BTLE and traditional Bluetooth. This weakness takes advantage of the specification's provision for things to "just work," which allowed the reconnection to continue without the authentication. Exploiting the weakness requires physical proximity and network access. The weakness is not being exploited in the wild. Some vendors, such as Apple, have released vendor-specific fix for this vulnerability, but not all vendors are expected to follow suit.

Lee Neely

So called "researchers" continue to disclose problems instead of recommending solutions.

William Hugh Murray

Unlike last week's release of iOS 13.7 and 13.6 prior to that which did not address any CVEs, iOS 14 does address 11 security issues, so you're going to want to require adoption of this version. Make sure that your MDM agent supports iOS 14; even so you may need to push (or have users install) updated software on their devices prior to installing iOS 14. If you have been using the keychain to store passwords, the new password management functionality now includes breach notification and will alert you as to which of your account passwords have been compromised as well as assist you in changing them.

Lee Neely