Ransomware IS the Story

However an enterprise elects to deal with a compromise resulting in extortion demands, and even though most will never be investigated by law enforcement, they should all be reported via the Internet Crime Complaint Center (IC3). This is about intelligence, not law enforcement. It is essential that we measure the threat rate, sources, and methods.

William Hugh Murray

COVID related activities remain a target of ransomware operators. With the intense pressure to deliver a cure, your support for your users to help them continue to make good choices is critical, both through training and technical countermeasures. Also watch for attempts to exfiltrate data, including IP related to the security measures being developed to counter the threat. Verify externally facing and collaboration services remain securely configured and monitor for unauthorized access.

Lee Neely

Note that the breach of this enterprise and the exfiltration of this data took time measured in days, not minutes or hours. Enterprises should have measures in place to detect breaches and remedy them in hours, not days.

William Hugh Murray

Most Azure services have an SLA of 99.9% availability but with many limitations, specific definitions, and other contractual language. Service levels that don't meet the terms enable your company to claim credits, but they generally don't happen automatically. Bottom line is that cloud SLAs do not really cover outage costs and continuity plans have to be in place (and periodically tested) for all critical cloud services.

John Pescatore

As John says, make sure you understand the SLA for your cloud and outsourced service providers. Monitor services to ensure the service levels are met and provide evidence for requesting credits or other compensation. Also keep an eye on costs associated with service monitoring to make sure they don't exceed actual returns.

Lee Neely

Changes to such systems should be applied at a measured rate and in such a way that they can be easily backed off if they cause a problem.

William Hugh Murray

Foreign agents targeting cleared individuals is nothing new; making the indicators and steps readily available is a nice assist from the FBI. They are valuable whether or not you have a security clearance. If you have a social media presence, as most of us do, reviewing account settings and ensuring you're only connecting with known or legitimate contacts needs to be SOP.

Lee Neely

While movement to a standard like RPKI which would cause changes to routing to be verified before problems arise is needed, according to the NIST RPKI monitor, only about 23% of unique IPV4 Prefix/Origin pairs are using it. https://rpki-monitor.antd.nist.gov/

Lee Neely

Just as in last week's DHS/CISA alert about a compromised government agency, this Visa alert starts out with "Legitimate user accounts, including an administrator account, were compromised as part of this phishing attack and were used by the threat actors to login to the merchant's environment." Administrator accounts that don't require more than a reusable password are the gaping wound that is continually causing high rates of damage to entire businesses. And they are easily treatable.

John Pescatore

"Card-not-present" fraud will likely continue as long as the brands and issuers continue to publish Primary Account Numbers in the clear, merchants continue to accept them, and consumers tolerate these unsafe practices. With exceptions, the European Banking Authority is now requiring "multi-factor" authentication for "card-not-present" transactions. The preferred implementations for meeting this requirement use one-time passwords sent out-of-band (e.g., SMS, e-mail). Merchants should prefer check-out proxies like PayPal, Apple Pay, Click to Pay, and their competitors and brands and issuers should encourage their use. Consumers should prefer merchants who provide access to these proxies and, in their absence, consider the use of one-time or one-merchant tokens, from, for example, Privacy.com.

William Hugh Murray

The developer was notified of the vulnerabilities on September 16th and had released patches the next day. Free Wordfence users will have firewall rules to prevent exploitation October 16th; don't wait to verify that you've already deployed the updates.

Lee Neely

"Cross-site scripting" describes an attack, not a "flaw." The vulnerability is "incomplete parameter checking" at the application layer. While complete parameter checking in the modern "stack" is difficult, it is easiest and necessary at the application layer. However, in this case, the problem is aggravated by the failure to limit and compensate for the use of WordPress plugins; one imports the vulnerability. These plugins come with no representations of quality and historically have been problematic. They should be used sparingly and the risk should be compensated for.

William Hugh Murray

The number of data elements required for COVID reporting, and the protection of that data, quickly exceeds what you can manage in Excel, which was likely selected as a fast path to capture and report data in the midst of a crisis. The hard part will be qualifying an application, verifying its security and moving reporting to APIs rather than uploaded Excel files, all without introducing further delays. While this is the same process we use to convert a manual process to an enterprise one, and the pandemic changes the priority, care must be taken to ensure the data is properly handled and recorded to prevent data loss, disclosure, or other legal entanglements.

Lee Neely