Surge of Critical Healthcare Attacks; Too Many High Priority Patches

Healthcare remains a target of both opportunity and choice. Increasing the cost, and reducing the surface, of attack in this industry is urgent.

William Hugh Murray

Patient care systems and applications should not be connected to the public networks.

William Hugh Murray

The most important quote from the Microsoft blog post is the rate of compromise of accounts using any type of MFA is less than 0.1% of the general population. Using the widely offered SMS-based 2FA options means a user is 1000 times less likely to have their credentials compromised. Before we start talking about more secure, but often single vendor-controlled alternatives, lets get that 1000x improvement in protection from phishing. If the apps (which are software written by vendors who are often issuing dozens of, often more than 100, applications patches per month) really do prove to be more secure, then the world can migrate to something more secure. I cant emphasize enough: the most important step is getting users away from reusable passwords.

John Pescatore

Implementing any form of MFA is a major improvement over a reusable password. Since you are able to forward SMS messages to your computer or other devices, using tools like Apple iMessage and Google Messages, interception is possible. Also, in the current environment, PSTN calls are also forwarded or otherwise re-routed, potentially exposing their data as well, as they are not encrypted end-to-end. Choose stronger authentication options such as the Microsoft Authenticator, Google Authenticator, prior to enabling SMS or voice verification options. Use a risk-based approach when selecting the authenticator strength for enterprise applications, which may lead you to require hard tokens for more sensitive data access, particularly when Internet accessible. NIST SP 800-63 provides guidance for selecting authenticator strength. https://www.nist.gov/itl/tig/projects/special-publication-800-63

Lee Neely

MFA without doubt is a key layer of protection against accounts being hijacked. While the use of Authenticator Apps is the preferred method as recommended by Microsoft it is important to consider the challenge of rolling out such Apps across your user base, in particular for those users who dont have corporate devices and may be resistant to installing a corporate app onto their personal device. You should look not just at MFA to defend your systems but also include other elements in a zero trust model.

Brian Honan

Courtneys First Law: "Nothing useful can be said about the security of a mechanism except in the context of a specific application and environment."

William Hugh Murray

Glad to see Microsoft finally joining the rest of the industry in standardizing on CVSS-based scoring. Next, they need to attack the issues around why enterprises seem to face obstacles to shortening Windows time to patch, even for the most critical vulnerabilities.

John Pescatore

While the change brings the notices in alignment with industry standards, evaluation information such as the scope, exploit path and consequences of exploit are no longer present, making it difficult to assess impact. Microsofts model is to apply all updates to end-user systems, such as Windows 10, and commodity servers; even so, have a good backup prior to updating, and regression test prior to deployment in production environments.

Lee Neely

The Adobe Connect fix is categorized as priority 3, meaning you can patch it with your normal patching process as its neither a traditional target nor under active exploit. Even so, if youre leveraging Adobe Connect for collaboration, application of the patch with your November activities is a good idea. The Reader Mobile vulnerability is Android specific and also a priority 3, which normal app store application updates should be able to support.

Lee Neely

These are the fourth and fifth updates for Chrome in the last three weeks. Unlike the prior three flaws, these were externally discovered and reported. And like prior updates, they are accompanied by claims of active exploit which drives the need for expeditious deployment. Dont forget to make sure that your mobile users are updating as well.

Lee Neely

The best mitigation is to protect PLCs by segregating them from unauthorized network access as they are not always engineered to handle general network traffic or probing.

Lee Neely