iCloud End-to-End Encryption Will Restart Debate; Internet Explorer is Mostly Gone But Still Needs Patching; Mitigate Flaw in Cisco Phones and Patch When Available

Interesting new features. But before you go ahead and require hardware tokens to access your account: Make sure you have a recovery plan for lost tokens. Apple should allow multiple tokens to be registered. Keep at least one backup in a safe place to protect yourself if your primary hardware token is lost. If implemented correctly, Apple will not be able to help you recover your content.

Johannes Ullrich

I’m placing the over/under at 6 months on how quickly a US intelligence or national law enforcement agency will brief the White House on how such end-to-end encryption is thwarting the investigation and apprehension of dangerous criminals. As a side bet, another over/under is 100TB – how much sensitive personally identifiable information will be compromised by then due to lack of use of end-to-end encryption. This is a debate that needs to happen, but we already know the negative impact of lack of use of encryption to protect stored data.

John Pescatore

This is simply a continuation of Apple’s plan to protect user privacy by employing end to end encryption. At the end of the day, a good thing for user privacy. Now the debate begins on potential loss of government ability to find and thwart on-line criminal activity against its citizens.

Curtis Dukes

The engineering effort to support taking existing data and running this type of encryption cannot be understated. Anything that goes wrong in the encryption/decryption process could mean tens of millions of backups that are no longer accessible. I want to put out there that this process must have taken a considerable effort and is a significant risk to the company. Kudos to Apple for attempting this at all.

Moses Frost

This is device-to-device encryption, not true end-to-end, i.e, person-to-person. The data will likely be in the clear on one or both of the devices. It will resist pervasive surveillance. It will raise the cost of investigation but not defeat it.

William Hugh Murray

You may consider Internet Explorer "legacy" at this point. But it may still be used to render content in Office documents.

Johannes Ullrich

North Korea, while a fairly underfunded state, still has this innovating team of individuals who find interesting ways to abuse Windows. Don’t underestimate their technical capabilities; they can still be effective. This is a classic one. Who would have thought IE11 is still the core rendering engine for HTML in Office in 2022? It would be as if I said IE6 was being used to render HTML in Adobe Reader. It’s rather shocking, but maybe not surprising.

Moses Frost

So far, no patch has been released. You may only disable CDP if you have LLDP enabled.

Johannes Ullrich

This vulnerability looks pretty serious for Cisco phones. CDP is a well-used protocol that does not require authentication and generally is gratuitously sent on the network. If a CDP packet can lead to a remote code execution, then patch these devices now. I cannot stress this enough, patch now. I still find very vulnerable network devices unpatched on a network, even when it is trivial to exploit, and the vulnerability has been known for over ten years. I cannot stress that a CDP packet that can cause RCE is terrible. Once someone is on one of these devices, they can quickly pivot to other parts of the network. If you cannot patch at this time, please make sure that these devices are on their network and that these networks are firewalled away from the data networks.

Moses Frost

Rackspace has done a good thing in warning its customers that “In situations like these, it's common for scammers and cybercriminals to try to take advantage.” Check your processes to be sure you’d be doing the same thing – once it is made public that Company X has been compromised and is notifying its customers, attackers pretend to be company X and try to scam passwords from customers. The important thing Rackspace has not yet divulged is *why* the attack succeeded – odds are high that reusable passwords were compromised somewhere. Ask your cloud service provider where they are in migrating privileged cloud infrastructure admin accounts to multi-factor authentication.

John Pescatore

Companies typically employ one of two approaches in breach notification: limit information made available on the attack; or be open and transparent about the incident. As Rackspace continues to investigate the cyber breach, let’s hope they fully share details of the event – to include what security applications were in place and operating. We all can learn from this unfortunate cyber incident.

Curtis Dukes

Be prepared to disclose both root cause and what you’ve done to prevent recurrence to both customers and regulators when you are breached. Transparency and honesty should be favored over spinning a story to make you look better.

Lee Neely

Another week, another cloud service breach. Executive leadership teams: use this cyber incident to reinforce implementation of configuration and access management processes for your cloud provided business operations. The Center for Internet Security makes available security configuration benchmarks for each of the major cloud service providers.

Curtis Dukes

While the cyber threat warning is specific to the Royal ransomware and healthcare sector, cyber gangs don’t divvy up critical infrastructure sectors amongst themselves. It’s more about a quick payout; ransomware gangs are targeting every infrastructure sector. That said, don’t let a good warning go to waste; revisit your cyber defense plan and its implementation.

Curtis Dukes

I hope you'll be able to upgrade your device to the latest update. Unfortunately, I only have two recommendations to ensure that you get updates. One, get on a Google Pixel device that will provide the latest and greatest updates. You could go with a flagship Samsung device, but there is no guarantee you will be patched. Two, as an alternative, you can get an Android One device that is guaranteed two years of updates. Unfortunately, these lower-end devices will probably have to be recycled if you want to be updated to date after two years.

Moses Frost

Increasingly, adversaries are targeting companies that provide digital services to both the private sector and government. From an attacker’s point of view, it’s more efficient to exploit once so that they can attack many. Both the 2019 Texas municipalities attack and this one are reminders for organizations to review their SLA with the digital service provider. Part of the review should include discussion on security controls that the service provider employs.

Curtis Dukes

If one is vulnerable to ransomware, a risk to which far too many are exposed, then one is also vulnerable to destruction or even malicious modification of one's data. Implement strong authentication, end-to-end application layer encryption or a structured network, and least privilege access control, the essence of a "zero trust" strategy.

William Hugh Murray