US Treasury Breached Using Stolen BeyondTrust Key; Feeling Aftershocks of Salt Typhoon Intrusion; Security Update to HIPAA Proposed

Another example of a supply chain attack as we end one year and start a new one. Seems like every software vendor is now offering a SaaS solution as part of the product roadmap. Organizations must now plan and measure third parties as part of their cybersecurity program. A good starting point is CIS Critical Security Control 15, Service Provider Management, that includes seven safeguards to ensure providers are protecting those platforms and data appropriately. https://www.cisecurity.org/controls/service-provider-management

Curtis Dukes

BeyondTrust identified CVE-2024-12356, CVSS score 9.8, and CVE-2024-12686, CVSS score 6.6, command injection vulnerabilities, in their cloud and self-hosted services. The cloud services have been patched. If you're self-hosting, BeyondTrustPrivileged Remote Access (PRA) and/or Remote Support (RS), you need to update to versions newer than 24.3.1. Take this as an example to consider when using cloud/outsourced services for remote access to endpoints. Make sure you have visibility to those accesses, are able to shut down unauthorized attempts, have secured the RS API, and fully understand how that access is managed/secured.

Lee Neely

It's unclear in many of these articles which cloud or key was used. Interestingly, the IOCs in the 'known IOC' list are all DigitalOcean IP addresses. This particular intrusion is interesting, and I'm waiting for more details about what happened. Is BeyondTrust at fault, or was there a lapse in security, etc.? We will have to wait for more information.

Moses Frost

Private cryptographic keys should be stored only in hardware security Modules (HSMs) that permit their use but cannot disclose them.

William Hugh Murray

The resulting new security requirements from the FCC are expected to be ruled on January 15th. Until the telecom services implement the expected minimum security improvements, consider the guidance for secure communications from NIST published last month.

Lee Neely

Do you have "leaked personal phone calls, SMS messages, and cell phone location" in your personnel threat models? Yikes...

Christopher Elgee

HIPAA continues to be in the ditch. Not only are covered entities targets of choice, but the responsibilities imposed by the law have had the perverse effect of slowing the implementation of electronic health records by twenty years. All of this is the result of placing the responsibility for risk assessment on the covered entities. The intent was to avoid "prescription," but the covered entities were not equipped to do the assessment. The right strategy is to require that set of measures, such as strong authentication, least privilege access control, encryption, and network segmentation, that are known to be both essential and efficient.

William Hugh Murray

Adding cybersecurity requirements to HIPAA, given the number of attacks on the medical sector of late, comes as no surprise. The trick is to make sure that your cybersecurity team is aware of the requirements added to HIPAA, as these requirements appear to include financial penalties for non-compliance. Make sure your teams are in agreement with your current protections and requirements, and have each other covered both for audits and all applications dealing with that data.

Lee Neely

Here's an opportunity for the government to consolidate cybersecurity requirements for critical infrastructure. Why not create a minimum baseline that every critical infrastructure sector will be measured against? Looking at the NPRM, all the technical safeguards are already part of existing security frameworks. Either choose one or enable framework reciprocity.

Curtis Dukes

I'm not sure how this impacts more sensitive pieces of software, but if the government is building software, I imagine sharing standard source codes would make a ton of sense.

Moses Frost

The law is based on the belief that multiple agencies are paying to develop the same code, and having a code repository where this code could be shared would avoid those redundant costs. It's not clear how this affects contractors who develop and deploy custom code across multiple agencies. Many agencies are already sharing open source and are familiar with needed security/best practices for GIT and other services. Agencies have 180 days to implement, which should consist of formalizing and broadening existing practices and policies.

Lee Neely

The seizure effectively puts a travel ban on the ship and allows the investigation to continue with the ship "captive." Following other undersea cable damage in November, Sweden, Germany, and Lithuania have launched criminal investigations against a Chinese ship exhibiting similar behavior.

Lee Neely

Know in advance who you will call in the event of a denial of service attack. It should not take you longer to identify that person than it will take to fix the problem. The illustrative case was GRC where it took 12 hours to identify the guy who fixed the problem in ten minutes.

William Hugh Murray

The airline industry continues to be targeted. American Airlines was impacted for an hour late last week; in September Germany's state air traffic control was attacked; in October, 13 of Mexico's airports were targeted. Rather than wait for regulator guidance, look to cyber hygiene best practices, including DDoS prevention, MFA, isolation/segmentation, monitoring, and judicious application of updates. Be sure to document what you're doing.

Lee Neely

As we begin the new year, organizations should revisit SLAs they have with Internet Service Providers. Additionally, organizations should look to further segment parts of their network to limit the impact of a DDoS attack.

Curtis Dukes

Never a good time to ask for a patch to be applied, but the holidays are tough. Keep your systems patched; patch them often. There is a workaround for the DoS condition that could be implemented, but that should be a quick band-aid rather than a long-term solution.

Moses Frost

CVE-2024-3393, Firewall DOS in DNS Security, CVSS 4 score 8.7, is activated by sending a malicious packet through the firewall, and can be mitigated by either applying the PAN-OS update or by updating your security profiles, both custom and out-of-the box, as directed in their bulletin. Note that you'll be making local copies of the OOB policies. Applying the OS update may be far simpler than vetting the changes to the firewall, which you will want to roll back if using OOB policies after the update is applied.

Lee Neely

Whether Chinese-made or US-made doesn't really matter, as software vulnerabilities sometimes get through QA checks. What's troubling is that evildoers are simply taking advantage of default credentials to exploit the router. The vulnerability simply accelerates the attack. Let's start the new year with the question, should the vendor be held liable for hard-coding default credentials in their product?

Curtis Dukes

If you're running an affected router, make sure that you've not only updated to the most recent firmware, but also changed all default credentials to something strong and unique.

Lee Neely

CVE-2024-45387, Traffic Ops SQL Injection flaw, CVSS score 9.9, affects Apache's Open Source Traffic Control Content Delivery Network (CDN) project. If you're running the older 7.0.0, before 8.0 version of Apache Traffic Control, you really need to update to the current build, minimum 8.0.2. If you're running version 8, make sure you're on 8.0.2 or higher, as no workarounds are mentioned.

Lee Neely

Beware of malicious meeting links, as well as invites from unexpected sources. Consider disabling auto-acceptance of meeting invites. Beyond valid links, make sure that your EDR is configured to block installation of malicious updates, and sweeten the deal by blocking access to known bad sites. Lastly, if you're using cryptocurrency, be sure to understand and follow current security best practices, as well as knowing the risks when stolen. While some exchanges offer insurance, it's not always extended to individuals managing their own keys.

Lee Neely

The evildoers are simply taking advantage of human nature. Standard practice is to stop and think for a minute on whether the message with invite was expected and from a known address. If not, simply discard and report as spam/junk to your provider/security team.

Curtis Dukes