CyberSecure Specialist

05 Jan

Hackers Abuse Windows Error Reporting Tool to Deploy Malware

Attacks, Malware

It is highly recommended to implement and maintain email security controls, including the ability to block certain file attachments. ISO files have become extremely popular among threat actors as a way to initially get malware on to the system while also evading defenses. In this campaign, the threat actors attach the ISO directly to a phishing email received by the end user. By being able to block incoming emails that contain ISO (or IMG) attachments,…

Read More
05 Jan

Cyberattack on Records Vendor Affects Scores of U.S. Counties

Attacks, Malware

To protect against similar cyber-attacks, organizations should: • Regularly back up data, air gap, and password protect backup copies offline.• Ensure copies of critical data are not accessible for modification or deletion from the system where the data resides.• Implement network segmentation.• Implement a recovery plan• Install updates/patch operating systems, software, and firmware as soon as practical after they are released.• Implement monitoring of security events on employee workstations and servers, with a 24/7 Security…

Read More
05 Jan

IOTW: Almost 50,000 UK government ministers vulnerable to cyber attacks

Attacks, Data Breaches

A large number of UK government ministers and civil servants have been warned that they are vulnerable to hackers after their personal information was posted online and remained visible for months. The personal information for more than 45,000 civil servants was available until March 2020 via the Government Communication Service (GCS) website. The information included names, email addresses, phone numbers and job titles as well as links to social media profiles including Twitter and LinkedIn.…

Read More
05 Jan

Predictions 2023: Big Tech’s Coming Security Shopping Spree

Information, News

The SecurityWeek editorial team huddled over the holidays to look back at the stories that shaped 2022 and, more importantly, to stare into a shiny crystal ball to find the cybersecurity narratives that will dominate this year’s headlines. For the most part, not much will change. Organizations large and small will continue to acknowledge major data breaches, zero-days and ransomware crises will spread to new targets and a skills shortage in an uncertain economy will…

Read More
05 Jan

CISA Releases Three Industrial Systems Control Advisories

Attacks, Insights, Malware

Original release date: January 5, 2023 CISA released three Industrial Control Systems (ICS) advisories on January 5 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations: ICSA-23-005-01 Hitachi Energy UNEM ICSA-23-005-02 Hitachi Energy FOXMAN-UN ICSA-23-005-03 Hitachi Energy Lumada Asset Performance Management This product is provided subject to this Notification and this Privacy…

Read More
05 Jan

NATO tests AI’s ability to protect critical infrastructure against cyberattacks

Data Breaches, Malware, Social Engineering

Autonomous intelligence, artificial intelligence (AI) that can act without human intervention, can help identify critical infrastructure cyberattack patterns and network activity, and detect malware to enable enhanced decision-making about defensive responses. That’s according to the preliminary findings of an international experiment of AI’s ability to secure and defend systems, power grids and other critical assets by cyber experts at the North Atlantic Treaty Organization’s (NATO) Cyber Coalition 2022 event late last year. The simulated experiment…

Read More
05 Jan

The BISO: bringing security to business and business to security

Data Breaches, Malware, Social Engineering

Throughout her career in IT security, Irina Singh has thrived on difficult projects. With a bachelor of science degree in management of information systems and a minor in international business, she now manages a team of business information security liaisons serving four foundational business units at medical device company Medtronic. “One of my slogans is that we bring business to security and security to the business,” she says. Singh calls herself a business information security partner, but…

Read More
04 Jan

Gaming: How much is too much for our children?

Information

With many children spending a little too much time playing video games, learn to spot the signs things may be spinning out of control Across Europe, half of the population aged 6-64 plays video games, according to industry body ISFE. The number rises significantly for 6-10-year-olds (68%), and those aged 11-14 (79%) and 15-24 (72%). According to some research, teenagers may spend as many as three hours per day gaming. That’s not necessarily a problem,…

Read More
04 Jan

Serious Security: Vital cybersecurity lessons from the holiday season

Information, Malware

by Paul Ducklin Even though it’s already Day 4 of Year 2023, some of the important IT/sysadmin/X-Ops security stories of the holiday season are only popping up in mainstream news now. So we though we’d take a quick look back at some of the major issues we covered over the last couple of weeks, and (just so you can’t accuse us of sneaking out a New Year’s listicle!) reiterate the serious security lessons we can…

Read More
04 Jan

How to foster secure and efficient data practices

Attacks, Data Breaches

Companies rely on data transfers to communicate between departments and with clients. When transferring data between different people, however, there are several risks if these data transfers are insecure. If insecure file transfer methods such as unencrypted email or cloud services are used, companies can open themselves up to potential exploitation by malicious actors. These actors could look to utilize methods including poisoning uploads with malware or intercepting files to gain access to confidential data.…

Read More