The IT Nerd

Recently, the DHS has announced a investigation into cloud security:

“Organizations of all kinds are increasingly reliant on cloud computing to deliver services to the American people, which makes it imperative that we understand the vulnerabilities of that technology,” said Secretary of Homeland Security Alejandro N. Mayorkas. “Cloud security is the backbone of some of our most critical systems, from our e-commerce platforms to our communication tools to our critical infrastructure. In its reviews of the Log4j vulnerabilities and activities associated with Lapsus$, the CSRB has proven itself to be ready to tackle and examine critical and timely issues like this one. Actionable recommendations from the CSRB will help all organizations better secure their data and further cyber resilience.”  

Ani Chaudhuri, CEO, Dasera had this to say:

The recent announcement by the Department of Homeland Security regarding the Cyber Safety Review Board’s (CSRB) upcoming review on cloud security highlights the criticality and urgency of bolstering defenses in our modern digital landscape. Cloud environments have become ubiquitous, supporting myriad facets of public and private sector activities. Given this backdrop, we can go into the questions presented.

Significance/Implications for Cloud Providers:

• Reputation and Trust: Cloud Service Providers (CSPs) have long championed the security of their platforms. This review will highlight their claims’ robustness and scrutinize their methodologies. Those proactive in their security strategies will find validation, while others might face a reckoning.
• Evolution of Best Practices: The CSRB’s recommendations will likely lead to an industry-wide shift in best practices, nudging CSPs to adopt innovative strategies, especially concerning identity management and authentication.
• Collaborative Efforts: This initiative underscores the need for public-private collaboration. CSPs should be primed to work closely with governmental agencies, benefiting from a broader pool of expertise.

Implications for Cloud Customers:

• Enhanced Security Posture: As the CSRB crystallizes its findings into actionable recommendations, cloud customers stand to benefit directly. These guidelines can fortify their defense mechanisms, making them less susceptible to breaches.
• Clarity and Education: Often, the intricacies of cloud security remain nebulous for many users. This review will bring much-needed clarity, helping organizations comprehend potential vulnerabilities and the ways to mitigate them.
• Shared Responsibility Realignment: Cloud security operates on a shared responsibility model. This review will sharpen the contours of this model, helping customers discern their part in the grander security schema.

The Outcome of the Review and Potential Changes:

• While the CSRB doesn’t have regulatory or enforcement powers, its influence stems from its collective expertise and the gravitas of its recommendations. Past reviews, like those into the Log4j vulnerabilities and the activities of Lapsus$, have been instrumental in reshaping cyber defense strategies.
• Given the recent Microsoft Exchange Online intrusion, we can expect a renewed emphasis on strengthening identity management and authentication in the cloud. This might lead to the inception of new technologies or the broader adoption of extant yet underutilized solutions.
• More importantly, the findings will likely foster a culture of proactive security vigilance rather than a reactive stance. The cloud industry might see an acceleration in the integration of advanced threat detection, response mechanisms, and continuous security education.

The DHS’s initiative, steered by the CSRB, couldn’t be more timely. In a world where our reliance on cloud infrastructure is deepening, such proactive measures herald a shift from merely responding to threats to preemptively identifying and plugging vulnerabilities. This is not just about technology; it’s about trust and ensuring the cloud remains a haven for innovation and growth.

Seeing as “the cloud” is central to businesses, this is a good move by the DHS. Because everyone needs to make sure that whatever infrastructure that people use are safe and secure 100% of the time.

According to research provided by The Record, the number of ransomware attacks posted on extortion websites in July reached a record high, with ransomware groups publicly claiming over 15 attacks per day on average.

Recorded Future’s data reveals a total of 484 ransomware attacks in July, up from 408 the previous month. The surge was largely driven by the Russia-based Clop ransomware group, which exploited a vulnerability in the MOVEit file transfer tool to breach global computer networks.

Those attacks accounted for 35% of all publicly reported victims in July, including Shell, Siemens Energy, and a major U.S. public pension fund, with the education sector being particularly impacted. However, there were a total of 484 attacks spread across 38 different groups in July 2023, compared to 214 attacks across 24 groups in July 2022.

Emily Phelps, Director, Cyware had this to say:  

“With ransomware, cybercriminals don’t need to be sophisticated hackers to execute sophisticated attacks. Ransomware has a low barrier for entry, and with the emergence of Ransomware-as-a-Service, it requires virtually no technical skills to execute a successful attack. It’s profitable and harder to trace, with many adversaries dealing in cryptocurrencies.  

“Preventing successful ransomware attacks requires organizations to take multiple actions, which include keeping software and systems patched and updated; regularly maintaining and isolating backups; conducting regular security awareness training; and investing in threat intelligence and detection systems that enable security teams to proactively defend against these types of attacks.”

Carol Volk, EVP, BullWall follows with this: 

“Ransomware attacks continue to rise and the battle continues. We must learn from every event, improving our security posture, as the fallout from such attacks can be devastating to a business in terms of lost revenue, business disruption and long-term reputational damage.  

“While the hope of a magical AI silver bullet to protect us is still just a dream, we have to own our own protection and apply the best defense available within the resources available to us. There are good defensive options, from on-prem teams to Security as a Service (SECaaS) that can provide the full range for a good defense, including detection, backup and containment solutions. Stay current!”

Ransomware is not going away. Organizations need to wrap their heads around this and do whatever is required to make sure that they are not going to be the next victim of a ransomware attack.

There’s new research that is out detailing hackers targeting smaller websites to take them over and set up phishing pages:

Abandoned websites end up captured by cybercriminals fairly often. A lack of maintenance and security patches means they are easy to compromise using a known exploit. Besides, on a long-neglected site, phishing pages can stay up for long periods of time, as no one monitors what gets published, which is exactly what scammers look for.

This does not mean malicious actors do not attack actively maintained sites, though. Smaller websites attracting little traffic are among those exposed to the hacking threat. Their owners may not be able to afford to spend enough money on information security or hiring a security professional, they may be unfamiliar with security settings, or they may be confident that their website is too small to be of any interest to hackers. However, to a phisher, the possibility of hacking the website is more important than its popularity, as links to scam pages are likely to be emailed or sent via instant messaging platforms. Therefore, even smaller websites are an attractive target for scammers.

According to W3Techs, 43.1% of all websites on the internet are powered by the WordPress content management system. There is a huge number of third-party plugins designed for extending the functionality of this popular platform. New vulnerabilities exploited by hackers are discovered both in plugins and in WordPress itself on a regular basis. The rest of this article will deal with phishing pages on hacked websites that are powered by WordPress.

Jack Nicholsen, CISO, Inversion6 had this to say:

Everyone should be concerned about the growing threat of phishing attacks on WordPress sites. These attacks can have a significant impact on businesses, both financially and reputationally. Hackers are increasingly targeting WordPress sites because they are a popular content management system (CMS) that is used by millions of websites. WordPress sites are also often less secure than other websites, as they may not be properly maintained or updated. Kaspersky found that hackers are using a variety of techniques to target WordPress sites, including: 

• Exploiting vulnerabilities in outdated software and plugins. WordPress plugins are a common way for hackers to gain access to a website. It is important to keep all plugins up to date and to only install plugins from trusted sources. 
• Phishing emails and social engineering attacks. Hackers will often send phishing emails that appear to be from a legitimate source, such as a bank or credit card company. The emails will often contain a link that, when clicked, takes the victim to a fake website that looks like the real website. Once the victim enters their personal information on the fake website, the attacker can steal it.
• Brute-force attacks. Hackers will often use brute-force attacks to try to guess the passwords for WordPress accounts. It is important to use strong passwords and to enable two-factor authentication.

 Security teams can take a number of steps to protect their WordPress sites from these attacks, including:

• Keeping their websites up to date with the latest security patches. WordPress releases security patches regularly, and it is important to install these patches as soon as possible. 
• Using strong passwords and two-factor authentication. Strong passwords should be at least eight characters long and include a mix of letters (uppercase and lowercase), numbers, and symbols. Two-factor authentication adds an extra layer of security by requiring users to enter a code from their phone in addition to their password.
• Installing a security plugin for WordPress. There are a number of security plugins available for WordPress that can help to protect your site from attacks.
• Monitoring their websites for suspicious activity. Security teams should monitor their websites for suspicious activity, such as unusual login attempts or changes to the website’s code. 
• Training employees on how to identify and avoid phishing emails. Employees should be trained on how to identify and avoid phishing emails. They should be taught to never click on links in emails from unknown senders and to never enter their personal information into websites that they do not trust.

My advice would be that if you have a website that isn’t being maintained, take it down. And for everyone else, you should do everything possible to secure those websites so that they don’t get leveraged by threat actors for evil.