The IT Nerd

New Zealand’s central bank announced that banks must report major cyber incidents within 72 hours, as it plans to implement formal cyber reporting requirements over the next year after regulators supported proposals by the Reserve Bank of New Zealand (RBNZ) on the importance of having access to information on cyber resilience from the central bank.

Last year, after New Zealand saw a rise in cyber-attacks, the government was motivated to boost its cyber defenses by setting up a lead agency to make it easier for the public and businesses to seek help during network intrusions. Furthermore, RBNZ collaborated with the Financial Markets Authority (FMA), New Zealand’s financial markets regulator, to develop shared reporting requirements that can be used for both agencies.

The following RBNZ cyber resilience reporting requirements will be implemented in phases through 2024:

• Material cyber incident reporting requirement: within 72 hours
• Periodic reporting of all cyber incidents: large entities to be required to report all cyber incidents every six months and other entities annually
• Self-assessment using the RBNZ’s Guidance on Cyber Resilience: large entities every year and other entities every two years.

Dave Ratner, CEO, HYAS had this comment:

   “Regulations requiring timely reporting are popping up across multiple geographies and verticals, and while they are in general a good thing, the definition of what is and isn’t ‘material’ is often not entirely clear.  Nevertheless, for an organization to be in a position to comply with these new regulations will require cyber resiliency solutions that are capable of alerting them to the telltale signs of a breach and see the initial digital exhaust indicating an attack in progress.  Most organizations are likely not prepared today and need to prioritize resiliency in 2024 to ensure that they are.”

Mark B. Cooper, President & Founder, PKI Solutions follows with this comment:

   “With regulators adopting stricter notification requirements, now more than ever, banks need to respond with their own stricter, higher levels of security posture management practices if they’re going to avoid having to report incidents.

   “The challenges organizations face is no longer limited to just advanced encryption or identity protection measures, but it highlights the critical need for pro-active, vigilant monitoring to quickly identify misconfigurations and alert security resources and staff. Prompt remediation is essential to defend against attacks that lead to triggering a notification.”

Requirements like these are a good thing from two perspectives. First it makes sure that any incident isn’t covered up. Second, it will “encourage” organizations to up their game in terms of their cyber defences to make sure that they don’t get pwned. These sorts of requirements need to be put into effect everywhere as that is one thing that will make us safer.

The CISA, the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released an advisory warning of TTPs Phobos ransomware attacks are using to target government and critical infrastructure entities.

“Structured as a ransomware as a service (RaaS) model, […] Phobos ransomware actors have targeted entities including municipal and county governments, emergency services, education, public healthcare, and critical infrastructure to successfully ransom several million in U.S. dollars,” the advisory said.

Attack chains typically leveraged phishing as an initial access vector, or vulnerable networks are breached by hunting for exposed RDP services and exploiting them by means of a brute-force attack.

Once successful, the threat actors deploy additional remote access tools, taking advantage of process injection techniques to execute malicious code and evade detection, and making Windows Registry modifications to maintain persistence within compromised environments.

“Additionally, Phobos actors have been observed using built-in Windows API functions to steal tokens, bypass access controls, and create new processes to escalate privileges by leveraging the SeDebugPrivilege process. Phobos actors attempt to authenticate using cached password hashes on victim machines until they reach domain administrator access,” the agencies said.

Phobos has been active since May 2019, with multiple variants identified. Cisco Talos disclosed in November that those behind 8Base ransomware are utilizing a variant of Phobos for their attacks.

BullWall Executive, Carol Volk had this to say:

   “The recent Phobos advisory from CISA, the FBI, and the MS-ISAC sheds light on the continued rise of ransomware attacks targeting government and critical infrastructure sectors. As with many ransomware attacks, the Phobos attacks employed phishing and exploitation of vulnerable RDP services and highlights the importance of robust cybersecurity measures at every level.

   “Organizations must prioritize implementing multi-layered defense mechanisms, including strong email security protocols and regular security awareness training to thwart phishing attempts.  Additionally, securing remote access points and promptly patching vulnerabilities in RDP services can significantly reduce the risk of exploitation.

   “However, we continue to see that even well prepared defenses will be breached by determined actors, so regular air-gapped backups, a ransomware containment system and MFA to protect RDP sessions should be part of the defense stack for the day your defenses are breached.”

John Benkert, CEO, Cigent follows with this:

   “Broken record here. Protecting critical infrastructure from Ransomware-as-a-Service (RaaS) attacks requires a multifaceted approach that spans technological, regulatory, and educational domains. Given the increasing sophistication and accessibility of RaaS platforms, which allow even low-skilled attackers to launch ransomware campaigns, the security of essential services such as healthcare, energy, transportation, and water systems has never been more important.

   “The foundational step in defending against these threats involves the implementation of robust cybersecurity measures that already exist. This includes regular software updates and patch management to close vulnerabilities, advanced threat detection systems to identify and neutralize threats early, and comprehensive data backup strategies to ensure data integrity in the event of a breach.

   “Let me be clear, solutions already exist in the commercial sector to protect against these threats. Instead of cultivating these commercial solutions, the government is more concerned with putting out regulations and standards that take years to approve and become obsolete before they are published.”

This should be a clear warning that defences for critical infrastructure specifically, but all organizations and sectors in general need to be a priority. The question is, how many warnings will it take for organizations to get the message?