On Monday, CISA announced that under its new Ransomware Vulnerability Warning Pilot (RVWP) program it has started scanning critical infrastructure entities’ networks for vulnerabilities to warn and help entities fix the flaws ahead of the bad actors.
As part of RVWP, CISA leverages existing authorities and technology to proactively identify information systems that contain security vulnerabilities commonly associated with ransomware attacks. Once CISA identifies these affected systems, our regional cybersecurity personnel notify system owners of their security vulnerabilities, thus enabling timely mitigation before damaging intrusions occur.
CISA accomplishes this work by leveraging its existing services, data sources, technologies, and authorities, including CISA’s Cyber Hygiene Vulnerability Scanning service and the Administrative Subpoena Authority granted to CISA under Section 2209 of the Homeland Security Act of 2002.
Naveen Sunkavalley, Chief Architect at Horizon3.ai had this to say:
“CISA’s new program is a necessary and definite step in the right direction to protect critical infrastructure. Many N-day vulnerabilities are now being exploited by threat actors within days of being disclosed. Time is of the essence. The faster organizations are notified of critical vulnerabilities, the faster they can react to avoid compromise.
“CISA’s program is not a panacea though. Many vulnerabilities are exploited as zero days, and there is often a delay of at least a few days between the time a new vulnerability is disclosed and when CISA adds that vulnerability to its Known Exploited Vulnerabilities catalog. Understanding which vulnerabilities are likely to be exploited and notifying prior to any known exploitation would be valuable.
“Moreover, exploiting vulnerabilities isn’t the only method ransomware actors have at their disposal. Phishing attacks and leaked credentials are used just as often (for instance with the Colonial Pipeline attack). Organizations need to operate under the mindset that a breach will eventually happen, and critically evaluate their attack surface, both external and internal, against a wide spectrum of possible attacks.”
Dave Ratner, CEO of HYAS follows up with this:
“We continue to see increasing attacks on all aspects of critical infrastructure and believe that increased visibility and observability into what is happening in real-time inside the environment is critical to rapid identification of these attacks and shutting them down before they expand into major incidents.
“Attackers continue to find new and innovative ways to circumvent the perimeter and breach both IT and OT networks; however, given that the malware then needs to beacon out for instructions, visibility into outgoing communication – which domains and what infrastructure is being communicated with and how often — can identify anomalous and nefarious activity inside the network and provide a key layer of protection, if not the “last line of defense”, for all aspects of critical infrastructure.”
This is a good step in terms of fighting threat actors. But it is only a step. This has to be combined with the hard work of those responsible for defending networks against threat actors along with spending money on the tools to effectively fight threat actors. Otherwise the CISA’s work will mean nothing.
New Zealand Becomes The Latest To Ban TikTok On Government Devices
Posted in Commentary with tags TikTok on March 17, 2023 by itnerdThe march to ban TikTok continues with news that New Zealand is going to be the latest country to ban TikTok on government devices:
New Zealand said on Friday it would ban TikTok on devices with access to the country’s parliamentary network due to cybersecurity concerns, becoming the latest nation to limit the use of the video-sharing app on government-related devices.
Concerns have mounted globally about the potential for the Chinese government to access users’ location and contact data through ByteDance, TikTok’s Chinese parent company.
The depth of those concerns was underscored this week when the Biden administration demanded that TikTok’s Chinese owners divest their stakes or the app could face a U.S. ban.
In New Zealand, TikTok will be banned on all devices with access to parliament’s network by the end of March.
Parliamentary Service Chief Executive Rafael Gonzalez-Montero said in an email to Reuters that the decision was taken after advice from cybersecurity experts and discussions within government and with other countries.
“Based on this information, the Service has determined that the risks are not acceptable in the current New Zealand Parliamentary environment,” he said.
The thing is that TikTok other than saying things like it it “disappointed” by these bans, hasn’t really offered up anything in the way of a substantive rebuttal to accusations that the social media app is a tool for the Chinese Communist Party to spy on the west and spread Chinese propaganda. Until they do that, these bans will simply continue. And likely expand to outright bans where TikTok will be erased from phones everywhere. Such as the one that seems to be coming in the US. So as a result of that, I expect these bans to continue to accelerate and expand.
Leave a comment »