The IT Nerd

The White House released a statement announcing that the government is extending its public-private cybersecurity partnership to the chemical industry:

The majority of chemical companies are privately owned, so we need a collaborative approach between the private sector and government. The nation’s leading chemical companies and the government’s lead agency for the chemical sector – the Cybersecurity and Infrastructure Agency (CISA) – have agreed on a plan to promote a higher standard of cybersecurity across the sector, including capabilities that enable visibility and threat detection for industrial control systems.

The Chemical Action Plan will serve as a roadmap to guide the sector’s assessment of their current cybersecurity practices over the next 100 days, building on the lessons learned and best practices of the previously launched action plans for the electric, pipeline, and water sectors to meet the needs for this sector. 

I secured a pair of comments on this statement from leading industry experts.

Jerry Caponera, General Manager, Cyber Risk at ThreatConnect:

There are a couple of things that worry me concerning the chemical sector. The first is that the chemical sector produces items that we may not necessarily think about but can’t survive without in modern society. Imagine a world without plastics to store our food or chemicals to make electronics.

The second is the real risk. We saw three ransomware attacks in 2019, including 2 in the US (a bigger one was Norsk Hydro). They mitigated the impact because the hit was on IT, not OT systems. But it could have been worse.

Third, there’s a massive risk with the materials in question. Chemicals produce much of what we need, but a chemical material in raw form can be dangerous. A cyber attack on a chemical system where the IT and OT systems are linked could cause a consequential loss of life. 

I’m glad the chemical industry is high on the list of sectors to watch. The ransomware attack on the colonial pipeline caused a minor blip in the supply of gas. Suppose a significant ransomware attack on chemical plants would destroy plastic packaging. That would be devastating. 

Padraic O’Reilly, Co-Founder and Chief Product Officer, CyberSaint Security: 

The biggest issue is that almost all infrastructure is privately held. Analogous to the pipeline: large cyber-to-physical systems with extensive OT. Complex segregation issues and legacy protocols and infrastructure. Malicious attacks and control of SCADA systems and PLCs are real vulnerabilities. Internet-connected devices and cloud migration are an issue, too. On the upside, the chemical sector has been under CFATS through DHS for over a decade. That will oil the gears. Likely that sophisticated monitoring and detection lag behind the most mature industries. Likely, too, that cyber risk management needs to be done at the executive level to ensure proper resourcing.

This can only be good for the security of the sector. Hopefully this idea spreads to other sectors as that will make us all safer.

UPDATE: I have a third comment from Wade Ellery, Field Chief Technology Officer, Radiant Logic:

     “These developments show the steady course our country is moving in to protect our most vulnerable assets, which have huge implications on the lives of our citizens. A comprehensive cybersecurity plan is the first step in tackling the immediate threat of cyber attacks. An identity-first security foundation–in which information sharing can cohesively exist throughout the different operations within the United States and our allies–must be a key component of that plan. In order for that to happen, identity security must be taken as the first line of defense for our most valued resources.”

A BlackByte ransomware affiliate is using a new custom data stealing tool called to steal data from compromised Windows devices so that they can do double extortion attacks reports Bleeping Computer. This news comes months after the FBI released an advisory on the strain, following its use to breach three companies in the US’ critical infrastructure.

Kevin Bocek, VP of Security Strategy & Threat Intelligence at Venafi has this to say:

“Following attacks on US critical infrastructure, the FBI released an advisory on BlackByte ransomware in February. But clearly this has done little to deter threat actors. They’ve built on BlackByte’s success with this latest update, which now includes next-generation double extortion capabilities, including a direct upload of exfiltrated data to Mega cloud with hardcoded credentials. This should set alarm bells ringing for organizations. Double extortion tactics make it much harder to say no to ransomware demands because the safety net of ‘restore from backup’ is no longer there to fall back on.

“Our research shows that 83% of ransomware attacks now make use of double extortion tactics. Threat actors – who are essentially just developers gone bad – have worked hard to improve their product, and the cybersecurity industry should be responding in kind. Ransomware often evades detection because it runs without a trusted machine identity. So, organizations must be managing machine identities via a control plane to reduce the use of unsigned scripts, increase code signing and restrict the execution of malicious macros. This is vital to a well-rounded ransomware defense.”

As these ransomware gangs evolve their attacks, companies need to evolve their defences accordingly. Otherwise they’ll just become victims of these ransomware gangs.

Singapore has today announced the formation of an inter-agency ransomware task force which will pool representatives from different sectors to better tackle ransomware attacks aimed at businesses. The task force, set up earlier this year, will develop and make recommendations on possible policies, operational plans and capabilities to improve Singapore’s counter-ransomware efforts.

Dr. Darren Williams, CEO and Founder of BlackFog had this to say:

     “Interconnectivity and alignment between government entities is paramount for any country, regardless of size, to establish a unified approach towards ransomware prevention. As noted by the Coordinating Minister for National Security, the attacks against Costa Rica served as a prime example of how quickly your entire nation can be undertaken from the swift actions of a skilled attacker. Moving forward, these targeted countries must not only focus on preventing ransomware as a whole, but on preventing sensitive data from being exfiltrated. We have seen time and time again how even when a ransomware attack is dealt with, once data has been stolen, the damage can perpetuate indefinitely.”

I think that this is a great move as one can respond better to these sorts of attacks if everybody is on the same page. I’ll be watching Singapore to see how well this works out.

Cybersecurity Awareness Month launched 19 years ago and celebrated in October each year, represents the importance of public/private partnerships in technology, data and communications security:

“Since 2004, the President of the United States and Congress have declared October to be Cybersecurity Awareness Month, helping individuals protect themselves online as threats to technology and confidential data become more commonplace. The Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA) lead a collaborative effort between government and industry to raise cybersecurity awareness nationally and internationally.” This year’s campaign theme, “‘See Yourself in Cyber’ — demonstrates that while cybersecurity may seem like a complex subject, ultimately, it’s really all about people.”

Commenting on this topic are three executives in the cybersecurity space. The first comment is from Don Boxley, CEO and Co-Founder of DH2i :    

“Today, work-from-home (WFH) has evolved into work-from-anywhere (WFA), to the delight of employees and their employers alike. The benefits of this new work paradigm for employees include the flexibility to choose work hours, getting more work done in less time, and a decrease in work-related expenses, and of course a better work/life balance. For employers, the benefits include higher productivity, a larger talent pool from which to draw, increased job satisfaction, more engaged employees and a lower turnover rate, as well as significantly reduced overhead expense. (And by the way, happy employees lead to happy return customers.) 

This ties back to this year’s CyberSecurity Awareness Month theme which reminds us that it’s really all about the people. However, it’s also all about the technology that we invest in to support our people’s success. 

To take a step back, the evolution from an onsite work model, to the new paradigm of WFH or WFA, as well as hybrid, wasn’t without its challenges. Perhaps one of the biggest bumps along the way was figuring out how people could WFH not only productively, but securely. At the beginning of the transition, many organizations were forced to depend upon their virtual private networks (VPNs) for network access and security and then learned the hard way that VPNs were not up to the task. It became clear that VPNs were not designed nor intended for the way we work today. Both external and internal bad actors were and are still exploiting inherent vulnerabilities in VPNs. Instead, forward looking IT organizations have discovered the answer to the VPN dilemma. It is an innovative and highly reliable approach to networking connectivity – the Software Defined Perimeter (SDP). This approach enables organizations to build a secure software-defined perimeter and use Zero Trust Network Access (ZTNA) tunnels to seamlessly connect all applications, servers, IoT devices, and users behind any symmetric network address translation (NAT) to any full cone NAT: without having to reconfigure networks or set up complicated and problematic VPNs. With SDP, organizations can ensure safe, fast and easy network and data access; while slamming the door on potential cybercriminals.”

Steve Santamaria, CEO, Folio Photonics is next:

“Cybersecurity-urgency is gripping the private and public sectors, as data now represents a strategic asset to almost every organization. Yet, while from IT to the C-suite it is agreed that the possibility of a cyberattack poses a highly dangerous threat, many would admit that they are probably ill prepared to fully understand and address all of the threats, in all of their forms, today and in the years ahead. 

Today, a multi-pronged strategy is the most common approach to protect against cybercrime. This usually includes a mix of security software, malware detection, remediation and recovery solutions. Traditionally, storage cyber-resiliency is found in the form of backup to hard disk and/or tape. Both media have relatively short lifespans and can be overwritten at a material level. They also offer distinct advantages as well as disadvantages. For instance, tape is less expensive but it has very strict storage and operating conditions. And disk offers a potentially much faster restore time, but the cost can be exorbitant. For those that have the flexibility to do so, they may be forced into picking-and-choosing what they save, and for how long they save it. 

What’s required is development of a storage media that combines the cybersecurity advantages of disk and tape. A solution that can ensure an enterprise-scale, immutable active archive that also delivers write once read many (WORM) and air-gapping capabilities, as well as breakthrough cost, margin and sustainability benefits. Affordable optical storage is the answer, as it is uniquely capable of leveraging today’s game-changing advancements in materials science to create a multi-layer storage media that has already demonstrated the major milestone of dynamic write/read capabilities. In doing so, it can overcome historical optical constraints to reshape the trajectory of archive storage. Ideal for datacenter and hyperscale customers, such a next-generation storage media offers the promise of radically reducing upfront cost and TCO while making data archives active, cybersecure, and sustainable, not to mention impervious to harsh environmental conditions, raditiation, and electromagnetic pulses, which are now being commonly used in cyber-warfare.” 

Our third comment on CyberSecurity Awareness Month comes from Surya Varanasi, CTO, StorCentric:

“As an IT professional, CyberSecurity Awareness Month reminds us how critical it is to continuously educate yourself and your workforce about the malicious techniques used by cybercriminals, and how to practice proper cyber hygiene in order to decrease potential vulnerabilities. 

Today, the process of backing up has become highly automated. But now, as ransomware and other malware attacks continue to increase in severity and sophistication, we understand that proper cyber hygiene must include protecting backed up data by making it immutable and by eliminating any way that data can be deleted or corrupted. 

An Unbreakable Backup does exactly that by creating an immutable, object-locked format, and then takes it a step further by storing the admin keys in another location entirely for added protection. Other key capabilities users should look for include policy-driven data integrity checks that can scrub the data for faults, and auto-heals without any user intervention. In addition, the solution should deliver high availability with dual controllers and RAID-based protection that can provide data access in the event of component failure. Recovery of data will also be faster because RAID-protected disk arrays are able to read faster than they can write. With an Unbreakable Backup solution that encompasses these capabilities, users can ease their worry about their ability to recover — and redirect their time and attention to activities that more directly impact the organization’s bottom-line objectives.”

And our final comment is from Brian Dunagan, Vice President of Engineering, Retrospect, a StorCentric Company:

“CyberSecurity Awareness Month is a great reminder that we must remain vigilant and always be thinking about how to handle the next wave of cyberattacks. While external bad actors, ransomware and other malware, are the most common threats, malicious or even careless employee actions can also present cybersecurity risks. In other words, it is virtually a given that at some point most will suffer a failure, disaster or cyberattack. However, given the world’s economic and political climate, the customers I speak with are most concerned about their ability to detect and recover from a malicious ransomware attack.

My advice to these customers is that beyond protection, organizations must be able to detect ransomware as early as possible to stop the threat and ensure their ability to remediate and recover. A backup solution that includes anomaly detection to identify changes in an environment that warrants the attention of IT is a must. Administrators must be able to tailor anomaly detection to their business’s specific systems and workflows, with capabilities such as customizable filtering and thresholds for each of their backup policies. And, those anomalies must be immediately reported to management, as well as aggregated for future ML/analyzing purposes.

Of course, the next step after detecting the anomaly is providing the ability to recover in the event of a successful ransomware attack. This is best accomplished with an immutable backup copy of data (a.k.a., object locking) which makes certain that the data backup cannot be altered or changed in any way.”

My commentary goes something like this. The fact that this year’s Cybersecurity Awareness Month is all about people is the right message. People are the weakest link in cybersecurity. Thus anything that can be done to educate and to highlight this so that people can adjust their behaviour is valuable. Thus I would keep that in mind while implementing the tools that you need to keep you safe from threat actors.

UPDATE: I have additional commentary on Cybersecurity Awareness Month from HelpSystems:

Donnie MacColl, Senior Director of Technical Support

We can all make everything we do more secure by taking affirmative actions and working in partnership with vendors and suppliers. This can be done by considering ourselves as end-users and customers of everything we use, whether that’s a physical shop, an online store, an app on our phone or a computer. Ask questions, for example, “does this app have 2FA?”, and, if not, move on and use the one that has. When in a store and asked for your email address or date of birth, ask “why?”, “what is it used for?”, “why do you need it?” and don’t share if not needed. By thinking about security and asking “is what I am using secure?”, we may prompt a chain of ownership. Now go ahead, grab a coffee and take timeout to change all your passwords to be unique and difficult to guess, and make sure all your software is on the latest version to reduce the chance of attack. You’ve got this, and if you are not sure of the best way to be secure, just ask!

Chris Spargen, Sr. Manager, Solutions Engineering

Setting a strong example is a way to collectively raise the bar on cybersecurity for your organization. Championing updated policies by being an early adopter, praising early adoption when you see it, and spearheading the latest security updates for the software solutions in your realm of influence will lead to a more secure organizational posture. Look for opportunities to partner with your vendors, testing new versions and helping them find any weaknesses that may exist before they reach the mainstream market.

Tyler Reguly, Sr. Manager, Security R&D

It doesn’t matter if you accidentally download malware, have someone access one of your accounts, or click on a phishing link, eventually everyone makes a mistake. For some people, having one of those horrible incidents happen is the only way they realize, “Hey, it can happen to me.” For others, however, it is a source of embarrassment, and they shy away from publicly discussing it or thinking about it. When we treat these incidents like a source of shame, we deny others the opportunity to learn from our experiences. The easiest way to “See Yourself in Cyber” is to see how others are impacted. Whether it is your personal or professional life, seeing someone you know impacted will do more to reinforce the importance of vigilance than see dozens of corporate breaches in the news. It is time to remove the stigma around being a victim of cybercrime and open the door so that everyone of us can ‘See Yourself in Cyber.’

John Grancarich, EVP, Strategy

Remember that at the end of the day, the smarter you can make a system to detect and prevent a threat the safer you and your organization will be. While phishing attacks are always going to evolve like any threat vector, the more often we can spend that one brief moment clicking ‘Report Phish’ makes the entire system smarter not just for you but for everyone else as well. A smarter system is a safer system.

Yesterday, The CISA or Cybersecurity Infrastructure Security Agency released a Government Binding Operational Directive (BOD), aiming to improve asset visibility and vulnerability detection on federal networks. The mandate directs agencies to perform automated asset discovery every seven days, and to identify and report suspected vulnerabilities on those assets every 14 days. Here’s what a binding operational directive means:

A binding operational directive is a compulsory direction to federal, executive branch, departments and agencies for purposes of safeguarding federal information and information systems. 44 U.S.C. § 3552(b)(1). Section 3553(b)(2) of title 44, U.S. Code, authorizes the Secretary of the Department of Homeland Security (DHS) to develop and oversee the implementation of binding operational directives. Federal agencies are required to comply with these directives. 44 U.S.C.§ 3554(a)(1)(B)(ii). These directives do not apply to statutorily defined “national security systems” or to certain systems operated by the Department of Defense or the Intelligence Community. 44 U.S.C. § 3553(b), (d), (e)(2), (e)(3). This directive refers to the systems to which it applies as “Federal Civilian Executive Branch” systems, and to agencies operating those systems as “Federal Civilian Executive Branch” agencies.

Is this a good thing or a waste of time? To answer that question, I have gathered some commentary from three experts in the space.

Liran Tancman, CEO and co-founder of Rezilion, is one of the founders of the Israeli cyber command and spent a decade in Israel’s intelligence corps. Here’s what he had to say:

It will require a critical look at current tools and strategies and, in many agencies and organizations, an investment in dollars to update technology and processes. Agencies need the right tools for vulnerability detection and prioritization, and they need automated technology for remediation of those vulnerabilities so that they can be focused on more mission-critical objectives. Critical infrastructure in particular often operates with older, legacy technologies that cannot properly defend against modern day threats. With tight budgets, federal agencies and critical infrastructure organizations will need to do some reevaluation of where their time and dollars are allocated if they want to truly be able to manage risk today.

Going back to my comment about legacy technology, government agencies and critical infrastructure organizations are often behind when it comes to the tools they are using. But this establishes baseline requirements for agencies to use in identifying assets and vulnerabilities, and in order to accomplish that these types of organizations will need to invest in creating and using a Software Bill of Materials (SBOM) with dynamic capabilities so that they can see real-time changes in their assets. And they need to combine the SBOM and VEX and get  the actual risk present in their environment. VEX is a machine-readable artifact that tells you which vulnerable components in an environment are actually exploitable. The objective of the VEX is to provide information for organizations to use and prioritize their remediation efforts. This contextualization is provided by the software vendor with a machine-readable artifact with justification values of why a particular component is not affected by a specific vulnerability and therefore not exploitable. Organizations should use a Dynamic SBOM that combines a real-time SBOM and the VEX. 

Next is Danielle Jablanski is a nonresident fellow at the Cyber Statecraft Initiative under the Atlantic Council’s Digital Forensic Research Lab (DFRLab) and an OT cybersecurity strategist at Nozomi Networks:

There is a constant drum beat of industry experts reflecting on government guidance, standards, and recommendations for cybersecurity that stipulates the federal government must do more to walk the walk on building resilience within federal systems and federal technologies before mandating industries to do better. This directive is a step in exactly that direction.

Threat actors targeting OT and ICS seek to craft the perfect concoction of capabilities and vulnerabilities that will cause disruption or damage to their target. They can be both opportunistic, highly tailored, or a mixture of both.

The directive is crucial for two reasons. First, if network activity is not monitored in real time, the status of assets is largely unknown, and whether they have vulnerabilities or not these assets cannot be protected without the necessary visibility into their day-to-day functionality.

Second, vulnerabilities are not all the same, the degree to which vulnerabilities impact integrity and availability of systems varies by technology, deployment, configuration, and environment.

The highly anticipated CISA cross-sector cyber performance goals (CPGs) are another step in the right direction, to help owners and operators of critical infrastructure  prioritize and implement the NIST cyber security framework.

It will also provide a benchmark or starting point for industry to self-evaluate their own cybersecurity practices and program maturity, prioritizing based on technology scope, costs, impact, and complexity.

Finally I have a comment from Ron Brash, VP Technical Research & Integrations at aDolus. He is a household name when it comes to ICS/OT cybersecurity and embedded vulnerability research:

This is stating the obvious, but the #1 resource that civilian agencies will need to be able to comply with the CISA directive is a solid deployment plan and enough staff (or contractors) to enact that plan. Assuming that is in place (a big assumption), the agencies will need to purchase and deploy the tools that can perform regular automated asset discovery scans and interpret the results from these scans. The initial effort to do this is never trivial, as building an accurate IT asset list almost always requires a lot of gumshoeing to correlate the results reported by the tools with what is actually in place. That said, it is a worthwhile endeavor as if you don’t know what you are actually trying to protect, it is hard to protect it. Plus, once the basics are done, it is much easier to keep your assets list up to date.

The real challenge will be the requirement to perform vulnerability scans “across all discovered assets, including all nomadic/roaming devices (e.g., laptops), every 14 days.” Again there are lots of tools available, but they tend to be focused on IT assets, not OT or IoT assets. As a result, agencies will likely run into a “Pareto Problem” — common IT assets like servers and workstations (the 80%) will be easy (20% effort), but then all the remaining non-traditional assets will take 80% of the effort. With the explosion in both OT and IoT products in the last decade, few agencies will escape this pain: think security cameras, badge readers, HVAC systems, and even soft drink machines as connected devices that will take a lot of effort to scan safely and reliably. Agencies with OT assets (such as air, water, or land monitoring and management) will have an even tougher time. 

This publication is a first step towards enforcing cybersecurity vigilance on connected assets. Even though software supply chain security and SBOMs are a core portion of Executive Order 14028, they are only mentioned in the background section in this guidance. In fact the Q&A section is telling: “Q: Why does the directive reference the software bill of materials (SBOM) in the Background section but not in subsequent sections?

A: SBOM is mentioned in the introduction to convey the Administration’s vision and describe our desired state in the long term. The directive focuses on very specific first steps that can be achieved within the next 6-12 months and are prerequisites for broader adoption of SBOM. Without comprehensive asset management, agencies will be unable to effectively use SBOMs to manage risk posed by asset components or libraries.“

SBOMs will require new tools to take advantage of all the new security capabilities they offer. They are also likely to expose a tsunami of previously unknown (but dangerous) vulnerabilities that will need immediate attention by staff. Those responsible for complying with this Operational Directive are getting an early warning from CISA: “SBOMs are becoming a mandatory security requirement in the next year so get your house in order now.”

So it sounds like that all of these experts agree that this is a step in the right direction. But it’s a step as part of a longer journey that hopefully will make us all safer as a result.

A reader pointed this out to me, so thanks for the tip.

Threat actors have been found by Google’s Mandiant deploying never-before-seen post-compromise implants in VMware’s virtualization software to seize control of infected systems and evade detection. The malware has been referred to it as a “novel malware ecosystem” that impacts VMware ESXi, Linux vCenter servers, and Windows virtual machines, allowing attackers to maintain persistent access to the hypervisor as well as execute arbitrary commands.

Mandiant has released a two part report that speaks to what this malware is, and how to defend against it. From reading both parts of this report, two things pop to mind:

• The attacks are tied to an emerging group called UNC3886 who likely motivated by espionage rather than financial given that these attacks are highly targeted. They could also be associated with China.
• This is something that is likely to be copied by other groups.

Finally, VMware has a post that speaks to this and offers advice. If you administer ESXi servers or other virtualization products, this should be required reading for you.

This is not only bad, it’s also a textbook example of why you need to stay on top of patching your IoT gear.

Last Fall, a command injection flaw in Hikvision cameras was revealed to the world as CVE-2021-36260. The exploit was given a “critical” 9.8 out of 10 rating by NIST. The higher the number, the worse it is and in this case, this is as close to worst case scenario as you can get without hitting 10.

Now here’s the problem. New research indicates that a year later, 80,000 or so cameras are out there in the world unpatched. And what’s worse, access to these cameras are for sale by hackers:

Specifically in the Russian forums, we have observed leaked credentials of Hikvision camera products available for sale. These can be leveraged by hackers to gain access to the devices and exploit further the path of attack to target an organization’s environment.

That’s bad. Really Bad. The vendor did put out alerts for this along with firmware updates. But because people have a tendency to what I call “install and forget” about IoT gear, here we are talking about it. Thus my advice to anyone who owns one of these cameras is to drop what you’re doing and update them now. And my advice to anyone who has IoT gear of any sort is to make sure you stay on top of your firmware updates so that way nobody tries to use your IoT gear to pwn you.

On this blog, you often read about some company or organization getting pwned by hackers and ransomware groups. Uber being the latest example. But the real question is how do stop your company from being one of those companies. I’ll serve up two options for you. MFA and Passwordless Authentication. But before we talk about what those options are, let’s explain what the core problem is.

When you sign into your online accounts you’re proving to the service that you are who you say you are. Traditionally that’s been done with a username and a password. The problem is that if someone gets their hands on your password, they can get into said service. Or if you use the same password for all your services, then you’re asking for trouble if one of those services gets pwned by hackers. In short, by only using a password you are exposing yourself to being hacked 100% of the time. So to decrease the chance of that happening, you have two options:

MFA: “Two-Step Verification” or “Multifactor Authentication” operates on the principle that you provide a password, then you provide a second authentication factor. Such as a message being sent to your smart phone with a number that you use to authenticate to the service. Because you physically have to have the smart phone in your hand, hackers are less likely to be able to break into the service. I say less likely because SIM swap scams where a hacker either physically steals your SIM, or tricks a carrier into swapping your cellular service onto a SIM that they control to take over the service that you want to log into. Thus while not perfect, MFA does provide some protection.

Passwordless Authentication: This is an authentication method in which a user can log in to a computer system without the entering (and having to remember) a password. In most common implementations users are asked to enter their public identifier (username, phone number, email address etc.) and then complete the authentication process by providing a secure proof of identity through a registered device or token. This makes it very hard, if not impossible for a hacker break into the service that you want to log into.

So why are we having this discussion? Well, if you take the most recent Uber hack, it’s come out that the hacker got credentials and used them to break in. Which also implies that there was no MFA or Passwordless Authentication in place because if there were, the hacker would not have been able to break in. Thus if you want to reduce your attack surface, implementing either MFA or Passwordless Authentication would be a great way to do it. And I am starting to hear about insurance companies who offer cyber insurance starting to mandate MFA or Passwordless Authentication. Thus businesses may eventually not have a choice. So to get ahead of the game, you might want to implement one of the two.

Yesterday I reported on a school district in Los Angeles getting pwned by ransomware. Today the FBI, CISA and MS-ISAC yesterday warned of US school districts being increasingly targeted by the Vice Society ransomware group, with more attacks expected after the start of the new school year. You can read more here as it is very detailed and provide a lot of insight.

Dr. Darren Williams, CEO and Founder of BlackFog offers this commentary:

     “BlackFog’s recent statistics show an increasing focus on Education from all threat actors (https://www.blackfog.com/the-state-of-ransomware-in-2022/). In fact, Education is now the most commonly attacked sector which we attribute to aging infrastructure and lack of security budgets to adopt new cyber security technologies such as anti-data exfiltration. Cyber gangs tend to target victims with the lowest investments in cyber security protection and large volume of data that cab be leveraged for subsequent extortion.”

It’s pretty clear that the education sector needs to up its game. But that takes funding and resources which they don’t always have. Thus I fear that we’ll see more threat actors take advantage of this to try and extort their way to a big payday.

Cloudflare yesterday disclosed that at least 76 employees and their family members have been targeted by the Twilio phishing attack. The recipients received texts on personal and work phones, originating from four numbers associated with T-Mobile-issued SIM cards and was ultimately unsuccessful. The messages pointed to a seemingly legitimate domain containing keywords including ‘Cloudflare’ and ‘Okta’ in a campaign designed to get employees to hand over their credentials. 

Sidebar: If you need some advice about how to not be a victim of a phishing scam, Microsoft has some good advice.

Mark Bower, VP of Product Management of Anjuna Security had this comment:

     “Turning trusted employees into oblivious insiders is the perfect vector to bypass traditional controls and we can expect many more attacks of this nature. They are cheap, and effective. Once inside with high levels of privilege, coordinated attackers can launch mayhem and theft – manipulating data, stealing even highly sensitive data like keys from running applications. The most effective defense is to force attackers into attempting to break modern CPU-level hardware controls around sensitive data in the cloud, massively delaying impact and keeping blast radius to the absolute minimum, ultimately frustrating attackers who will move on to unprotected lower hanging fruit.”

I will also add that companies really need to step up the training of their employees as well as running phishing simulators to ensure that their employees aren’t unwitting participants in threat actors trying to gain access to a company’s resources.