Managed Event Collection

Executives Targeted: Cybersecurity Scams, Vulnerabilities & Accountability

ys to exploit businesses’ trust in electronic signatures, like using fake DocuSign templates. At the same time, there are new security problems in popular software from Microsoft and Google. Additionally, Microsoft is making sure their top leaders are responsible for keeping the company safe from cyberattacks. In this advisory, we will talk about these issues and how you can implement measures to protect your organization.

Fake DocuSign Templates: A Growing Threat
Scammers are using fake DocuSign templates to trick businesses into giving away sensitive information or making payments. These fake templates look real and can cause significant financial and reputational damage. It’s important to be aware of these scams and take steps to protect your business.

Details:

Scam Types: Scammers create fake DocuSign templates that look like real business documents. Common scams include urgent payment requests, fake legal documents, and threats of data breaches.
Mitigation Steps: To protect against these scams, implement internal controls, conduct regular social engineering tests, educate employees through security awareness training, verify sender identities, and use DocuSign features like pre-defined signers and custom branding.

Microsoft and Google Zero-Day Vulnerabilities
Both Microsoft and Google have recently fixed zero-day vulnerabilities that were being exploited by attackers. These vulnerabilities allowed attackers to gain control over systems and steal data. It’s crucial to apply the latest security patches to protect your systems.

Details:

Microsoft Zero-Day (CVE-2024-30051): This vulnerability in the Windows Desktop Window Manager was used to deliver QakBot malware. It allowed attackers to gain SYSTEM privileges on affected systems.
Google Chrome Zero-Day (CVE-2024-4947): This type of confusion bug in the V8 JavaScript engine was actively exploited. It allowed attackers to execute arbitrary code and perform malicious activities.

Recommendations:

Update Software: Apply the latest security patches from Microsoft and Google immediately.
Monitor Systems: Keep an eye on system activity to detect any signs of exploitation. Using a SIEM to collect and correlate logs to detect and respond to active threats.
Vulnerability Scanning: Conduct regular vulnerability scans and all internal and external infrastructure in IT and OT environments.
Educate Users: Inform users about the importance of installing updates promptly and recognizing when software is out of date.

Microsoft to Hold Executives Accountable for Cybersecurity
Microsoft has announced a new initiative to hold its executives accountable for cybersecurity performance. This move ties executive pay to the company’s security metrics, ensuring top leadership prioritizes robust cybersecurity practices. The Secure Future Initiative (SFI), launched last November, has been expanded to affect executive compensation. Part of the compensation for Microsoft’s Senior Leadership Team will be based on meeting security goals and milestones. Microsoft has also made several changes, including appointing Deputy CISOs and improving security governance.

Reason for Change: This decision comes in response to increasing cyber threats and the growing importance of robust cybersecurity measures. Microsoft has been hit with a number of incidents recently which has not helped its reputation. By tying executive pay to security outcomes, Microsoft aims to ensure that its leadership prioritizes and actively manages cybersecurity risks.
Details of the Policy:
- Performance Metrics: Specific cybersecurity metrics and goals will be set, and the achievement of these goals will directly impact executive bonuses and other forms of compensation.
- Accountability: This policy aims to foster a culture of accountability at the highest levels of the company, ensuring that senior leaders are directly incentivized to prevent data breaches and other security incidents.
Industry Impact: Microsoft’s approach is likely to influence other companies to adopt similar policies, especially as regulatory pressures and cyber threats continue to escalate. This could set a new standard in the tech industry for how companies manage and prioritize cybersecurity.
Public Statements: Microsoft executives have expressed that this initiative underscores the company’s commitment to security and acknowledges the critical role that leadership plays in safeguarding customer data and company assets.

The recent cybersecurity news highlights the variety and seriousness of threats that companies face today. The increase in fake DocuSign templates shows the need for better user education and strong internal controls. Microsoft and Google’s quick response to serious security flaws shows how important it is to update software on time and monitor systems regularly. Microsoft’s new plan to link executive pay to cybersecurity performance sets a new standard for making leaders responsible for protecting company data. Ultimately, a proactive and informed approach to cybersecurity is essential in managing the challenges of today’s interconnected world.

Passwords: The Gift That Keeps on Giving

In honor of World Password Day on May 2^nd, government entities and tech giants are making big moves to raise awareness and promote secure data protection mechanisms. In this article, we spotlight recent news around the security and advancements of robust password policies across the globe.

The Change Healthcare Cyberattack: Lessons Learned the Hard Way

During a U.S. Senate hearing on May 1^st, UnitedHealth CEO, Andrew Witty, acknowledged the root cause of the Change Healthcare cyberattack. Witty attributed the assault from earlier this year to a security lapse and emphasized the importance of multifactor authentication, a standard practice across UnitedHealth, which could have prevented the $872 million breach. Hackers gained access through compromised credentials, unleashing a ransomware storm that disrupted payment and claims processing nationwide.

nGuard recommends services like vulnerability scanning, penetration testing, and managed SIEM, all of which could have detected the weakness exploited in this attack, ensuring a proactive defense against similar incidents in the future. Additionally, nGuard’s cybersecurity incident response (CSIR) services assists organizations in rapidly identifying and containing breaches, minimizing the impact on critical systems and data.

Advancements in Authentication: Google’s Passkey Adoption

In celebration of World Password Day, Google has announced their successes with passkey adoption and utilization. Claiming passkeys have been “used more than one billion times by 400 million Google accounts” and is “50 percent faster”, this milestone reflects a shift towards more secure authentication methods. The conversion will also expand “Cross-Account Protection”, making it even more difficult for cybercriminals to gain initial traction by notifying users of “suspicious events with apps and services” connected to their Google Account. As passwords prove vulnerable to phishing attacks, passkeys offer a promising alternative with increased defenses.

Our services, including penetration testing, and strategic security assessments, can assess the efficacy of authentication mechanisms and security policies to identify gaps and make tailored recommendations to your organization’s needs.

Regulatory Initiatives: The UK Bans Default Passwords

On April 29^th, the United Kingdom became the first country to ban default passwords for IoT devices. While many other entities have taken steps in this direction, this new regulation signifies a more proactive approach to upholding high cybersecurity standards and paving the way for others to do the same. Currently, the United States does not have a federal law for securing IoT devices, although the National Institute of Standards and Technology (NIST) has guidelines for IoT cybersecurity. Governing bodies and manufacturers must prioritize initial security protocols to mitigate risks posed by default credentials.

Our password database audit can assist organizations in testing the strength of encrypted passwords to safeguard against potential breaches.

Combatting Sophisticated Phishing: Insights from LastPass Incident

CryptoChameleon, a sophisticated phishing campaign, is now targeting LastPass users to unveil their master passwords. First, victims receive a robocall which ultimately ends in receiving a follow up call from a live customer service representative that asks questions to officially “close a ticket”. During the call, the scammer provides a reassuring spiel before sending over a link via email to a copycat LastPass site. Once the user enters their credentials, the “agent” immediately has the ability to permanently disable access for the user, and view all of their linked accounts and passwords. LastPass is providing details and updates of operation to promote awareness among users. The evolving nature of social engineering techniques pose significant challenges to traditional security measures, emphasizing the need for heightened awareness and proactive defenses.

nGuard’s simulated and targeted spear phishing social engineering campaigns, security awareness training, and cybersecurity incident response capabilities equip organizations to detect and respond swiftly, minimizing potential damages, and shielding users from advanced phishing and persistent threats.

Embracing Passkey Technology: Microsoft’s Integration

Like Google and Apple, Microsoft has announced the integration of passkey technology for World Password Day. This conversion, taken by world-renowned tech giants, signifies the push for enhanced security and user convenience. Since passkeys cannot be stolen or forgotten, they offer a seamless authentication experience while decreasing dangers associated with traditional credentials and will even be coming soon to associated mobile apps in the “coming weeks”.

In light of recent cyber threats and initiatives, it is evident that safeguarding users from vulnerabilities surrounding passwords is paramount across the globe . From multifactor authentication to security awareness training to security information and event management (SIEM), password protections are becoming increasingly important. As advancements in authentication and lessons learned pave the way for solidifying security, nGuard’s expertise in strategic security assessments, penetration testing, phishing simulations, and holistic policy development, ensures institutions can adapt and thrive in the tumultuous cyberworld.

Palo Alto’s PAN-OS Under Siege: Responding to CVE-2024-3400

Overview of the Vulnerability
Recently, Palo Alto Networks identified a critical zero-day vulnerability in their firewall software, PAN-OS versions 10.2, 11.0, and 11.1. The vulnerability, tracked as CVE-2024-3400, enables unauthenticated actors to execute arbitrary code as root through command injection. This exploit particularly affects devices where both the telemetry and GlobalProtect features are enabled. Initially identified as being exploited in the wild since March 26th, this security flaw has permitted well-resourced, likely state-sponsored threat groups, identified as UTA0218, to implant backdoors, pivot to internal networks, and exfiltrate data.

Technical Analysis
The exploit occurs via command injection where a malicious actor manipulates the SESSID cookie value. This manipulation occurs when the GlobalProtect portal or gateway with telemetry enabled receives the modified SESSID. The string manipulation ultimately executes as a shell command, leading to unauthorized data access or system control.

Impact Assessment
This vulnerability has a significant impact, with over 82,000 firewalls potentially vulnerable, and 40% of these within the United States. The threat was severe enough that CISA added CVE-2024-3400 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to secure their devices promptly. Additionally, numerous proofs of concept (PoCs) are available that exploit this vulnerability, increasing the risk of widespread exploitation.

Response and Mitigation Strategies
Palo Alto Networks has started issuing hotfixes to address this vulnerability. However, they noted that disabling telemetry, once considered a viable mitigation strategy, is no longer effective. To guard against these threats, organizations must install the latest software updates and enable threat prevention capabilities, such as the ‘Threat ID 95187’ in the Palo Alto Networks Threat Prevention subscription.

In the wake of these vulnerabilities, nGuard’s penetration testing services can play a crucial role. By simulating an attack on the network using the latest exploit techniques, nGuard helps identify vulnerabilities before they can be exploited maliciously. Furthermore, nGuard’s vulnerability management solutions provide ongoing detection and remediation of security vulnerabilities, ensuring that firewalls and other critical infrastructure are protected against newly discovered threats.

Forward-Looking Security Strategies
Organizations should not only focus on patch management but also on enhancing their detection capabilities. Continuous monitoring and testing, along with a robust incident response plan, are critical. It’s also vital for organizations to understand that no single mitigation tactic is foolproof; thus, a layered security approach is essential. Employing services like those offered by nGuard not only helps in immediate threat identification and mitigation but also strengthens the security posture against future threats.

Conclusion
The release of exploit code for CVE-2024-3400 has escalated the urgency for organizations using Palo Alto Networks’ firewalls to implement comprehensive security measures. While the provided hotfixes address immediate vulnerabilities, long-term security requires an integrated approach combining technology, processes, and expert services like those provided by nGuard. This proactive stance ensures resilience against evolving cybersecurity threats.

Microsoft’s Cyber Roller Coaster: The Good, The Bad, & The Really Bad

Recently, Microsoft has made significant strides in enhancing its cybersecurity posture while also grappling with challenges that highlight vulnerabilities in its systems. In this advisory, we dissect the recent updates from Microsoft, categorizing them into the good, the bad, and the really bad, and provide insights into how organizations can navigate these changes effectively.

The Good: Azure AI Fortifications
Microsoft’s Azure AI Studio has received notable enhancements aimed at bolstering defenses against emerging threats. Introducing tools designed to protect against prompt injection and ensure the resilience of generative AI applications, developers now have the means to build more reliable and secure AI systems. These advancements signify Microsoft’s commitment to staying ahead of malicious actors in the ever-expanding realm of artificial intelligence.

The Bad: US House of Representatives’ Ban on Copilot
The US House of Representatives has taken a precautionary stance by prohibiting the use of Microsoft’s Copilot chatbot and AI productivity tools due to cybersecurity concerns. The decision reflects apprehensions over potential data leaks to unauthorized cloud services, prompting the House to await a government-tailored version of Copilot. This move underscores the growing need for stringent security protocols, especially in government entities entrusted with sensitive information.

The Really Bad: Cascading Security Failures
A scathing report from the independent Cyber Safety Review Board sheds light on preventable security failures within Microsoft, culminating in a breach with severe implications. The theft of a Microsoft signing key by Chinese hackers underscores systemic issues within the company’s corporate culture, where security has been deprioritized. This revelation serves as a stark reminder of the critical importance of robust security measures in safeguarding against sophisticated cyber threats.

How Can You Project Your Organization?
Organizations face an array of cybersecurity challenges that demand proactive measures to safeguard digital assets and sensitive information. To address these challenges effectively, it is imperative for organizations to conduct comprehensive assessments and deploy robust security solutions. Key assessments include:

External Penetration Testing:
- Identify vulnerabilities in external-facing systems and networks.
- Assess the effectiveness of perimeter defenses against external threats.
Web Application Penetration Testing:
- Detect security vulnerabilities in web applications.
- Prevent common exploits such as SQL injection and cross-site scripting.
- Ensure the confidentiality, integrity, and availability of web-based services.
Security Information and Event Management (SIEM):
- Aggregate, correlate, and analyze security events and logs from various sources.
- Detect and respond to security incidents in real-time.
- Provide insights into potential threats and vulnerabilities across the organization’s IT environment.
- AI-driven anomaly detection in identifying security incidents within the organization’s IT environment.
Vulnerability Management:
- Identify and prioritize security vulnerabilities within systems and networks.
- Remediate vulnerabilities to reduce the risk of exploitation by cyber attackers.
- Establish a continuous monitoring and assessment process to stay ahead of emerging threats.
API Penetration Testing:
- Evaluate the security of APIs and associated endpoints.
- Prevent unauthorized access, data breaches, and API abuse.
- Ensure the integrity and confidentiality of data exchanged through APIs.

The recent events surrounding Microsoft serve as both a cautionary tale and a beacon of progress. While advancements in AI defenses offer promise in mitigating emerging threats, the revelations of cascading security failures and proactive measures such as the House’s ban on Copilot show the persistent challenges in safeguarding digital assets. By adopting robust security protocols, organizations can mitigate risks against evolving cyber threats.

White House Warning: Water Systems Under Threat

The White House issued a stark warning to U.S. governors regarding the escalating risk of “disabling” cybercrimes targeting water systems nationwide. In a recent letter, National Security Advisor Jake Sullivan and Environmental Protection Agency (EPA) Administrator Michael Regan noted the urgent need for enhanced cybersecurity measures to fortify over 150,000 utilities across the country.

These attacks pose a devastating risk to the critical infrastructure, potentially disrupting the vital supply of clean and safe drinking water and imposing substantial costs on affected communities. The letter pointed to specific instances of cyber assaults, led by the China-sponsored hacking group Volt Typhoon and the Iranian Islamic Revolutionary Guard Corps.

In June 2023, nGuard provided a deep dive into Volt Typhoon’s activities and later addressed their five-year persistent access to U.S. infrastructure. These intrusions into critical infrastructure, such as drinking water systems, raise concerns of pre-positioning for disruptive actions in potential geopolitical conflicts. Similarly, the Iranian-linked Cyber Av3ngers targeted water facilities, exploiting easy vulnerabilities like unchanged default passwords, a basic oversight with catastrophic implications. Developing system architecture with defense in depth, coupled with regularly monitoring and updating software, promotes proactivity and can strengthen organizations against comparable attacks.

Despite ongoing efforts by federal agencies like the EPA to bolster cybersecurity regulations for the water sector, challenges persist due to legal obstacles, technical incapacity, and resource constraints. The EPA’s proposed cybersecurity rules faced setbacks, leaving the water sector without binding regulations to address cybersecurity vulnerabilities effectively.

Recognizing the gravity of the situation, the White House is mobilizing efforts to address these threats comprehensively. Federal agencies and state officials are urged to collaborate in identifying vulnerabilities, implementing best practices, and preparing for potential security incidents. In direct response, the EPA is establishing a Water Sector Cybersecurity Task Force to formulate “near-term actions and long-term strategies” to secure water systems nationwide against evolving cyber assaults.

When evaluating your organization’s fortifications, consider the following high impact mitigation steps:

Identify gaps within infrastructure and daily operations through third-party strategic analysis.
Inventory technology assets and perform backups on a regular basis.
Prioritize the logging and monitoring of critical infrastructure to detect new and existing vulnerabilities.
Implement microsegmented architecture and perform penetration segmentation validation testing to validate defense in depth and decrease lateral movement within internal systems.
Simulate real attacks and test plans to build resilience and durability of your own response team.
Develop and update policies, centered around nationally recognized frameworks, such as CMMC and NIST.
Audit configurations, controls, and network segmentation to ensure key devices are up to date and functioning as intended.

As the nation and its respective communities confront these challenges, it becomes imperative to prioritize vigorous cyber footholds and adopt rigorous practices to protect essential services. The White House’s warning is a blaring call for immediate action to solidify defenses and ensure the resilience of utility providers in the wake of emerging cyber strikes.

NIST Drops Game-Changing CSF 2.0

On February 26, 2024, the U.S. National Institute of Standards and Technology (NIST) unveiled Cybersecurity Framework (CSF) Version 2.0, marking a significant update since its 2014 inception. This release emphasizes governance and extends its applicability beyond critical infrastructure. It also addresses supply chain concerns and offers additional implementation support.

NIST CSF has been a cornerstone in managing cybersecurity risk, and the 2.0 version responds to evolving cyber threats, aligning with the National Cybersecurity Strategy. A notable enhancement is the inclusion of a sixth core function – “Govern,” signaling a strategic shift. This function guides organizations in incorporating cybersecurity risk management into broader enterprise risk programs, emphasizing outcomes, and urging informed decisions at the C-suite level.

The emphasis on governance underscores the recognition that cybersecurity is a pivotal enterprise risk factor. 2.0 aims to engage senior leadership, urging them to prioritize cybersecurity alongside financial, supply chain, reputational, and physical risks. This aligns with the landscape where cybersecurity is no longer a technical concern but a strategic imperative.

Unlike its predecessor, CSF 2.0 extends its reach, making it accessible to organizations of all sizes and sectors, moving beyond its initial focus on critical infrastructure. Accompanying this expansion are tailored resources, including success stories, quick-start guides, and a reference tool. These tools cater to diverse entities, such as small businesses, enterprise risk managers, and those securing their supply chains.

Supply chain risk management (SCRM) takes a prominent role in CSF 2.0, acknowledging the complex and interconnected nature of modern supply chains. Guidelines within the new “G-SCRM” function address the intricate challenges associated with supply chain cybersecurity. This aligns with the global reality of supply chains relying on multi-tiered outsourcing between public and private entities.

The release of CSF 2.0 is a response to a shifting cybersecurity landscape and the need for a comprehensive, adaptable framework. By providing tailored resources, acknowledging the significance of governance, and addressing supply chain risks, NIST continues to be at the forefront of guiding organizations to anticipate, understand, and mitigate cybersecurity threats. CSF 2.0 still references processes such as continuous monitoring, vulnerability assessments, penetration testing, and red-team exercises that provide ongoing visibility and drive proactive enhancements.

As organizations grapple with an ever-evolving threat landscape, the CSF 2.0 positions itself not merely as a static document and this updated framework provides a valuable tool to enhance cybersecurity posture, manage risks effectively, and align cybersecurity strategies with broader enterprise goals.