Cybersecurity

The FBI has published a TLP:WHITE FLASH message providing indicators of COVID-19 phishing emails to assist in network defense. The FBI advises that cyber criminals, who include advanced persistent threat (APT) groups, have crafted COVID-19-themed health, informational, and warning notice emails in an attempt to obtain online service credentials, such as those for Microsoft Office 365 accounts. Additionally, cyber criminals have attached archive files that contain malicious portable executables (PE) or JAVA.jar files to their phishing emails.

The Canadian Centre for Cyber Security (the Cyber Centre) has published a guide containing focused cybersecurity advice during the COVID-19 pandemic. This guide, which is organized into sections of guidance for IT management, IT implementation, and client awareness, offers a curated selection of the Cyber Centre’s collection of advice and other products. For example, the IT management section highlights the Cyber Centre’s Cloud Security Risk Management guide, which outlines an integrated risk management approach to establishing cloud-based services.

The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has published an Alert providing recommendations related to Microsoft Office 365 (O365) deployments, which organizations can review to ensure their environments have been properly configured to protect, detect, and respond against potential attackers. CISA adds that since many organizations have recently migrated to cloud collaboration services, such as O365, and perhaps did so speedily, they may not have fully considered the security configurations of these platforms.

The Canadian Internet Registration Authority (CIRA, the non-profit agency that managers the .ca Internet domain) and Canadian Centre for Cyber Security have teamed up to offer Canadian Shield, a free protected domain name system (DNS) service that prevents Canadians from connecting to malicious websites that might infect their devices and steal their personal information. CIRA is providing the threat blocking technology while the Canadian Centre for Cyber Security is offering its threat intelligence services – basically a who's-who list of every bad actor roaming the web.