Cybersecurity

An article from IBM provides steps to build an immersive simulation when cultivating an organization’s cybersecurity culture. A cybersecurity culture can’t be built with training alone – it must also involve exercises to ensure the policies personnel have been trained to uphold are effective and that the training to ensure compliance with these policies was effective.

The GandCrab ransomware family emerged in late February 2018 and was quickly adopted by cybercriminals because it offered something no other ransomware family had offered before: custom ransom amounts. While the average user would be reluctant to spend as much as $500 to get their data back, organizations and companies would be far more interested in paying larger amounts of money. Currently, the most prolific versions of GandCrab are versions 4 and 5, which are estimated to have infected around 500,000 victims worldwide since July 2018.

The NCCIC has released an advisory on an improper privilege management vulnerability in PEPPERL+FUCHS CT50-Ex. CT50-Ex running Android OS v4.4 and v6.0 are affected (the original manufacturer was Honeywell). Successful exploitation of this vulnerability could allow a malicious third-party application to gain elevated privileges and obtain access to sensitive information. An update is available that resolves this vulnerability. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.

The U.S. Department of Homeland Security National Cybersecurity and Communications Integration Center (NCCIC) has produced a new Security Tip, Proper Disposal of Electronic Devices. The NCCIC emphasizes that in addition to effectively securing sensitive information on electronic devices, it is important to follow best practices for electronic device disposal.