When internet giants Microsoft and Google make bold statistics about stopping greater than 99% of automated attacks by using multifactor authentication (MFA), it is probably a good idea to heed their advice. According to Alex Weinert, Group Program Manager for Identity Security and Protection at Microsoft, based on their studies, accounts are more than 99.9% less likely to be compromised when using MFA.
In the wake of the outbreak of ransomware attacks against more than 20 Texas local governments (as WaterISAC reported in its August 20 Security and Resilience Update and in an August 21 advisory), DHS Cybersecurity and Infrastructure Security Agency (CISA) Director Chris Krebs encouraged organizations to apply the le
If you are not monitoring network activity, you will not detect an attack when it happens. Without the ability to detect threats within your environment, adversaries will go unnoticed. According to numerous findings by CISA during its cybersecurity assessments, while most organizations enable logging, many fail to aggregate relevant logs to a centralized log management system or SIEM (security information and event management) for correlation and analysis.
Phishing defense firm Cofense has observed a new phishing campaign targeting national grid utility infrastructure. The new campaign includes what appears to be a PDF attachment, but is actually a jpg file with an embedded malicious hyperlink directing users to a malicious webpage that downloads Adwind RAT (also known as jRAT, AlienSpy, JSocket, etc.). Adwind RAT evades most antivirus and antimalware detection and foils sandbox analysis.
Cyber insurance policies are not new, but until recent years they lacked maturity. While cyber insurance is still evolving, it is becoming a necessity in cybersecurity resilience strategy. Cisco Talos Intelligence Group published a post covering some key points all businesses should know about cyber insurance. It is important to understand that not all cyber policies are created equal, and it is likely no two policies are the same. Cyber policies are not plug ’n play like traditional vehicle insurance policies and each policy is customized on a case-by-case basis.
The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has published a one-page document addressing considerations in light of the outbreak of ransomware attacks against the nation’s networks. CISA observes that the ransomware infections being reported and discussed in the news are just part of the picture, as many more incidents are not being disclosed.
August 21, 2019
The NCCIC has updated this advisory with additionally information on the nature of the vulnerability. Read the advisory at CISA.
August 13, 2019
On Friday, August 16, the Texas Department of Information Resources (DIR) reports 23 local governments in the state were infected with ransomware in what it described as a coordinated attack. "It appears all entities that were actually or potentially impacted have been identified and notified," DIR said.
Microsoft has released a security update to address an elevation of privilege vulnerability (CVE-2019-1162) in Windows. An attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Microsoft Security Advisory and apply the necessary update.
Back in the day, data found in malware was much more generic, or at least much less specific. Today, with phishing-based scams, BEC, and CEO-fraud leading the pack of cyber attack techniques, the malware samples being uploaded to free malware scanning services reveal far more specific company data than they used to. The Register posted a reminder about the dangers of uploading malware to public online sandbox services. Malware samples certainly provide valuable data for cyber analysts, but malicious actors also view the data.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
