Cybersecurity

Rather than focusing on applying all new patches as soon as possible, a new report from Kenna Security and the Cyentia Institute suggests organizations tackle security from the vantage point of prioritization. With over 110,000 CVEs published-and roughly 300 new CVEs published per week in 2018-staying current with vulnerabilities as they are uncovered is likely to become overwhelming. Likewise, doing so can overextend IT security professionals.

According to an article from Symantec, attacks on industrial control systems (ICS) and Internet of Things (IoT) on the upswing, but organizations aren’t always doing enough to defend themselves. Symantec notes it logged a six-fold increase in the number attacks on customers' IoT systems last year. Elsewhere, 41 percent of ICS computers were attacked in the first half of 2018, up from 37 percent a year earlier.

The NCCIC has published an advisory on path traversal and improper authentication vulnerabilities in Johnson Controls Facility Explorer. Versions 14.x prior to 14.4u1 and 6.x prior to 6.6 are affected. Successful exploitation of these vulnerabilities could allow an attacker to read, write, and delete sensitive files to gain administrator privileges in the Facility Explorer system. Johnson Controls has mitigated these vulnerabilities in the updated versions, which the NCCIC recommends users upgrade to. The NCCIC also advises on a series of mitigating measures for this vulnerability.

An article from CSO magazine describes how a hacker can send someone an email and capture their password hash, and then crack it to a plaintext password that can be used to access their accounts. Hashing is the act of converting passwords into unreadable strings of characters that are designed to be impossible to convert back, known as hashes. Cracking the password hash is possible because under easy-to-simulate circumstances, embedded links in an email can cause your computer to try authenticating to a remote server.