Cybersecurity

The FBI’s Portland, Oregon office has published an advisory providing a background of and tips for defending against e-skimming. E-skimming occurs when cyber criminals inject malicious code onto a website. The threat actor may have gained access via a phishing attack targeting employees – or through a vulnerable third-party vendor attached to a company’s server. Organizations that need to be especially wary of this kind of activity include those that take credit card payments online, as threat actors can capture credit card data in real time as the user enters its.

CISA has published an advisory on code injection, improper restriction of operations within the bounds of a memory buffer, and uncontrolled search path element vulnerabilities in Schneider Electric ProClima. Successful exploitation of these vulnerabilities could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. All versions prior to 8.0.0 are affected. Schneider Electric has released Version 8.0.0 of ProClima and recommends users upgrade to this version or newer. Additionally, CISA recommends a list of actions to mitigate this vulnerability.

Firefox is the only browser that received top marks in a recent audit carried out by Germany's cyber-security agency – the German Federal Office for Information Security (or the Bundesamt für Sicherheit in der Informationstechnik – BSI). The BSI tested Mozilla Firefox 68 (ESR), Google Chrome 76, Microsoft Internet Explorer 11, and Microsoft Edge 44. The tests did not include other browsers like Safari, Brave, Opera, or Vivaldi. The audit was carried out using rules detailed in a guideline for "modern secure browsers" that the BSI published last month, in September 2019.

What do people have to do with cybersecurity? In a word, everything. Reports consistently cite over 90% of cyber attack exploits target humans over system vulnerabilities. As stated by one of the world’s most notorious hackers, Kevin Mitnick (now Chief Hacking Officer at KnowBe4), it is easier to get someone to “reveal” something than it is to “hack” into their system.