Cybersecurity

In October 2023, Health-ISAC (H-ISAC) facilitated an all-day workshop and tabletop exercise with Health-ISAC members and United States Government (USG) agencies in Washington, DC. While the exercise involved healthcare organizations, the scenario and challenges are applicable and representative broadly across all critical infrastructure sectors. The H-ISAC has released its Hobby Exercise 2023 After Action Report, which documents the lessons learned and challenges experienced upon review of its most recent Hobby Exercise Series.

Email-based attacks are arguably the most prevalent phishing technique used to gain initial access to “VIP” accounts such as executives, finance managers, and human resources staff. Attacks targeting executives are nothing new, but a couple of recent campaigns highlight the importance of the need to include executives, C-Suite, and other leadership in security awareness training. Two recent campaigns are leveraging Microsoft Azure corporate clouds and QR code phishing (quishing) to abscond with sensitive information, including credentials.

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins – February 13, 2024

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:

ICS Vulnerability Advisories:

CISA Releases One Industrial Control Systems Advisory

WaterISAC and the National Rural Water Association (NRWA) recently announced a formal collaboration effort intended to educate rural utilities across the country about both cyber and physical security threats. The collaboration comes in hopes to increase resilience efforts among some of the country’s smallest and often overlooked utilities, including 25,000 NRWA members that serve populations of 3,300 or fewer.