You are here

Home

Cybersecurity

WaterISAC's 12 Cybersecurity Fundamentals for Water and Wastewater Utilities – Release of Fundamentals 1-3

Today, WaterISAC is unveiling the first three of its newly updated 12 Cybersecurity Fundamentals for Water and Wastewater Utilities as part of a concerted effort to provide the sector with the most up-to-date guidance (see attached). At the WaterISAC Cyber Resilience Briefing yesterday, Gus Serino, President at I&C Secure, walked attendees through the first three of the Fundamentals and gave a high-level overview of their importance and practical application.

For Situational Awareness: Readout from State Convening to Discuss Cybersecurity and the Water Sector

WaterISAC is sharing this for your situational awareness. Last week, Anne Neuberger, Deputy National Security Advisor for Cyber and Emerging Technologies and Janet McCabe, EPA Deputy Administrator, met with state and local officials from across the country to discuss cybersecurity in the water sector. This meeting was initiated by EPA Administrator Michael Regan and National Security Advisor Jake Sullivan after they sent a letter to U.S. Governors.

Ransomware Resilience – It’s Better to Learn from Someone Else’s Ransomware Incident

Throughout the decade, ransomware has become a prime method for attackers and one of the most impactful on victims. Threat actors don’t seem to discriminate, with attacks spanning all kinds of industries, both large and small. Regardless of the size or type of organization, when incidents occur there are always practical lessons that everyone can learn from to bolster your own resilience against similar attacks.

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins – March 26, 2024

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins – March 26, 2024

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:

ICS Vulnerability Advisories:

CISA Releases Four Industrial Control Systems Advisories

Passthrough: CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate SQL Injection Vulnerabilities

CISA and the FBI released a joint Secure by Design Alert, Eliminating SQL Injection Vulnerabilities in Software. The alert came in response to a recent exploitation of SQL injection in a managed file transfer application (MOVEit) that affected thousands of organizations.

Threat Awareness – MFA Bypass Attacks Keep Getting Easier to Execute

As Phishing-as-a-Service (PhaaS) offerings continue lowering the barrier to entry for low-skilled threat actors, “Adversary-in-the-Middle” (AitM) attacks have become much less technical to execute. Open-source toolkits make phishing campaigns accessible to the most novice threat actors. With such frameworks, actors can easily create custom Microsoft365 login pages and mimic other popular websites such as Amazon, Google, LinkedIn, Facebook, and X (formerly Twitter) to conduct opportunistic or highly targeted phishing campaigns.

Pages

Subscribe to Cybersecurity