Cybersecurity

The Cybersecurity and Infrastructure Security Agency (CISA) warns users to remain vigilant for malicious cyber activity targeting Hurricane Dorian disaster victims and potential donors. Fraudulent emails commonly appear after major natural disasters and often contain links or attachments that direct users to malicious websites. Users should exercise caution in handling any email with a hurricane-related subject line, attachment, or hyperlink. In addition, users should be wary of social media pleas, texts, or door-to-door solicitations relating to severe weather events.

The NCCIC has published an advisory on a stack-based buffer overflow vulnerability in EZAutomation EZ Touch Editor. Versions 2.1.0 and prior are affected. Successful exploitation of this vulnerability could allow an attacker to execute code under the privileges of the application. EZAutomation recommends users update to Version 2.2.0 or later and, to further reduce the risk, to use project files from known sources. The NCCIC also recommends a series of measures to mitigate the vulnerability.

The NCCIC has published an advisory on an authentication bypass using an alternate path of channel vulnerability in Datalogic AV7000 Linear Barcode Scanner. All versions prior to 4.6.0.0 are affected. Successful exploitation of this vulnerability could allow a remote attacker to bypass authentication through issues in the HTTP authentication process. Datalogic reports a new version of the firmware was released to mitigate the reported vulnerability. The NCCIC also recommends a series of measures to mitigate the vulnerability.

The ongoing process of asset management is foundational for assessing, prioritizing, and managing risk across the entire organization. Without knowing what assets you have, there is nothing meaningful to inform other risk management programs such as vulnerability management, governance, incident response, etc. WaterISAC's 15 Cybersecurity Fundamentals for Water and Wastewater Utilities discusses the importance of including asset characteristics beyond just a list of devices for a comprehensive inventory record.