You are here

Home » Cybersecurity

Cybersecurity

Threat Awareness – Presence of Chinese Manufactured Connected Devices in U.S. Networks, Including Water and Wastewater Utilities

There have been significant concerns in recent years over specific foreign-made components existing on U.S. networks, specifically devices and software connected to the internet carrying the risk of the potential for abuse via backdoors, supply chain implants, and tampering to aid in espionage or disrupt critical infrastructure. However, despite official government bans, research indicates foreign-manufactured connected device usage is growing faster in the U.S. than in other countries.

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins – April 2, 2024

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins – April 2, 2024

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:

ICS Vulnerability Advisories:

CISA Releases One Industrial Control Systems Advisory

Security Awareness – Impersonation Scams, the Real Threat?

Data compiled by the FTC’s Consumer Sentinel Network shows that losses from impersonation scams in 2023 top $1.1 billion, three times higher than in 2020. The data was based on 490,000 scams reported to the agency in 2023, 330,000 of which were for business impersonation complaints, and the rest were from government impersonations. Most of the scams were conducted via phone calls, followed by email and text messaging, although the former has been in decline, and the latter on the rise, for the last three years.

Vulnerability Awareness – Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library

Reports of malicious code being embedded in XZ Utils versions 5.6.0 and 5.6.1 have caused CISA and the open source community to respond. XZ Utils is data compression software and may be present in Linux distributions. The malicious code may allow unauthorized access to affected systems.

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins – March 28, 2024

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins – March 28, 2024

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following alerts, updates, and bulletins.

  • There were no Industrial Control Systems Advisories since March 26 as of this writing.

Alerts, Updates, and Bulletins:

Report – Google and Mandiant Report Show Zero-Day Trends Exploited In-the-Wild

Google’s Threat Analysis Group (TAG) and Mandiant produced a first-ever joint report that digs into the zero-day vulnerabilities that were exploited in 2023 to better understand threat actor behavior and key trends. The report shows 97 zero-day vulnerabilities were exploited in 2023, 50 percent more than the 62 in 2022, but slightly less than the 106 peak in 2021.

Passthrough: CISA Seeks Input on CIRCIA, Proposed Rulemaking on Mandatory Cyber Incident Reporting

Yesterday, the Federal Register posted for public comment CISA’s Notice of Proposed Rulemaking (NPRM), which the agency was required to develop by the “Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)”. The proposal describes when critical infrastructure organizations will be required to report cybersecurity incidents.

WaterISAC's 12 Cybersecurity Fundamentals for Water and Wastewater Utilities – Release of Fundamentals 1-3

Today, WaterISAC is unveiling the first three of its newly updated 12 Cybersecurity Fundamentals for Water and Wastewater Utilities as part of a concerted effort to provide the sector with the most up-to-date guidance (see attached). At the WaterISAC Cyber Resilience Briefing yesterday, Gus Serino, President at I&C Secure, walked attendees through the first three of the Fundamentals and gave a high-level overview of their importance and practical application.

Pages

Subscribe to Cybersecurity