PenTestPartners (PTP) is known for straightforward posts and practical analysis. This cyber hygiene article respectfully challenges some authoritative guidance (from the National Cyber Security Centre) – whether or not three random word passwords are strong enough. This is another good candidate for security awareness reminders on the importance of creating less crackable passwords.
The Cybersecurity and Infrastructure Security Agency (CISA) is announcing the issuance of three “Capacity Enhancement Guides.” While these guides are specifically directed at federal agencies, they contain best practices that can be applied more broadly across state, local, tribal, and territorial governments and the private sector. Access the guides at CISA.
The guides include:
The National Security Agency (NSA) has released an information sheet with guidance for enterprise network owners and administrators on adopting encrypted Domain Name System (DNS) over Hypertext Transfer Protocol over Transport Layer Security (HTTPS), referred to as DNS over HTTPS (DoH). When configured appropriately, strong enterprise DNS controls can help prevent many initial access, command and control, and exfiltration techniques used by threat actors.
The FBI has published a Private Industry Notification (PIN) observing that cyber criminals are focusing their operations to target employees of companies worldwide who maintain network access and an ability to escalate network privilege. The FBI explains that during COVID-19 shelter-in-place and social distancing orders, many companies had to quickly adapt to changing environments and technologies and may not be fully monitoring network access and privilege escalation.
Joker’s Stash, one of the oldest, most successful credit card and point-of-sale dump repositories appears to be closing its doors. According to Flashpoint, between PCI-DSS enhancements, COVID-19, and blockchain domain takedowns, Joker’s Stash may have finally succumbed to death by a thousand cuts. As many utilities accept credit cards for payments, there is always concern about the card processing platform or service becoming compromised and actors absconding with hundreds or thousands of payment card records processed for utility payments.
WaterISAC Cybersecurity Risk Analyst Jen Walker put the spotlight on WaterISAC during a recent “Cybersecurity Evangelist” podcast she hosts for risk management firm Gate 15. Jen spoke with WaterISAC Director of Preparedness and Response Chuck Egli, and together they discussed how WaterISAC operates in support of the security and resilience of the water and wastewater sector. Their conversation included discussions of WaterISAC’s products and services, providing an orientation for new and aspiring members and a refresher for WaterISAC veterans.
Purchase Order Scams
The Cybersecurity and Infrastructure Security Agency (CISA) has published an analysis report advising that threat actors are using phishing and other vectors to exploit poor cyber hygiene practices within a victims’ cloud services configuration, adding that it is aware of several recent successful attacks. CISA observes these types of attacks frequently occurred when victim organizations’ employees worked remotely and used a mixture of corporate laptops and personal devices to access their respective cloud services.
Researchers at Heimdal Security have provided a high-level overview of MegaCortex ransomware. While MegaCortex has been primarily known to target enterprise networks, members may recall that version 2 has been linked to its OT process aware cousin, EKANS. For more on EKANS and its relationship to MegaCortex v2, members are encouraged to review the Security & Resilience Update on February 4, 2020.
‘Tis the new year, and with a new year comes a great time to revisit some of the basic blocking and tackling of cybersecurity. Listed in this post you will find sage guidance on some cyber hygiene basics. Tackle a topic a week and you’re sure to keep busy. Oh, and don’t forget to review those policies and procedures (#9 in WaterISAC’s 15 Cybersecurity Fundamentals for Water and Wastewater Utilities) – these tips and tools could be valuable updates!
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
