Treasury Department Warns of Potential Penalties for Ransomware Victims Who Pay
Late last week, the U.S. Treasury Department published an advisory warning that ransomware victims who pay hackers that are under U.S. sanctions could be punished.
Cybersecurity
National Cybersecurity Awareness Month 2020, Week One – If You Connect It, Protect It
National Cybersecurity Awareness Month 2020’s Week 1 theme, “If You Connect It, Protect It” seems fitting this year. With widespread and persistent remote working, there is no telling how many home routers, wireless access points, mobile devices, gaming systems, toasters, coffeemakers, and baby monitors have unintentionally been connected to corporate networks. Left unsecured, these hostile foreign devices are not only vulnerable to a plethora of cyber threats, but they also have the potential to wreak havoc on enterprise networks, home networks, and the internet at large.
Security Incident Survey (July to September 2020)
In support of its mission to identify threats to the water and wastewater sector, WaterISAC is asking utilities to respond to its survey asking about incidents and suspicious activities they've experienced in the past quarter, from July 1 to September 30, 2020. WaterISAC will aggregate, anonymize*, and share with members the information collected from the survey in its next Quarterly Water Sector Incident Summary report. The response deadline is Friday, October 16, 2020.
National Cybersecurity Awareness Month 2020 Kickoff
It’s October! And while many are thinking pumpkin spice and everything nice, in the cybersecurity realm October has become synonymous with National Cybersecurity Awareness Month (NCSAM). But given cyber is a part of everyday life and a cost of doing business, NCSAM isn’t just for cybersecurity, it’s for everybody. Cybersecurity is a shared responsibility among all people.
WaterISAC Presents ‘15 Cybersecurity Fundamentals Awareness Month’ (15CFAM)
In honor of National Cybersecurity Awareness Month (NCSAM), WaterISAC will cover each of our 15 Cybersecurity Fundamentals during the month of October. We dubbed the series, ‘15 Cybersecurity Fundamentals Awareness Month’ (15CFAM). The goal of 15CFAM is to provide reminders along with additional resources not previously included in the current guide. Members can track ongoing posts through the Resource Center on our portal with the ‘15CFAM’ tag.
CISA Alert: Potential for China Cyber Response to Heightened U.S-China Tensions
The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has published an alert providing specific Chinese government and affiliated cyber threat actor tactics, techniques, and procedures (TTPs) and recommended mitigations In light of heightened tensions between the U.S. and China. CISA is providing this information to assist in the protection of the nation’s critical infrastructure. In addition to recommendations listed in the mitigations section of the alert, CISA recommends organizations take the following actions:
Ransomware Guide (DHS and MS-ISAC)
The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have jointly published the Ransomware Guide, which details practices organizations should engage in to help manage the risk posed by ransomware. The guide consist of two parts, with the first providing best practices to prevent attacks and the second consisting of a response checklist.
Telework Essentials Toolkit (DHS)
The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has released the Telework Essentials Toolkit, a comprehensive resource of telework best practices. The Toolkit provides three personalized modules for executive leaders, IT professionals, and teleworkers. Each module outlines distinctive security considerations appropriate for their role:
CISA Analysis Report: Federal Agency Compromised by Malicious Cyber Actor
The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has published an analysis report on a recent threat actor’s cyber attack on a federal agency’s enterprise network.
MB connect line mbCONNECT24, mymbCONNECT 24 (ICSA-20-273-01)
CISA has published an advisory on SQL injection, cross-site request forgery, and command injection vulnerabilities in MB connect line mbCONNECT24 and mymbCONNECT 24. For both products, versions 2.6.1 and prior are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to gain unauthorized access to arbitrary information or allow remote code execution. MB connect line recommends users update mymbCONNECT24 and mbCONNECT24 to Version 2.6.2 or higher. CISA also recommends a series of measures to mitigate the vulnerabilities.
Pages
