You are here

Home » Cybersecurity

Cybersecurity

Be Prepared with Public-Private Partnerships

SecurityRoundtable.org, powered by Palo Alto Networks posted resounding support for the necessity of public-private partnerships in the fight against cyber threats. Citing the fact that threat actors participate in collaboration to further attack campaigns, it is imperative that organizations across all facets of business do it better in defense of our networks and homeland security. The post cites several law enforcement organizations that are key to successful information and intelligence sharing, many of which WaterISAC maintains relationships.

Palo Alto Releases Security Updates for PAN-OS

Palo Alto Networks has released security updates to address a vulnerability affecting the use of Security Assertion Markup Language in PAN-OS. An unauthenticated attacker with network access could exploit this vulnerability to obtain sensitive information. CISA encourages users and administrators to review Palo Alto Security Advisory for CVE-2020-2021 and apply the necessary updates or workarounds.

Netgear Router Vulnerabilities

The U.S. Department of Homeland Security Cybersecurity and Infrastructure Agency (CISA) reports multiple Netgear router models contain vulnerabilities that a remote attacker can exploit to take control of an affected device. CISA encourages users and administrators to update to the most recent firmware version and to replace end-of-life devices that are no longer supported with security patches. Given the increase in telework, CISA recommends that CISOs consider the risk that these vulnerabilities present to business networks.

Rockwell FactoryTalk Services Platform XXE (ICSA-20-177-02) – Product Used in the Water and Wastewater Sector

CISA has published an advisory on an improper restriction of XML external entity reference vulnerability in Rockwell Automation FactoryTalk Services Platform. Versions 6.11.00 and earlier affected. Successful exploitation of this vulnerability could lead to a denial-of-service condition and to the arbitrary reading of any local file via system level services. Affected users are encouraged to use Rockwell Automation Knowledgebase article 25612 to determine if FactoryTalk Services Platform is installed.

Rockwell FactoryTalk View SE (ICSA-20-177-03) – Product Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on cleartext storage of sensitive information and weak encoding for password vulnerabilities in Rockwell Automation FactoryTalk View SE. Versions 9.0 and earlier and 10.0 are affected. Successful exploitation of these vulnerabilities could lead to unauthorized access to server data. Users of the affected versions of DeskLock provided with FactoryTalk View SE are encouraged to update to an available software version that addresses the associated risk, v10.0 or later.

ICS/OT Policies and Procedures – Evaluating Effective Incident Response in Times of Lockdown

There is no question, this new age surrounding COVID-19 has definitely forced all organizations to rethink, reassess, reaffirm, or redesign many policies and procedures. ICS organizations are no exception. However, perhaps one of the critical functions that has not been given its due attention is incident response. Likewise, incident response is often not given its due attention under the best of times.

ABB Device Library Wizard (ICSA-20-175-03) – Product Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on an insecure storage of sensitive information vulnerability in ABB Device Library Wizard. Versions 6.0.X, 6.0.3.1, and 6.0.3.2 are affected. Successful exploitation of this vulnerability could allow a low-level user to escalate privileges and fully compromise the device. ABB recommends users apply updates to address the vulnerability. CISA also recommends a series of measures to mitigate the vulnerability. Access the advisory at CISA.

Smart City Systems Implementation Resource Guide

The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has published a Trust in Smart City Systems report. It is intended to serve as a resource guide for discussions between smart city decision-makers, designers, and implementers during the initial, high-level design of a smart city project and make decisions based on a more complete understanding of the tradeoffs.

Honeywell ControlEdge PLC and RTU (ICSA-20-175-02) – Products Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on a cleartext transmission of sensitive information vulnerability in Honeywell ControlEdge PLC and RTU. ControlEdge PLC R130.2, R140, R150, and R151 and ControlEdge RTU R101, R110, R140, R150, and R151 are affected. Successful exploitation of these vulnerabilities could allow an attacker to obtain passwords and session tokens. Honeywell provided detailed information for mitigation on the insecure communication in Control Edge PLC\RTU, available in a support document. CISA also recommends a series of measures to mitigate the vulnerability.

Pages

Subscribe to Cybersecurity