Cybersecurity

The Canadian Centre for Cyber Security (the Cyber Centre) has published a guide containing focused cybersecurity advice during the COVID-19 pandemic. This guide, which is organized into sections of guidance for IT management, IT implementation, and client awareness, offers a curated selection of the Cyber Centre’s collection of advice and other products. For example, the IT management section highlights the Cyber Centre’s Cloud Security Risk Management guide, which outlines an integrated risk management approach to establishing cloud-based services.

The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has published an Alert providing recommendations related to Microsoft Office 365 (O365) deployments, which organizations can review to ensure their environments have been properly configured to protect, detect, and respond against potential attackers. CISA adds that since many organizations have recently migrated to cloud collaboration services, such as O365, and perhaps did so speedily, they may not have fully considered the security configurations of these platforms.

The Canadian Internet Registration Authority (CIRA, the non-profit agency that managers the .ca Internet domain) and Canadian Centre for Cyber Security have teamed up to offer Canadian Shield, a free protected domain name system (DNS) service that prevents Canadians from connecting to malicious websites that might infect their devices and steal their personal information. CIRA is providing the threat blocking technology while the Canadian Centre for Cyber Security is offering its threat intelligence services – basically a who's-who list of every bad actor roaming the web.

CISA has published an advisory on exposure of sensitive information to an unauthorized actor and improper input validation vulnerabilities in LCDS LAquis SCADA. Versions 4.3.1 and prior are affected. Successful exploitation of these vulnerabilities could allow unauthorized attackers to view sensitive information and create files in arbitrary locations. LCDS recommends users update to the latest version of LAquis SCADA. CISA also recommends a series of measures to mitigate the vulnerabilities.