You are here

Home » Cybersecurity

Cybersecurity

Empowering Small and Medium-Sized Businesses: A Resource Guide for Developing a Resilient Supply Chain Risk Management Plan

The ICT SCRM Task Force’s newest resource, Empowering SMBs: A Resource Guide For Developing a Resilient Supply Chain Risk Management Plan, was created to provide a valuable starting point for small and medium-sized businesses (SMBs) to develop and tailor an information and communications technology (ICT) supply chain risk management (SCRM) plan that meets the needs of their business. The Task Force SMB Resource Guide is a supportive tool that an organization can leverage to establish an actionable SCRM plan that will support the mitigation of risks and disruptions to their supply chains.

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins – October 17, 2023

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:

ICS Vulnerability Advisories:

CISA Releases Two Industrial Control Systems Advisories

Products are used across multiple sectors, please check these latest advisories for specific equipment used across your ICS environments and address accordingly.

Unsubstantiated Ransomware Threats Against Colonial Pipeline: The Ongoing Challenge of False Allegations

Colonial Pipeline reported that there has been no disruption to its pipeline operations or systems following threats from a ransomware group known as Ransomed.vc, stating the claims made by Ransomed.vc are "unsubstantiated." To validate the security of its systems, Colonial Pipeline collaborated with its security and technology teams and CISA, confirming there had been no disruption to pipeline operations and that its system remained secure. It is believed that the files initially posted online appeared to be related to a third-party data breach that was unrelated to Colonial Pipeline.

Threat Awareness – Phishing Campaign Leveraging LinkedIn Smart Links Returns to Siphon Microsoft Credentials

Cofense detected a surge in the abuse of LinkedIn Smart Links in phishing attacks allowing actors to bypass protection measures and evade detection. “Smart Links are part of LinkedIn's Sales Navigator service, used for marketing and tracking, allowing Business accounts to email content using trackable links to determine who engaged with it. Also, because Smart Link uses LinkedIn's domain followed by an eight-character code parameter, they appear to originate from a trustworthy source and bypass email protections” (Bleeping Computer, 2023).

Don’t Dismiss DDoS Defense

Google says it mitigated a series of DDoS attacks reaching a peak of 398 million requests per second (rps), which is nearly 9 times bigger than the largest-recorded DDoS attack last year, peaking at 46 million rps. The latest set of attacks started in August and are still ongoing. According to Google, the attacks rely on a novel technique dubbed “Rapid Reset” which leverages stream multiplexing, a feature of the widely adopted HTTP/2 protocol.

Pages

Subscribe to Cybersecurity