You are here

Home

Cybersecurity

ICS/OT Threat Awareness – Censys Researchers Reveal Over 40,000 Vulnerable ICS Devices, Many Linked to Water and Wastewater

Recent research conducted by Censys, an internet intelligence platform, provides an extensive analysis of the exposure of industrial control systems (ICS), discovering over 40,000 vulnerable ICS devices in the U.S. alone. Excluding building control and automation protocols, there are approximately 18,000 exposed devices likely controlling critical industrial systems. Additionally, nearly half of the human-machine interfaces (HMIs) associated with water and wastewater systems were found to be vulnerable to manipulation without requiring any authentication.

CISA Alert – CISA Releases Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem

Today, CISA and the FBI jointly published “Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem.” The guide is designed to help organizations drive a secure technology ecosystem by ensuring their software manufacturers prioritize secure technology from the start.

CISA Alert – Royal Ransomware Actors Rebrand as “BlackSuit,” FBI and CISA Release Update to Joint Advisory

The FBI and CISA recently published an update to the joint Cybersecurity Advisory “#StopRansomware: Royal Ransomware.” The updated advisory provides network defenders with recent and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with BlackSuit variants (previously Royal). FBI investigations identified these TTPs and IOCs as recently as July 2024.

Situational Awareness – DigiCert Certificate Revocations and Possible Impact to Critical Infrastructure

DigiCert, a leading certificate authority (CA), began revoking thousands of SSL/TLS certificates due to a recently identified domain validation flaw. On July 29, the company informed its customers of the urgent need to revoke these certificates, citing strict compliance requirements set by the CA/Browser Forum (CABF). Initially, it was estimated that about 0.4% of validations were impacted; however, further discussions revealed that more than 83,000 certificates and over 6,800 subscribers were affected.

Fraud Alert – EPA Office of Inspector General Issues Notice of Violation Phishing Scam

The EPA Office of Inspector General (OIG) has issued a fraud alert regarding a recent trend involving phishing scams that utilize fraudulent EPA Notice of Violation letters. In this scheme, scammers send counterfeit letters to businesses, falsely claiming they have violated environmental regulations like the Clean Air Act and demanding immediate payment of substantial fines.

CISA Publishes Resources for Onboarding and Employment Screening to Help Manage the Risk of Insider Threats

Last week, CISA released a new resource, "Resources for Onboarding and Employment Screening," designed for critical infrastructure leaders, human resources (HR) personnel, and managers at any level. This fact sheet provides actionable recommendations and resources for vetting and screening of individuals prior to hiring into an organization. Overall, the goal in conducting personnel vetting and background checks is to reduce the potential for insider threat activity.

Pages

Subscribe to Cybersecurity