Aggregator

Name: Arab Security Cyber Wargames 2024 Qualifications (an Arab Security Cyber Wargames event.)
Date: Aug. 2, 2024, 1 p.m. — 03 Aug. 2024, 13:00 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://www.ascyberwargames.com/ascwgs2024/
Rating weight: 0.00
Event organizers: Arab Security Cyber Wargames

Name: PECAN+ CTF 2024 (an PECAN+ CTF event.)
Date: Aug. 4, 2024, 1 a.m. — 04 Aug. 2024, 05:00 UTC  [add to calendar]
Format: Jeopardy
On-site
Location: Australia
Offical URL: https://pecanplus.ecusdf.org/
Rating weight: 0.00
Event organizers: PECAN+

Insight #1: Don't shrug off this internet plague! Cross-site scripting (XSS) is the overlooked vulnerability plaguing the web. As Contrast’s
recent attack data show, it's everywhere, yet it’s often dismissed as “'low risk.” The truth? This prevalence makes XSS more of a threat, and it's easily exploited. Fortunately,
Application Detection and Response (ADR) is here to help you stop it!   Insight #2: Finding root cause doesn't always solve the problem 

Root cause analysis is not just about figuring out the technical problems that may have occurred, as Forbes describes. Technical problems rarely exist in isolation. They often occur within the context of a larger process or workflow. If that process is inefficient, it can create conditions that make technical problems more likely to occur, or harder to detect and fix.

  Insight #3: Fixing culture helps fix security  So many interesting interactions with peers over the last few months are making me realize that there is still a major disconnect between finding and fixing vulnerabilities and the culture that drives it. Too many security leaders don't care about culture and care more about resolving risk. But I would argue that creating a positive security culture will naturally help to address vulnerabilities faster (
mean time to respond/remediate [MTTR]) and create less vulnerabilities as time goes on (
vulnerability escape rate [VER]). Why can't we get over this hump?

The post Cybersecurity Insights with Contrast CISO David Lindner | 09/20/24 appeared first on Security Boulevard.

Report finds that many critical infrastructure networks can be breached using simple attacks. Plus, a new MITRE Engenuity tool uses machine learning to infer attack sequences. Meanwhile, CISA will lead a project to standardize civilian agencies’ cyber operations. And get the latest on XSS vulnerabilities, CIS Benchmarks and a China-backed botnet’s takedown!

Dive into six things that are top of mind for the week ending September 20.

1 - CISA: Critical infrastructure orgs susceptible to common attacks

After assessing the security of 143 critical infrastructure organizations in 2023, the U.S. government found most of the networks could be breached using ordinary, well-known attack methods.

That’s according to “CISA Analysis: Fiscal Year 2023 Risk and Vulnerability Assessments,” a report about the risk and vulnerability assessments (RVAs) conducted by the Cybersecurity and Infrastructure Security Agency (CISA) and the U.S. Coast Guard (USCG).

Specifically, CISA and USCG assessors had the most success gaining initial access, attaining network permanence, evading defenses and moving laterally by using valid accounts, phishing schemes and default credentials – all simple attack methods.

For example, the use of valid accounts, which are legitimate accounts whose login credentials have been compromised, was the most successful attack technique for achieving:

• Initial access (41.3%)
• Persistence (42.2%)
• Privilege escalation (44.7%)

Valid-account use also ranked as the second most successful attack technique for evading defenses.

(Source: “CISA Analysis: Fiscal Year 2023 Risk and Vulnerability Assessments” report, September 2024)

The report offers troves of recommendations to critical infrastructure organizations, including:

• Adopt a secure password policy that requires phishing-resistant multi-factor authentication for remote access; strong passwords; unique credentials, and more.
• Maintain a comprehensive asset inventory, and keep software updated and patched.
• Segment networks and block outbound connections from internet-facing servers to prevent lateral movement and privilege escalation.

Each of the 143 critical infrastructure organizations received a report about their network security results, mapped to the MITRE ATT&CK framework. Each report included key findings, improvement recommendations, potential mitigations and attack path details.

To get more details, read the 24-page “CISA Analysis: Fiscal Year 2023 Risk and Vulnerability Assessments” report and complementary charts.

For more information about protecting critical infrastructure environments and about operational technology (OT) security, check out these Tenable resources:

• “Critical Infrastructure Cybersecurity: Disrupt OT Attack Vectors in the New Era of Distrust” (white paper)
• “Addressing Critical Infrastructure Threats for State and Local Governments” (solution overview)
• “CISA Finding: 90% of Initial Access to Critical Infrastructure Is Gained Via Identity Compromise. What Can You Do About It?” (blog)
• “Enhancing Critical Infrastructure Cybersecurity for Water Utilities” (infographic)
• “Adhering to the NIST Framework with Tenable OT Security” (data sheet)

2 - New MITRE tool uses ML to anticipate cyberattacks 

To help cybersecurity teams stay ahead of hackers, MITRE Engenuity has released a new browser-based tool designed to predict cyberattack sequences.

The Technique Inference Engine (TIE) lets cybersecurity pros input tactics or techniques from the MITRE ATT&CK knowledge base they’ve detected in their environment. Using a machine learning (ML) model, TIE then infers the following steps that attackers would most likely take.

“TIE will help analysts quickly understand what is likely to have happened next, based on a broad corpus of threat intelligence,” reads a MITRE Engenuity blog about the new tool.

(Source: MITRE Engenuity, September 2024)

With the TIE results in hand, cybersecurity teams can, among other things, do the following:

• Prioritize techniques to look for while triaging an event.
• Improve post-mortem incident analysis by highlighting potential gaps.
• Help create adversary emulation plans.

“We’re delighted to provide the community with a tool that gives defenders a way to identify what you don’t detect,” the blog reads

MITRE Engenuity built TIE in collaboration with experts from nine other organizations, including Tenable Research.

“Tenable Research is proud to be a key contributor to the new MITRE Engenuity Technique Inference Engine (TIE) – a powerful resource for security teams. TIE leverages machine learning to predict adversarial behaviors based on real-world cyber threat intelligence, helping you stay one step ahead of attackers,” reads a Tenable LinkedIn post.

To get more details, check out:

• The blog “Know your Adversary’s next move with TIE”
• The Technique Inference Engine’s web interface 
• The TIE project’s home page
• The TIE’s GitHub page

3 - CISA: Fed agencies must adopt a common security posture

Is your company considering implementing a consistent and uniform set of foundational cybersecurity practices for all teams and departments throughout the organization? If so, you might want to check out how the U.S. government plans to do just that across 100-plus federal agencies.

CISA will be in charge of the project, which it detailed in the document “Federal Civilian Executive Branch (FCEB) Operational Cybersecurity Alignment (FOCAL) Plan,” announced this week.

The goal: To standardize the cybersecurity operations of civilian agencies in the executive branch, known by the acronym FCEB, to ensure they can all properly manage cyber risk in today’s complex and fast-evolving threat landscape.

 

Currently, these agencies architect their IT and cybersecurity operations independently, and consequently their ability to manage cyber risk varies. “There is no cohesive or consistent baseline security posture across all FCEB agencies” and as a result “the FCEB remains vulnerable,” CISA says in the FOCAL plan’s document.

“Collective operational defense is required to adequately reduce risk posed to more than 100 FCEB agencies and to address dynamic cyber threats to government services and data,” the plan’s document reads.

The FOCAL plan focuses on five core areas:

• Asset management
• Vulnerability management
• Defensible architecture
• Cyber supply-chain risk management
• Incident detection and response

“The FOCAL Plan was developed for FCEB agencies, but public and private sector organizations should find it useful as a roadmap to establish their own plan to bolster coordination of their enterprise security capabilities,” reads a CISA statement.

To get more details, check out:

• The plan’s announcement “CISA Releases Plan to Align Operational Cybersecurity Priorities for Federal Agencies”
• The FOCAL plan’s description

4 - FBI takes down China-controlled IoT botnet used to steal information

A botnet of 260,000-plus IoT devices used to conduct information-stealing attacks on behalf of China’s government against targets in the U.S. and abroad has been dismantled.

Working with international partners, the FBI led the operation against the botnet, which was active since 2021 and was controlled by Beijing-based IT contractor Integrity Technology Group, also known as Flax Typhoon.

Hackers working for Flax Typhoon created the botnet by breaching 260,000-plus consumer IoT devices in the U.S. and in other countries. By using these legitimate devices, the hackers made their attacks look like normal internet traffic. 

Flax Typhoon developed an application that allowed the hackers to control the botnet’s compromised devices, while another tool offered them a menu of malicious commands.

The infected devices, which included small office / home office (SOHO) routers, IP cameras, digital video recorders and network-attached storage devices, got disconnected from the botnet as part of the FBI’s operation. The devices’ legitimate operations weren’t disrupted.

These are some FBI recommendations for preventing the hijacking of IoT devices for botnets, and for protecting networks from active botnets:

• Disable unused services and ports, such as remote management options and file sharing services.
• Segment networks and use the least-privilege principle to limit the risk from compromised IoT devices.
• Keep software and firmware patched and updated.
• Replace default passwords with strong passwords.
• Periodically reboot IoT devices, which terminates running processes and may remove some malware types.
• Replace end-of-life equipment with products that vendors are actively supporting.

To get more details, check out:

• The Department of Justice’s announcement “Court-Authorized Operation Disrupts Worldwide Botnet Used by People’s Republic of China State-Sponsored Hackers”
• The court warrant
• The FBI’s cybersecurity advisory “People’s Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations”

For more information about IoT and OT security, check out these Tenable resources:

• “How To Secure All of Your Assets - IT, OT and IoT - With an Exposure Management Platform” (blog)
• “Discover, Measure, and Minimize the Risk Posed by Your Interconnected IT/OT/IoT Environments” (on-demand webinar)
• “Unlock Advanced IoT Visibility in your OT Environment Security” (on-demand webinar)
• “How to Tackle OT Challenges: Asset Inventory and Vulnerability Assessment” (blog)
• “Securing IT/OT Convergence for Industry 4.0 Success” (on-demand webinar)

5 - CISA issues plea to end XSS vulnerabilities

Although cross-site scripting (XSS) vulnerabilities are easily preventable, software makers continue introducing them into their products, a situation that needs to stop.

So said CISA and the FBI in the fact sheet “Secure by Design Alert: Eliminating Cross-Site Scripting Vulnerabilities.”

When software makers neglect to properly “validate, sanitize or escape inputs,” XSS vulnerabilities can crop up, allowing attackers to inject malicious scripts into web apps, according to the fact sheet.

“CISA and FBI urge CEOs and other business leaders at technology manufacturers to direct their technical leaders/teams to review past instances of these defects and create a strategic plan to prevent them in the future,” the fact sheet reads.

 

 

Recommendations for software makers to prevent XSS vulnerabilities include:

• Validate the structure and meaning of inputs
• Carry out code reviews
• Use output-encoding functions in modern web frameworks
• Conduct adversarial testing to assess the quality and security of code

For more information about XSS bugs:

• “What Is Cross-Site Scripting (XSS)?” (TechTarget)
• “Cross Site Scripting (XSS)” (OWASP)
• “Understanding the Threat of XSS” (IEEE Computer Society)
• “How to prevent XSS” (PortSwigger)
• “Cross Site Scripting Prevention Cheat Sheet” (OWASP)

6 - CIS publishes new, updated Benchmarks for Microsoft, Google and Apache products

Microsoft’s Windows Server OS. Google’s ChromeOS. Apache’s Cassandra database.

Those products are among the CIS Benchmarks that were either updated or newly released in August by the Center for Internet Security.

Specifically, these secure-configuration recommendations were updated in June:

• CIS Apache Cassandra 3.11 Benchmark v1.2.0
• CIS Apache Cassandra 4.0 Benchmark v1.1.0
• CIS Microsoft Windows Server 2016 STIG Benchmark v3.0.0

 

In addition, CIS released brand new Benchmarks for Apache’s Cassandra 4.1 and Tomcat 10.1; FreeBSD 14 Benchmark v1.0.0; Google’s ChromeOS; and Ubuntu Linux 24.04 LTS.

Organizations can use the CIS Benchmarks’ secure-configuration guidelines to harden products against attacks. Currently, there are more than 100 Benchmarks for 25-plus vendor product families in categories including: 

• cloud platforms
• databases
• desktop and server software
• mobile devices
• operating systems

To get more details, read the CIS blog “CIS Benchmarks September 2024 Update.” 

For more information about the CIS Benchmarks list, check out its home page, as well as:

• “Getting to Know the CIS Benchmarks” (CIS)
• “Security Via Consensus: Developing the CIS Benchmarks” (Dark Reading)
• “How to Unlock the Security Benefits of the CIS Benchmarks” (Tenable)
• “CIS Benchmarks Communities: Where configurations meet consensus” (Help Net Security)
• “CIS Benchmarks: DevOps Guide to Hardening the Cloud” (DevOps)

Law enforcement authorities have announced the takedown of an international criminal network that leveraged a phishing platform to unlock stolen or lost mobile phones. The phishing-as-a-service (PhaaS) platform, called iServer, is estimated to have claimed more than 483,000 victims globally, led by Chile (77,000), Colombia (70,000), Ecuador (42,000), Peru (41,500), Spain (30,000), and Argentina

Интернет-провайдеры подали жалобу на дискриминацию при замедлении YouTube.

Исследователи раскрыли новый метод проникновения, нацеленный на разработчиков.

检测业务是否受到此漏洞影响，请联系长亭应急服务团队！

检测业务是否受到此漏洞影响，请联系长亭应急服务团队！

德国联邦信息安全局(Federal Office for Information Security)表示，十分之一受 CrowdStrike 事件影响的组织正在抛弃旧的安全解决方案，其中 4% 已经放弃，另外 6% 即将放弃。联邦信息安全局没有澄清它所指的旧安全方案是否就是 CrowdStrike 公司的 Falcon 产品。这一结果来自对 311 家受影响德国机构的调查。23% 的被调查组织表示他们首先是从社交媒体而不是 CrowdStrike 公司了解此事的，48% 的组织被迫短时间停止运营，它们的平均下线时间是 10 小时。除了影响业务连续性外，40% 的组织表示它们与客户的关系受到了此事件的损害。66% 被调查组织表示已改进或将改进应急方案。

The Cybersecurity and Infrastructure Security Agency (CISA) has issued six advisories concerning vulnerabilities: These advisories highlight critical industrial control system vulnerabilities. Rockwell Automation’s RSLogix 5 and RSLogix 500 software Rockwell Automation’s RSLogix 5 and RSLogix 500 software are vulnerable due to insufficient verification of data authenticity, identified as CVE-2024-7847. This vulnerability has a CVSS v4 […]

The post CISA Releases Six Advisories for Industrial Control Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.