Cyber Policy in the News
From Cloudwards: Data Privacy Statistics, Facts & Trends of 2023
Whether you’re concerned about a company’s recent privacy policy change, a data breach handing your personal information over to criminals, government requests for data or the lack of data privacy laws, the first step for data protection is learning about some key data privacy statistics.
By Robin Barber (Editor)
Data Privacy Statistics, Facts & Trends of 2023: Your Data Is the New Oil
News Insights: White House Releases New National Cyber Policy
Today, the White House released a new national cyber policy
News Insights:
“This strategy continues a trend of a more activist federal government pushing cybersecurity forward. Within the last 12 months or so, you can see increased announcements and initiatives from CISA, as an example, that foreshadowed something broader. The pillars build on existing ideas and cyber principles – defend critical infrastructure, support the nation’s collective defense, and embrace secure by design. That last item has been discussed in solution development forums for years, but hasn’t become a norm for producers.
The real test will come in the pronouncements that follow. A strategy by itself won’t compel companies to change how they invest. This strategy is a shot across the bow that signals tougher standards are coming. How those manifest themselves will be fascinating to watch. Will the administration try to enact laws with associated fines? Will they pressure industry groups to do self-improvement? Can they become a catalyst for real change and help get cybersecurity past the tipping point where best practices are the only accepted practices? Hopefully, one way or another, they can spur real change and make all of our lives safer.”
Craig Burland, CISO, Inversion6
“The report emphasizes modernizing federal security, a crucial part of this must be accelerating the government’s ability to onboard modern and next generation security technologies. Government agencies must be able to efficiently test technologies in dynamic environments that mirror, in both scale and complexity, the environment they will be expected to defend. They also would benefit from moving validated security solutions to the front of the line and accelerating mandatory audit timelines. In the end, when the federal government gains access to advanced security solutions more quickly, they can force attackers to rapidly adapt to try and keep pace.
Technology will also be critical for improving the ‘speed and scale’ of threat intelligence sharing that the report calls for. Threat intelligence is vital but it is vast and only growing – organizations need technology which cuts through the intelligence and identifies how a particular vulnerability impacts their unique environment and they need that information fast. Distilling that information and translating it into a strategy based on bespoke organizational risk is a job for technology – we can’t put the onus on humans anymore, and they need to be freed up for strategy and remediation.
It is positive to see the new strategy emphasizes the importance of mandating ‘security by design’ as well as the focus on robust technologies and the creation of a better cyber workforce.
As we look towards a future where a hybrid human-AI approach to cyber is absolutely necessary, the pursuit to meet a stronger, more robust, and better enabled cyber workforce must be executed with innovative and accessible programs that are both growing and investing in the next generation of security practitioners and augmenting them to get further faster and increase workload efficiency and accelerate response times.”
By Marcus Fowler, CEO Darktrace Federal
“Would you consent to undergoing a surgical procedure performed by a newly graduated individual who possesses exceptional proficiency in performing surgeries on cats? Furthermore, why would you entrust the same individual with the task of developing software for your pacemaker? While the answer to the former question will be negative, as a society, we permit the latter to occur. The IT industry has demonstrated remarkable adeptness in evading warranties on their products and offering them for sale ‘as is.’ This apparent lack of accountability is unprecedented in other industries, such as healthcare and construction.”
Szilveszter Szebeni – CISO at Tresorit
“If we’ve learned nothing else, it’s that the stick of penalties has failed, and now the Federal government is going to offer carrots, something I’ve long believed will be more effective. The National Cybersecurity Strategy’s biggest impact – if it can achieve its stated goals – will be to shift corporate mindsets in the US from “security means penalties” to “security means attaining rewards.” Looking beyond critical infrastructure, the Strategy notes that regulators are encouraged to incentives cybersecurity through rate-making processes, tax structures, or other mechanisms. We need to reward robust while penalizing inferior security. If the Strategy can effectively shift this mentality, then businesses can view cybersecurity as a tangible revenue-enabler listed on their balance sheets rather than merely an amorphous cost savings.”
Karen Walsh – Cyber Security Compliance Expert and CEO at Allegro Solutions
From Avanan: Business Email Compromise Scam Leads to Credential Harvesting Evernote Page
Business Email Compromise attacks are one of the fastest-growing and most difficult-to-stop attacks in the cybersecurity space. There are a number of variants, but in general, these attacks spoof someone in your organization, often an executive, and don’t use any malware or malicious links. (BEC attacks can also involve malware or malicious links, but the toughest ones to stop are primarily text-based.)
Read full article: https://www.avanan.com/blog/business-email-compromise-scam-leads-to-credential-harvesting-evernote-page
From Avanan – PhishPal: How PayPal Became a Hackers’ Haven
In July of last year, we wrote about a new campaign where hackers are sending phishing emails and malicious invoices directly from PayPal.
This is different from the plenty of attacks we’ve seen that spoof PayPal. This is a malicious invoice that comes directly from PayPal.
And since it comes directly from PayPal, it becomes incredibly difficult not only for email security services to stop but also for end-users to respond to it accordingly.
Read full article:
Cyber-physical Systems Vulnerability Disclosures Reach Peak, While Disclosures by Internal Teams Increase 80% Over 18 Months
State of XIoT Security Report: 2H 2022 from Claroty’s Team82 reveals positive impact by researchers on strengthening XIoT security and increased investment among XIoT vendors in securing their products
NEW YORK, NY – February 14, 2023 – Cyber-physical system vulnerabilities disclosed in the second half (2H) of 2022 have declined by 14% since hitting a peak during 2H 2021, while vulnerabilities found by internal research and product security teams have increased by 80% over the same time period, according to the State of XIoT Security Report: 2H 2022 released today by Claroty, the cyber-physical systems protection company. These findings indicate that security researchers are having a positive impact on strengthening the security of the Extended Internet of Things (XIoT), a vast network of cyber-physical systems across industrial, healthcare, and commercial environments, and that XIoT vendors are dedicating more resources to examining the security and safety of their products than ever before.
Compiled by Team82, Claroty’s award-winning research team, the sixth biannual State of XIoT Security Report is a deep examination and analysis of vulnerabilities impacting the XIoT, including operational technology and industrial control systems (OT/ICS), Internet of Medical Things (IoMT), building management systems, and enterprise IoT. The data set comprises vulnerabilities publicly disclosed in 2H 2022 by Team82 and from trusted open sources including the National Vulnerability Database (NVD), the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), CERT@VDE, MITRE, and industrial automation vendors Schneider Electric and Siemens.
“Cyber-physical systems power our way of life. The water we drink, the energy that heats our homes, the medical care we receive – all of these rely on computer code and have a direct link to real-world outcomes,” said Amir Preminger, VP research at Claroty. “The purpose of Team82’s research and compiling this report is to give decision makers in these critical sectors the information they need to properly assess, prioritize, and address risks to their connected environments, so it is very heartening that we are beginning to see the fruits of vendors’ and researchers’ labor in the steadily growing number of disclosures sourced by internal teams. This shows that vendors are embracing the need to secure cyber-physical systems by dedicating time, people, and money to not only patching software and firmware vulnerabilities, but also to product security teams overall.”
Key Findings
- Affected Devices: 62% of published OT vulnerabilities affect devices at Level 3 of the Purdue Model for ICS. These devices manage production workflows and can be key crossover points between IT and OT networks, thus very attractive to threat actors aiming to disrupt industrial operations.
- Severity: 71% of vulnerabilities were assessed a CVSS v3 score of “critical” (9.0-10) or “high” (7.0-8.9), reflecting security researchers’ tendency to focus on identifying vulnerabilities with the greatest potential impact in order to maximize harm reduction. Additionally, four of the top five Common Weakness Enumerations (CWEs) in the dataset are also in the top five of MITRE’s 2022 CWE Top 25 Most Dangerous Software Weaknesses, which can be relatively simple to exploit and enable adversaries to disrupt system availability and service delivery.
- Attack Vector: 63% of vulnerabilities are remotely exploitable over the network, meaning a threat actor does not require local, adjacent, or physical access to the affected device in order to exploit the vulnerability.
- Impacts: The leading potential impact is unauthorized remote code or command execution (prevalent in 54% of vulnerabilities), followed by denial-of-service conditions (crash, exit, or restart) at 43%.
- Mitigations: The top mitigation step is network segmentation (recommended in 29% of vulnerability disclosures), followed by secure remote access (26%) and ransomware, phishing, and spam protection (22%).
- Team82 Contributions: Team82 has maintained a prolific, years-long leadership position in OT vulnerability research with 65 vulnerability disclosures in 2H 2022, 30 of which were assessed a CVSS v3 score of 9.5 or higher, and over 400 vulnerabilities to date.
To access Team82’s complete set of findings, in-depth analysis, and recommended security measures in response to vulnerability trends, download the full State of XIoT Security Report: 2H 2022 report.
Join Team82 Slack channel for additional discussion and insight into the report.
Acknowledgements
The primary author of this report is Bar Ofner, security researcher at Claroty. Contributors include: Rotem Mesika, threat and risk group lead, Nadav Erez, vice president of data, Sharon Brizinov, director of research, Amir Preminger, vice president of research, Chen Fradkin, data scientist, and Moran Zaks and Yuval Halaban, security researchers. Special thanks to the entirety of Team82 for providing exceptional support to various aspects of this report and research efforts that fueled it.
About Claroty
Claroty empowers organizations to secure their Extended Internet of Things (XIoT), a vast network of cyber-physical systems across industrial, healthcare, and commercial environments. The company’s cyber-physical systems protection platform integrates with customers’ existing infrastructure to provide a full range of controls for visibility, risk and vulnerability management, network segmentation, threat detection, and secure remote access. Backed by the world’s largest investment firms and industrial automation vendors, Claroty is deployed by hundreds of organizations at thousands of sites globally. The company is headquartered in New York City and has a presence in Europe, Asia-Pacific, and Latin America.
To find out more about Claroty, visit claroty.com.
Louisiana Hospitals Hit with Class-Action Lawsuits over Sharing Patients’ Data
Herman Herman & Katz lawyers: Controversial Meta Pixel computer code was used by LCMC Health and Willis-Knighton Health websites
NEW ORLEANS – Two of the largest hospital networks in Louisiana have been using a tracking code embedded deep in their websites that shares sensitive patient data without the patients’ knowledge or consent, according to class-action lawsuits filed by Herman Herman & Katz trial lawyers.
Known as Meta Pixel, the computer code created by the company that owns Facebook and Instagram potentially analyzed, gathered and shared the sensitive medical data of hundreds of thousands of patients, the lawsuits allege. These victims were patients within the LCMC Health Systems network of hospitals in the New Orleans area and Willis-Knighton Health System facilities in northwest Louisiana, according to the lawsuits.
“We are learning more and more about this shocking breach of trust as our investigation continues,” said Herman Herman & Katz partner Stephen Herman. “This was a gross invasion of privacy that went on for years.”
Click here for video of Mr. Herman discussing the case.
The Meta Pixel code was created by Meta (NASDAQ: META) to narrowly target users with digital advertisements. When website visitors clicked the “schedule an appointment” button, the code captured sensitive health information like medical conditions, prescriptions, doctors’ names, and previous appointments and sent it to Facebook. In one case, for example, a woman received targeted ads about heart disease and joint pain shortly after entering her information into one of the hospital websites.
According to the lawsuits, use of the Meta Pixel in healthcare settings violates the Health Insurance Portability and Accountability Act (HIPAA), which prohibits the sharing of personal health information with a third party without explicit patient consent.
LCMC Health Systems is a network of New Orleans-area hospitals and medical facilities, including Children’s Hospital, East Jefferson General Hospital, New Orleans East Hospital, Touro, University Medical Center New Orleans, and West Jefferson Medical Center.
Willis-Knighton Health System is the largest healthcare provider in northwest Louisiana and includes Willis-Knighton Medical Center, Willis-Knighton South & the Center for Women’s Health, WK Bossier Health Center, WK Pierremont Health Center, and WK Rehabilitation Institute.
HHK is working with AZA Law in Houston and Kelly & Townsend LLC in Natchitoches, La., on the litigation.
Herman Herman & Katz is dedicated to achieving justice for our clients. We excel in a wide range of practice areas throughout Louisiana, and our personal attention, experience and commitment achieve the results our clients deserve. Our Louisiana personal injury lawyers are here to aggressively pursue justice on your behalf and help you get back on your feet. To learn more, visit: https://hhklawfirm.com/.
Media Contact:
Robert Tharp
214-420-6011
KuppingerCole Analysts predicts Container Security Market to grow to 2.63 bn USD by 2025
In light of the growing demand for securing digital services, the Container Security Market is steadily growing and is expected to reach 2.63 billion USD by 2025. Its Compound Annual Growth Range (CAGR) of 25.7% is a key indicator of that growth. The largest market share is in North America, contributing 68.1% of the global revenue, followed by EMEA with a 25.4% share. APAC and LATAM show lower adoption, but see significant growth can be expected in those markets as well.
Read the full article here.
In the last few years, security faced a massive change in infrastructure and a major increase in overall complexity, introducing numerous new risks and security challenges. Similarly, companies must gain skills to efficiently mitigate those risks. Containers and Kubernetes have quickly become synonymous with modern DevOps methodologies, continuous delivery, and deployment automation and are generally praised as a breakthrough in developing and managing cloud-native applications and services.
However, the need to secure containerized applications at every layer of the underlying infrastructure (from bare-metal hardware to the network to the control plane of the orchestration platform itself) and at every stage of the development lifecycle (from coding and testing to deployment and operations) means that container security must cover the whole spectrum of cybersecurity and then some.
KuppingerCole Analysts is an international and independent IT-analyst organization headquartered in Europe with presence worldwide. The company provides market sizing information and reports for IAM, Cybersecurity and Digital Identity Market, assuring a neutral position with extensive expertise and practical relevance.
WaPo: U.S. national cyber strategy to stress Biden push on regulation
The White House wants expanded requirements for private companies that operate in critical infrastructure sectors
https://www.washingtonpost.com/national-security/2023/01/05/biden-cyber-strategy-hacking/
Proofpoint publishes report on TA453
Key Takeaways
- From at least late 2020 and through 2022, TA453 has engaged in campaigns that deviate from the group’s expected phishing techniques and target victimology.
- In these campaigns, TA453 has employed the use of compromised accounts, malware, and confrontational lures to go after targets with a range of backgrounds from medical researchers to realtors to travel agencies.
- Proofpoint researchers assess with moderate confidence that this activity reflects a flexible mandate to the Islamic Revolutionary Guard Corps’ (IRGC) intelligence requirements.
- Further, a sub-cluster of TA453 activity demonstrates a possible directive to support covert, and even kinetic, operations of the IRGC.
Overview
Since at least late 2020, Proofpoint researchers have observed aberrations in TA453 (which overlaps with groups publicly known as Charming Kitten, PHOSPHORUS, and APT42) phishing activity in which the threat actor has stepped away from its typical phishing techniques and target victimology. A hallmark of TA453’s email campaigns is that they almost always target academics, researchers, diplomats, dissidents, journalists, human rights workers, and use web beacons in the message bodies before eventually attempting to harvest a target’s credentials. Such campaigns may kick off with weeks of benign conversations from actor-created accounts before attempted exploitation.
By comparison, TA453’s outlier campaigns have targeted medical researchers, an aerospace engineer, a realtor, and travel agencies, among others. They have leveraged new-to-TA453 phishing techniques including compromised accounts, malware, and confrontational lures. Proofpoint judges with moderate confidence that this atypical activity reflects TA453’s dynamic support to ad hoc Islamic Revolutionary Guard Corps’ (IRGC) intelligence requirements. This activity also provides researchers with a better understanding of the IRGC’s mandate and insight into TA453’s potential support of IRGC surveillance and attempted kinetic operations.
Read full report: https://www.proofpoint.com/us/blog/threat-insight/ta453-refuses-be-bound-expectations
From Inky.com: Fresh Phish: The Case of the Crafty Cryptocurrency Con
From Inky.com: Fresh Phish: The Case of the Crafty Cryptocurrency Con
Read article:
https://www.inky.com/en/blog/fresh-phish-the-case-of-the-crafty-cryptocurrency-con