Login
We recently had the chance to discuss the top trend predictions for 2023, issued by Gartner®, and what these may mean for CISOs. The trends are below:
These showed several themes: internal pressures, external changes and solution adoption.
CISOs need to be aware of the pressures that may come from inside the business. C Level executives having risk related elements in their employment contracts (8) may result in a higher focus on Risk management. This may benefit CISOs to position cyber security as part of the Risk calculation and perhaps unlock more support for risk reduction initiatives.
Aligned is the concept of a culture of organisational resilience being mandated by CEOs (7). CISOs now talk about culture change in cyber security, making business colleagues identify as part of the overall security of the organisation. This may now include resilience. Again, this may provide a vehicle for change for CISOs.
Risk as a factor when assessing whether to do business with third parties (4) will highlight the third-party dependency issues that now concern CISOs. The perimeter is now long gone; security extends beyond the organisational remit of the CISO. The ability to understand and collaborate with third party security will become n increasing requirement. There is a downside for CISOs. Many are already burdened with the need to report on compliance and audits. This may increase as requests come in from business partners, current and potential, on the organisation’s cyber security posture.
Related to compliance and reporting is the issue of Privacy. It is predicted the consumer privacy will increase to cover most countries (1). This may require additional focus on the extent and scope to which Privacy is reported. Many CISOs address this already due to requirements such as GDPR. This may provide a strong basis to move forward. CISOs have seen Privacy as a positive. “Do you really need that data?” is a question often asked. Organisations can reduce the amount of unwanted data stored and needing security.
Responding to attacks and the relentless change in tactics is an additional trend. Payments for ransomware is contentious. From the morale, legal and practical aspects of making payments. If this becomes regulated (5) it may provide a clearer basis for decision making. Perhaps it may provide a for of deterrent for attacks. If the victim cannot pay why attack them? Perhaps this is just wishful thinking. On the negative side attackers may increase the capability of their tools in the operational technology environment with extreme impact (6). A current area of concern for CISOs that may increase in focus.
On a positive side a majority of organisation will adopt zero trust as a starting point for their security (3). However, many will not gain the benefits. CISOs are now increasing addressing the organisational and cultural change required to make Zero Trust succeed and realising it is not just about the technology. There are clear benefits that have been identified in Cisco research papers1. CISOs are looking to introduce new consolidated technologies in web, cloud services and private application access (3). This may reduce tech debt, enable smoother operational management, centralised policy control and better reporting.
https://www.cisco.com/c/dam/en/us/products/collateral/security/zero-trust-field-guide.pdf
Source: https://www.gartner.com/en/articles/the-top-8-cybersecurity-predictions-for-2021-2022
We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!
Cisco Secure Social Channels
Give the gift of security resilience and receive instant savings from a secure choice enterprise agreement.
When it comes to the holidays, most thoughts turn towards shopping and spending time with friends and loved ones. In the business world, the holiday season often lands at the end of the quarter / fiscal year, and businesses start to make lists of things that need to be purchased in the coming years, and sometimes they find themselves wanting to purchase a gift – so to speak – for themselves.
The problem that many organizations face is that when it comes to purchasing products and services, balancing today’s needs and budget isn’t as easy as it sounds. Add to this the concern of unclear future security needs which can be stressful. But what if you could get exactly what you need, protect the budget and future-proof your investment at the same time?
We want to give a gift to you. That is right, you read that correctly. We want to make your holidays a little bit more special with the gift of security resilience. And we can offer that to you with instant savings.
Here are a few examples of how you can build the gift of security resilience that best fits your organization’s security needs today and is ready to grow with your tomorrow.
Provide edge to edge protection. Hold the first line of defense against cyberthreats for branch offices and remote users. Maintain the last line of defense, by protecting your endpoint devices with rapid incident detection, response, and remediation of advanced threats.
Provide protection for your users and devices with these essential Cisco Secure products.
Protect what matters, get cloud and application protection that secures internet access, safeguards cloud app usage, and identifies public cloud threats. Build out your cloud and application security with these essential Cisco Secure products.
Cisco Secure Zero Trust helps you transform your business with continuous verification of users and devices for secure access. These Cisco Secure products are part of the essential architecture towards building zero trust secure access.
Choose any of the two Cisco Secure products that you want to buy towards building out user and device security, cloud and application security, zero trust secure access, or any of our security solutions. You do not have to stop with two, you have the freedom to grow; add more, save more.
Cisco Secure products you can choose from:
Give the Gift of Security with a Cisco Secure Choice Enterprise Agreement
Choose, buy, and deploy Cisco Secure products through one easy-to-manage Cisco Secure Choice Enterprise Agreement; save more as you buy more for all of those on your holiday list. Protect your end users working remotely, in office only, or in a hybrid environment as with more devices on and off the network, cybersecurity risks are not slowing down anytime soon. Build the solution that best fits your organization through a single, flexible agreement that lets you pay annually, as you go, over 3 or 5 years, with 0% financing.
With Cisco’s Secure Choice Enterprise Agreements, you can add security resilience in 2023 and beyond, with exactly the security products and services you need, right when you need them the most.
We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!
Cisco Secure Social Channels
The smarts behind a smart home come from you. At least when it comes to keeping it more private and secure.
Without question, smart home devices have truly stormed the marketplace. We’ve gone from a handful of relatively straightforward things like connected lights, outlets, and cameras to a wide range of fully connected household appliances like refrigerators, stoves, and laundry machines. You can even water your garden with smart devices, which check for soil moisture, weather reports, and for what you’re watering.
Further new technologies like the Matter protocol aim to make them all work more reliably and easily—with a new networking standard that allows different devices from different platforms to work together. Something they couldn’t do before and something that likely kept people from adding to their connected home because of compatibility issues. No more.
It’s exciting, as it should be. Yet the security and privacy measures for these devices hasn’t quite kept up with all this rapid development and expansion. Not across the board, anyway. Security isn’t always built into these devices. In some cases, it’s so poorly handled that it makes some devices prone to attack.
However, you can absolutely enjoy a smart home and all the comforts and conveniences that come along with it. Safely. Just a little extra effort from you makes it possible. And you don’t need to be any kind of whiz to pull it off.
For starters, the old security adage holds true for smart homes and devices: “If it’s connected, it must be protected.” Any connected device can provide a hacker with an inroad to your home network and the data and devices on it. So even that seemingly innocent smart wall outlet that you use to run your living room lamps could be a target.
In fact, we’ve seen instances where a little outlet created a big security issue, such as one report where an unsecure plug used poor factory passwords and didn’t use secure encryption to communicate with the household router. The result—hackers could obtain login credentials to a victim’s entire home network.
Another old security adage is that your home network is only as secure as your weakest device. In the above case, that was a poorly designed smart outlet—at least from a security standpoint.
Now consider a highly connected smart home with a dozen or so smart devices. Maybe some of those have great security built in and are backed by manufacturers that update them regularly for ongoing security. And maybe some of those other devices, not so much. Again, just one poorly secured device in that mix could jeopardize your connected things, along with the data you keep on them.
On the topic of data, we often talk about privacy policies and how they’re not all created equal. Depending on the app, device, and operating system—along with any settings you have control over too—may determine what information a company collects, keeps, and shares about you and your usage. Moreover, it may determine what they or other third parties might do with that data as well.
Put simply, not every company treats your personal data the same way. Some may sell it to data brokers for profit or share it with third parties like insurance companies, government agencies, law enforcement, and others according to findings published by some industry groups.
Still others may not sell that data, yet they will share it with third parties for analysis or use it to fuel their own advertising campaigns or advertising platforms they own. And of course, there are others who collect and analyze the bare minimum and keep that data to themselves.
Consider once more that smart home filled with a dozen or so smart devices. That likely means several different data privacy policies are in play as well, each handing the data created by that home in different ways. And in ways that you may or may not be fully aware of, given that privacy policies are often notoriously long reads, sometimes filled with legalese.
Without question, privacy is another consideration for your smart home.
You can do plenty of things that can make your smart devices more private and more secure than they were when they came out of the box. And as mentioned above, the steps are all rather straightforward. Our Smart Home Security Guide lays it out for you.
It’s part of the McAfee Security Guide Series, and in it you’ll get a closer look at how you can protect a smart wall outlet, along with that smart coffeemaker, door lock, refrigerator and more. It covers the basics of protection, how to shop for more private and secure smart devices, plus a section that talks specifically about smart speakers and protecting your privacy while using them.
In all, our Smart Home Security Guide is here to help. The truth is that security isn’t always included with smart home devices. Not right out of the box anyway. Just like with your computers, smartphones, and other devices, the best security relies on you. With a handful of steps, you can enjoy your smart home with confidence.
The post The Smart Home Security Guide appeared first on McAfee Blog.
Attackers specifically craft business email compromise (BEC) and phishing emails using a combination of malicious techniques, expertly selected from an ever-evolving bag of tricks. They’ll use these techniques to impersonate a person or business that’s well-known to the targeted recipient and hide their true intentions, while attempting to avoid detection by security controls.
As a result of the requisite expertise needed to combat these complex attacks, email security has traditionally been siloed away in disparate teams and security controls. Practitioners are buried under an ever-growing pile of RFCs, requiring extensive domain-specific knowledge, unending vigilance, and meticulous manual interventions, such as tweaking trust levels and cultivating allow/block lists with IPs, domains, senders, and vendors.
Cisco Secure Email Threat Defense is leading the industry forward with a major shift, elevating email security into a new era; where administration will consist of merely associating specific business risks with the appropriate due diligence response required to remediate against them.
Email Threat Defense has introduced a new Threat Profile that provides the customer with deep insights into the specific business risks of individual email threats and the confidence to act quickly. This new visualization is powered by a new patent-pending threat detection engine. This engine leverages intelligence distilled from Talos global-scale threat research across a massive volume of email traffic into machine learning, behavioral modeling, and natural language understanding.
The detection engine granularly identifies specific underlying threat techniques utilized in the message by the attacker. The identified techniques provide the full context of the threat message as the supporting foundation for the engine to determine threat categorization and the specific risk to the business. These malicious Techniques, together with the threat category and specific business risk, are used to populate the Threat Profile.
Each message’s Threat Profile is identified in real-time, automatically remediated per policy, and surfaced directly to the operator in the message detail views, providing deep contextual insights into the attacker’s intent and the associated risks to the business. As part of a larger Extended Detection and Response (XDR) strategy, the actionable intelligence in Email Threat Defense is integrated with the wider enterprise orchestration of security controls via SecureX, easing the operational burden by decreasing your mean time to remediation (MTTR).
Email Threat Defense delivers a distinct understanding of malicious messages, the most vulnerable targets within the organization, and the most effective means of protecting them from phishing, scams, and BEC attacks. With a clean design and core focus on simplifying administration, Email Threat Defense deploys in minutes to strengthen protection of your existing Microsoft 365 Exchange Online platform against the most advanced email threats.
For more information, visit the Cisco Secure Email product pages, read the Email Threat Defense data sheet, and view the demo video below.
We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!
Cisco Secure Social Channels
Oh, the scammers online are frightful, and the deals they offer seem delightful. No matter what you think you know, let it go, let it go, let it go (to the tune of 1945’s Let it Snow by Vaughn Monroe with the Norton Sisters).
‘Tis the season to find ourselves awash in good tidings and, well, consumerism. While it’s only partly tongue in cheek, we must be honest with ourselves. We spend a lot of money online. Often, we find ourselves leaving things to the last minute and hope that the delivery folks can make the magic happen and send us all the widgets and grapple grommets while we surf the Internet from the safety of our sofas with coffee in hand.
But, not every deal is what it appears to be. Scammers are always lurking in the void of the Internet waiting for a chance to fleece the unexpecting from their hard-earned money. This can manifest itself to the unsuspecting in many ways. There are shipping frauds, gift card giveaways and vishing (phone-based scams).
Scams tend to rely on generating a false sense of urgency. The shipping scam emails often show up in our inboxes as a warning about a missed or delayed package that will be sent back to the point of origin if we don’t answer quickly. Of course, this requires a payment to receive the fictitious package.
These types of shipping scam emails are quite effective this time of year when more often than naught many people have enough orders coming to their house to make a fort with the empty boxes.
The other kinds of attacks are the gift card scams and vishing. The first of which taps into the sense of excitement that a person might receive something for free. “Fill out this form with your credit card information for a chance to win a $200 gift card.” Sadly, this attack works well for older generations for which giveaways were more common and they aren’t as accustomed to spotting digital swindlers.
The last scam that we will tackle here is often labeled as vishing or voice phishing. This is a method whereby the attackers call a victim and attempt to convince their target that they need to do something which will lead to the exposure of financial information while pressuring the victim to think if they don’t act quickly that they will miss an opportunity for personal gain.
Unfortunately, the aforementioned scams really bring in a lot of return for the criminal element. In 2021, over 92,000 victims over the age of 60 reported losses of $1.7 billion. This represents a 74 percent increase in losses over losses reported in 2020.
One additional scam that plays on the heart strings is the romance scams. A lot of single people find themselves lonely during the holidays and can be manipulated into thinking that they’ve found a romantic match. But this can drain the bank accounts as well.
In 2021, the IC3 received reports from 7,658 victims who experienced over $432 million in losses to Confidence Fraud/Romance scams. This type of fraud accounts for the highest losses reported by victims over the age of 60.
All these attacks prey on people’s emotional responses. So, how do we prepare ourselves? We need to make knowledge a capability and arm ourselves with information that will help us avoid being taken advantage of by criminals.
Passwords are a significant exposure. They are the digital equivalent of a house key. A password will work for anyone that has access to it. We need to utilize technologies such as multi-factor authentication (MFA) on websites where it is possible to do so. So even if bad actors have our password, the victim still needs to approve the login.
If we don’t have the option to use MFA it would be an excellent idea to make use of a password manager. This is a way to safely store passwords and not fall into the trap of reusing passwords on multiple sites. Attackers bank on human nature and if we use the same credentials on multiple sites there is a high possibility that the criminals could gain access to other sites if they compromise just one.
I’m usually one to eschew the practice of New Year’s resolutions but I’ll make an exception. Keep a keen sense about yourselves whenever you receive an email or SMS that you were not expecting. If a deal is too good to be true then, well, it most likely is a scam. If you’re in doubt, try to look up the phone number, email address, person or “organization” offering the “deal.” More often than not, you’ll find lots of people reporting that it’s a scam.
Rather than being visited by the three ghosts of holiday scams, make sure you and your loved ones are prepared for a happy holiday and a prosperous New Year.
We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!
Cisco Secure Social Channels
Nowadays, “cybersecurity” is the buzzword du jour, infiltrating every organization, invited or not. Furthermore, this is the case around the world, where an increasing proportion of all services now have an online presence, prompting businesses to reconsider the security of their systems. This, however, is not news to Cisco, as we anticipated it and were prepared to serve and assist clients worldwide.
Secure Cloud Analytics, part of the Cisco Threat, Detection, and Response (TD&R) portfolio, is an industry-leading tool for tackling core Network Detection and Response (NDR) use cases. These workflows focus primarily on threat detection and how security teams may recognize the most critical issues around hunting and forensic investigations to improve their mean-time-to-respond.
Over the last year, the product team worked tirelessly to strengthen the NDR offering. New telemetry sources, more advanced detections, and observations supplement the context of essential infrastructure aspects as well as usability and interoperability improvements. Additionally, the long-awaited solution Cisco Telemetry Broker is now available, providing a richer SecOps experience across the product.
As part of our innovation story on alerting capabilities, Secure Cloud Analytics now features new detections tied to the MITRE ATT&CK framework such as Worm Propagation, Suspicious User Agent, and Azure OAuth Bypass.
Additionally, various new roles and observations were added to the Secure Cloud Analytics to improve and change user alerts, that are foundational pieces of our detections. Alerts now include a direct link to AWS’ assets and their VPC, as well as direct access to Azure Security Groups, enabling further investigation capabilities through simplified workflows. In addition, the Public Cloud Providers are now included in coverage reports that provide a gap analysis to determine which accounts are covered. Alert Details offers new device information, such as host names, subnets, and role metrics that emphasize detection techniques. To better configure alerts, we are adding telemetry to gain contextual reference on their priority. Furthermore, the ingest process has grown more robust due to data from the Talos intelligence feed and ISE.
The highly anticipated SecureX integration is now available in a single click, with no API credentials required and smooth interaction between the two platforms. Most importantly, Secure Cloud Analytics alerts may now be configured to automatically publish as incidents to the SecureX Incident Manager. The Talos Intelligence Watchlist Hits Alert is on by default due to its prominence among the many alert types.
Among other enhancements to graphs and visualizations, the Encrypted Traffic widget allows for an hourly breakdown of data. Simultaneously, the Device Report contains traffic data for a specific timestamp, which may be downloaded as a CSV. Furthermore, the Event Viewer now displays bi-directional session traffic to provide even more context to Secure Cloud Analytics flows, as well as additional columns to help with telemetry log comprehension: Cloud Account, Cloud Region, Cloud VPC, Sensor and Exporter.
On-premises sensors now provide additional telemetry on the overview page and a dedicated page where users can look further into the telemetry flowing through them in Sensor Health. To optimize the Secure Cloud Analytics deployment and improve the user experience, sensors may now be deleted from the interface.
Regarding telemetry, Cisco Telemetry Broker can now serve as a sensor in Secure Cloud Analytics, so users can identify and respond to threats faster with additional context sent to Secure Cloud Analytics. In addition, there will soon be support for other telemetry types besides IPFIX and NetFlow.
As we can see from the vast number of new additions to Secure Cloud Analytics, the product team has been working hard to understand the latest market trends, listen to the customers’ requests, and build one of the finest SaaS products in the NDR industry segment. The efforts strongly underline how Secure Cloud Analytics can solve some of the most important challenges in the NDR space around visibility, fidelity of alerts and deployment complexity by providing a cloud hosted platform that can offer insights on-premise and on cloud environments simultaneously from the same dashboard. Learn more about new features that allow Secure Cloud Analytics to detect, analyze, and respond to the most critical dangers to their company much more quickly.
We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!
Cisco Secure Social Channels
Holiday travel is back with a vengeance this year. Set yourself up for a cyber-safe and hassle-free trip with our checklist.
The post Traveling for the holidays? Stay cyber‑safe with these tips appeared first on WeLiveSecurity
Your phone is likely a daily companion, giving you access to work emails, chats with friends, weather reports, and more — all in the palm of your hand. You can also use your phone for browsing online, looking up everything from your favorite recipes to your most-read media webpages.
While being able to browse whenever and wherever you want is convenient, you might prefer that your phone doesn’t save all your online searches. For example, if you frequently let other people use your phone, you may not want them to have access to a history of your Google searches. In this case, you can use private browsing or “incognito mode.”
This allows you to browse online without leaving any trace of your browsing activity on your mobile phone. Configuring your phone to use incognito mode can give you greater confidence while surfing online, as you’ll enjoy the peace of mind that comes with knowing your browser history isn’t recorded on your device.
This article explains what incognito mode is and how you can set it up on your mobile phone.
Incognito mode allows you to browse online without leaving certain data on the device you’re using. Also referred to as private browsing mode, it makes sure there’s no record of your search engine history, websites you visited, and even login details (and related passcodes) on that device.
As soon as you close the incognito web browser window, any cookies are erased and all these details disappear instead of being saved.
That said, if you leave an incognito browser window open on your phone — and then hand your phone to someone else — they’ll be able to see the activity. So, if you want to make the most of incognito mode, make sure to close the browser window after every surfing session.
Further, if you actively bookmark a page, it will be saved — even if you’re in incognito mode. Read on for some more caveats surrounding incognito mode and the extent of privacy it gives you.
It’s important to note that incognito mode or private browsing mode is a device-specific privacy measure. It makes sure that your search and web browsing history isn’t visible on the device itself.
However, your traffic and activity are both still visible to third parties beyond your device, such as your network admin, internet service provider (ISP), and the websites and search engines that you visit.
Viewing in private or incognito mode also won’t disguise your unique IP address from these parties. Incognito mode further doesn’t secure your device against cyberthreats like hackers.
That said, there are plenty of other tools you can use to safeguard your device against cybercriminals. For example, McAfee+ helps to secure your Wi-Fi connection, shield you from malicious websites or links, and detect malware.
You may already be familiar with incognito mode through your computer. For example, many people set up incognito mode through browsers like Mozilla Firefox, Google Chrome, Safari, Microsoft Edge, or Internet Explorer.
However, incognito mode isn’t just for computers — you can also use it on your phone’s web browsing apps.
The steps to setting up incognito mode are fairly straightforward. That said, it depends largely on which type of device you have.
Setting up private browsing or incognito mode for an Android isn’t the same as setting it up for iOS. Read on to learn how to go incognito whether you’ve got an Apple iPhone or an Android phone like Samsung.
The process for setting up incognito mode also varies based on the browser you’re using. Here’s how to set it up in the Google Chrome browser for your Android (note that the Google Chrome app is the default browser for most Android phones):
Remember, for Google Chrome’s incognito mode to do the trick, you need to close your browsing session after each use. If you leave the tab open and someone else uses your phone, they can see your activity.
For iPhones, the default browser is Safari. Here’s how to set up private browsing in Safari for your iPhone:
Again, remember to close your browser’s private tabs when you’re done surfing. This makes sure that cookies are deleted and the private session is safely hidden from your device’s history.
The above steps can help you set up incognito mode on your Apple or Android phone’s browser. However, you probably use your phone for much more than browsing.
You might have apps for watching videos, getting driving directions, listening to music, and more. And the tips above will only protect your privacy when using the phone’s browser — not apps.
That said, some apps offer their very own in-app incognito mode. Examples include YouTube, Google Maps, Spotify, and Instagram. Other apps simply offer the option of private sessions, requiring you to log in with a dedicated username and password if you’re going to use the app. These include Whatsapp, Dropbox, Amazon, PayPal, and Evernote.
Some of these apps can even be configured so they’re only unlockable with touch ID or face ID.
Browsing in incognito or private mode on your phone allows you to surf online without leaving any trace of your search history on that specific device. However, it doesn’t block third parties like your internet service provider or network administrator from seeing what websites you’ve visited. Only your phone is affected.
Incognito mode also doesn’t protect you against potential cyberthreats, like malware. To stay safe and browse with confidence, consider McAfee Mobile Security. It includes Wi-Fi privacy protection, browsing safeguards, shields against unauthorized third-party activities, and more — and it works for Android and iOS devices. Find out more.
The post How to Browse Privately on Your Phone appeared first on McAfee Blog.
Microsoft has released its final monthly batch of security updates for 2022, fixing more than four dozen security holes in its various Windows operating systems and related software. The most pressing patches include a zero-day in a Windows feature that tries to flag malicious files from the Web, a critical bug in PowerShell, and a dangerous flaw in Windows 11 systems that was detailed publicly prior to this week’s Patch Tuesday.
The security updates include patches for Azure, Microsoft Edge, Office, SharePoint Server, SysInternals, and the .NET framework. Six of the update bundles earned Microsoft’s most dire “critical” rating, meaning they fix vulnerabilities that malware or malcontents can use to remotely commandeer an unpatched Windows system — with little to no interaction on the part of the user.
The bug already seeing exploitation is CVE-2022-44698, which allows attackers to bypass the Windows SmartScreen security feature. The vulnerability allows attackers to craft documents that won’t get tagged with Microsoft’s “Mark of the Web,” despite being downloaded from untrusted sites.
“This means no Protected View for Microsoft Office documents, making it easier to get users to do sketchy things like execute malicious macros, said Greg Wiseman, product manager at security firm Rapid7. This is the second Mark of the Web flaw Microsoft has patched in as many months; both were first publicly detailed over the past two months on Twitter by security researcher Will Dormann.
Publicly disclosed (but not actively exploited for now) is CVE-2022-44710, which is an elevation of privilege flaw in the DirectX graphics component of Windows 11.
Another notable critical bug is CVE-2022-41076, a remote code execution flaw in PowerShell — a key component of Windows that makes it easier to automate system tasks and configurations.
Kevin Breen at Immersive Labs said while Microsoft doesn’t share much detail about CVE-2022-41076 apart from the designation ‘Exploitation More Likely,’ they also note that successful exploitation requires an attacker to take additional actions to prepare the target environment.
“What actions are required is not clear; however, we do know that exploitation requires an authenticated user level of access,” Breen said. “This combination suggests that the exploit requires a social engineering element, and would likely be seen in initial infections using attacks like MalDocs or LNK files.”
Speaking of malicious documents, Trend Micro’s Zero Day Initiative highlights CVE-2022-44713, a spoofing vulnerability in Outlook for Mac.
“We don’t often highlight spoofing bugs, but anytime you’re dealing with a spoofing bug in an e-mail client, you should take notice,” ZDI’s Dustin Childs wrote. “This vulnerability could allow an attacker to appear as a trusted user when they should not be. Now combine this with the SmartScreen Mark of the Web bypass and it’s not hard to come up with a scenario where you receive an e-mail that appears to be from your boss with an attachment entitled “Executive_Compensation.xlsx”. There aren’t many who wouldn’t open that file in that scenario.”
Microsoft also released guidance on reports that certain software drivers certified by Microsoft’s Windows Hardware Developer Program were being used maliciously in post-exploitation activity.
Three different companies reported evidence that malicious hackers were using these signed malicious driver files to lay the groundwork for ransomware deployment inside victim organizations. One of those companies, Sophos, published a blog post Tuesday detailing how the activity was tied to the Russian ransomware group Cuba, which has extorted an estimated $60 million from victims since 2019.
Of course, not all scary and pressing security threats are Microsoft-based. Also on Tuesday, Apple released a bevy of security updates to iOS, iPadOS, macOS, tvOS and Safari, including a patch for a newly discovered zero-day vulnerability that could lead to remote code execution.
Anyone responsible for maintaining Fortinet or Citrix remote access products probably needs to update, as both are dealing with active attacks on just-patched flaws.
For a closer look at the patches released by Microsoft today (indexed by severity and other metrics) check out the always-useful Patch Tuesday roundup from the SANS Internet Storm Center. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: AskWoody.com usually has the lowdown on any patches that may be causing problems for Windows users.
As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these updates, please drop a note about it here in the comments.
Cisco’s latest release of the Secure Firewall operating system, Secure Firewall Threat Defense Version 7.3, addresses key concerns for today’s firewall customers. The 7.3 release delivers more features to the three key outcomes: see and detect more threats faster in an increasingly encrypted environment, simplify operations, and lower the TCO of our security solution.
QUIC Fingerprinting
The QUIC protocol is seeing significant adoption but seeing within QUIC is highly challenging. It is the default protocol for popular sites such as Google and Facebook, almost 10% of sites today now support transport over the QUIC protocol. Further enhancements to Cisco’s Encrypted Visibility Engine (EVE), first launched a year ago in 7.1, allows for the fingerprinting of traffic that is using the QUIC Protocol in Secure Firewall 7.3. This allows for enhanced visibility of this traffic for use in policy decisions to help determine the nature of the traffic and identify potential malicious traffic hiding in the QUIC Protocol.
MITRE Rule Groups
The Intrusion Prevention System (IPS) in Secure Firewall 7.3 now includes groups of rules mapped to the MITRE framework so that customers can both deploy explicit protections and see events mapped to those known attackers’ tactics and techniques. Additionally, the reporting and eventing capabilities have been enhanced to show any events that map to specific tactics as described by MITRE.
Remote Access VPN Dashboard
Remote work is here to stay. Hybrid work is the new normal, to complement our best-in-class Remote Access VPN Capabilities inside Cisco Secure Firewall, release 7.3 delivers a consolidated dashboard for monitoring the Remote Access infrastructure. The new dashboard capabilities consolidate existing and new information into a single location so that customers can track logged in users, failed attempts to connect, location that users are connecting from as well as insights on throughput and bandwidth usage, providing customers with the security and business visibility they need to manage Remote Access VPN capabilities regardless of scale.
Enhanced Cluster Capabilities
Clustering capabilities within Secure Firewall offer a powerful way to scale out for performance and resiliency. With the release of Secure Firewall 7.3, operational enhancements to the clustering solution have been added so that customers can now monitor the full suite of metrics relating to the health of their cluster directly from the Secure Firewall Management Center as well as the capability to perform backup and restore actions on cluster nodes for a significantly reduced time-to-recovery in the event of a failure
Additional Site-To-Site VPN Capabilities
The Virtual Tunnel Interface (VTI) Capabilities have been further enhanced with Dynamic Virtual Tunnel Interface (DVTI) capabilities allowing for simplified connectivity between branch and hub sites. Support has also been added for OSPF and EIGRP routing protocols in conjunction with Virtual Tunnel Interfaces for added flexibility with route-based VPNs as well as Loopback Interface configuration to aid with management services in a dynamic environment.
Secure Firewall 3105 Hardware
Alongside the new Software and further extending Cisco’s powerful Secure Firewall 3100 series hardware platforms launched earlier this year, the new Secure Firewall 3105 bridges the gap on both price and performance between the small and mid-range hardware platforms. Delivering all the key capabilities of the other appliances in the 3100 series such as Clustering, Dual Power Supplies and Network Module support, as well as impressive performance from Firewall, VPN and TLS decryption thanks to the new architecture, the 3105 model targets the lower end of the mid-range with 10Gbps throughput.
Expanded support in Microsoft Azure Cloud
As organisations continue to adopt services from public cloud providers, Cisco Security recognises the need to enable our customers the flexibility to deploy more form factors in more locations as well as the ability to scale to meet modern cloud network demands.
Automated integration to Cisco Umbrella
Building on the DNS Integration capabilities delivered in Secure Firewall 7.2, customers leveraging the advanced capabilities of Cisco Umbrella can now significantly reduce the configuration overhead required to direct traffic to the Cisco Umbrella Cloud by making use of the SASE Topology capabilities in Secure Firewall 7.3. Customers can now automatically configure and manage IPSec Tunnels between Secure Firewall devices across their environment and the Umbrella Cloud as well as having a single view of the tunnel status directly within Secure Firewall Management Center.
These are just some of the many new features in the 7.3 version. We encourage you to take download it here and try it out. You can find more information on the 7.3 software release here.
We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!
Cisco Secure Social Channels
InfraGard, a program run by the U.S. Federal Bureau of Investigation (FBI) to build cyber and physical threat information sharing partnerships with the private sector, this week saw its database of contact information on more than 80,000 members go up for sale on an English-language cybercrime forum. Meanwhile, the hackers responsible are communicating directly with members through the InfraGard portal online — using a new account under the assumed identity of a financial industry CEO that was vetted by the FBI itself.
On Dec. 10, 2022, the relatively new cybercrime forum Breached featured a bombshell new sales thread: The user database for InfraGard, including names and contact information for tens of thousands of InfraGard members.
The FBI’s InfraGard program is supposed to be a vetted Who’s Who of key people in private sector roles involving both cyber and physical security at companies that manage most of the nation’s critical infrastructures — including drinking water and power utilities, communications and financial services firms, transportation and manufacturing companies, healthcare providers, and nuclear energy firms.
“InfraGard connects critical infrastructure owners, operators, and stakeholders with the FBI to provide education, networking, and information-sharing on security threats and risks,” the FBI’s InfraGard fact sheet reads.
In response to information shared by KrebsOnSecurity, the FBI said it is aware of a potential false account associated with the InfraGard Portal and that it is actively looking into the matter.
“This is an ongoing situation, and we are not able to provide any additional information at this time,” the FBI said in a written statement.
KrebsOnSecurity contacted the seller of the InfraGard database, a Breached forum member who uses the handle “USDoD” and whose avatar is the seal of the U.S. Department of Defense.
USDoD’s InfraGard sales thread on Breached.
USDoD said they gained access to the FBI’s InfraGard system by applying for a new account using the name, Social Security Number, date of birth and other personal details of a chief executive officer at a company that was highly likely to be granted InfraGard membership.
The CEO in question — currently the head of a major U.S. financial corporation that has a direct impact on the creditworthiness of most Americans — told KrebsOnSecurity they were never contacted by the FBI seeking to vet an InfraGard application.
USDoD told KrebsOnSecurity their phony application was submitted in November in the CEO’s name, and that the application included a contact email address that they controlled — but also the CEO’s real mobile phone number.
“When you register they said that to be approved can take at least three months,” USDoD said. “I wasn’t expected to be approve[d].”
But USDoD said that in early December, their email address in the name of the CEO received a reply saying the application had been approved (see redacted screenshot to the right). While the FBI’s InfraGard system requires multi-factor authentication by default, users can choose between receiving a one-time code via SMS or email.
“If it was only the phone I will be in [a] bad situation,” USDoD said. “Because I used the person[‘s] phone that I’m impersonating.”
USDoD said the InfraGard user data was made easily available via an Application Programming Interface (API) that is built into several key components of the website that help InfraGard members connect and communicate with each other.
USDoD said after their InfraGard membership was approved, they asked a friend to code a script in Python to query that API and retrieve all available InfraGard user data.
“InfraGard is a social media intelligence hub for high profile persons,” USDoD said. “They even got [a] forum to discuss things.”
To prove they still had access to InfraGard as of publication time Tuesday evening, USDoD sent a direct note through InfraGard’s messaging system to an InfraGard member whose personal details were initially published as a teaser on the database sales thread.
That InfraGard member, who is head of security at a major U.S. technology firm, confirmed receipt of USDoD’s message but asked to remain anonymous for this story.
USDoD acknowledged that their $50,000 asking price for the InfraGard database may be a tad high, given that it is a fairly basic list of people who are already very security-conscious. Also, only about half of the user accounts contain an email address, and most of the other database fields — like Social Security Number and Date of Birth — are completely empty.
“I don’t think someone will pay that price, but I have to [price it] a bit higher to [negotiate] the price that I want,” they explained.
While the data exposed by the infiltration at InfraGard may be minimal, the user data might not have been the true end game for the intruders.
USDoD said they were hoping the imposter account would last long enough for them to finish sending direct messages as the CEO to other executives using the InfraGuard messaging portal. USDoD shared the following redacted screenshot from what they claimed was one such message, although they provided no additional context about it.
A screenshot shared by USDoD showing a message thread in the FBI’s InfraGard system.
USDoD said in their sales thread that the guarantor for the transaction would be Pompompurin, the administrator of the cybercrime forum Breached. By purchasing the database through the forum administrator’s escrow service, would-be buyers can theoretically avoid getting ripped off and ensure the transaction will be consummated to the satisfaction of both parties before money exchanges hands.
Pompompurin has been a thorn in the side of the FBI for years. Their Breached forum is widely considered to be the second incarnation of RaidForums, a remarkably similar English-language cybercrime forum shuttered by the U.S. Department of Justice in April. Prior to its infiltration by the FBI, RaidForums sold access to more than 10 billion consumer records stolen in some of the world’s largest data breaches.
In November 2021, KrebsOnSecurity detailed how Pompompurin abused a vulnerability in an FBI online portal designed to share information with state and local law enforcement authorities, and how that access was used to blast out thousands of hoax email messages — all sent from an FBI email and Internet address.
Update, 10:58 p.m. ET: Updated the story after hearing from the financial company CEO whose identity was used to fool the FBI into approving an InfraGard membership. That CEO said they were never contacted by the FBI.
Update, 11:15 p.m. ET: The FBI just confirmed that it is aware of a potential false account associated with the InfraGard portal. The story now includes their full statement.
This is a developing story. Updates will be noted here with timestamps.
ind-1200
In our last blog, we gave a rundown of what the Telecommunications (Security) Act (TSA) is, why it’s been introduced, who it affects, when it starts, and how firms can prepare. Here, we take a closer look into the themes introduced by the Act, explore how the telecoms industry can explore zero trust to further improve its security posture, and outline the benefits that can be gained when complying.
When the Telecoms Security Act (TSA) was introduced, it was labelled as ‘one of the strongest telecoms security regimes in the world, a rise in standards across the board, set by the government rather than the industry’ by Matt Warman, former Minister of State at the Department for Digital, Culture, Media, and Sport. The industry is certainly feeling the impending impact of the act – with one industry pundit at an event we ran recently describing it as a ‘multi-generational change’ for the sector.
One of the headline grabbers stemming from the Act are the associated fines. With the new powers granted to it by the Act, Ofcom now has the responsibility to oversee operators’ security policies and impose fines of up to 10 percent of turnover or £100,000 a day in case operators don’t comply or the blanket ban of telecoms vendors such as Huawei. Sounds like the typical ‘stick’-based costly compliance messaging that no-one particularly wants to hear, right? But what if the TSA had some ‘carrot’-based business benefits that are much less discussed?
The TSA introduces a new security framework for the UK telecoms sector to ensure that public telecommunications providers operate secure and resilient networks and services and manage their supply chains appropriately. ny of the themes introduced in the code of practice can be aligned with the themes in a zero trust security model, which are also a focus for CISOs.
Zero trust security is a concept (also known as ‘never trust, always verify’) which establishes trust in users and devices through authentication and continuous monitoring of each access attempt, with custom security policies that protect every application. At Duo, our approach to zero trust is:
A crucial point to note here: much like a solution that claims to help with all aspects of the TSA, telecom providers should be wary of any vendor who claims to have a zero-trust product. Both are far much bigger than any ‘silver bullet’ solution purports to offer. But there is a good reason a zero-trust framework has been mandated by the US White House for all federal agencies, and recommended by the Australian Cyber Security Centre (ACSC) and the UK’s National Cyber Security Centre (NCSC).
As well as helping to mitigate the significant cyber risks presented to the telecoms industry, a zero-trust strategy provides many business benefits. Our recent Guide to Zero Trust Maturity shows that:
A robust zero-trust security program includes phishing-resistant multi factor authentication (MFA), access controls for devices and applications, risk-signalling, dynamic authentication, firewalls, analytics, web monitoring and more. As I said previously there is no one answer to zero trust, or indeed the TSA, but getting the basics right like strong MFA, single sign on (SSO) and device trust are an easy and effective way to get started.
The TSA will be a huge undertaking for industry, but it is important to focus on the benefits such a wide-reaching set of regulatory rules will inevitably result in. As another guest from our recent event put it: ‘the TSA is full of the latest and modern best practice around security, so the aim really is to raise the tide and all ships, which can only be a good thing.’
We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!
Cisco Secure Social Channels
Cybersecurity has changed dramatically since the dawn of firewalls in the 1980s. But despite all the upheaval and innovation, they have stood the test of time. The basic concept of allowing “good” traffic to flow and blocking the bad stuff remains essential. Of course, it looks much different now than in the era of Care Bears and Cabbage Patch Kids.
Today’s workers, data, and applications are everywhere, and firewalls must be as well. There’s no longer just one finite space to defend. With the recent explosion of hybrid work and the rapid transition to multi-cloud environments, it’s imperative that firewalls evolve alongside a business — and be ready for whatever’s next.
So, can your firewall grow with you? Or is it stuck in the age of Hair Bands and He-Man?
The past few years have brought about a keen focus on resilience — remaining strong, yet adaptable in the face of unexpected and even unfathomable challenges. But an organization cannot persevere without security being at the forefront of any resilience strategy.
96% of executives consider security resilience highly important to their business.
– Cisco Security Outcomes Report
Firewalls are a critical foundation for building powerful, resilient security infrastructure. Yet contemporary firewalls have to be and do more than one thing. Cisco Secure Firewall delivers world-class security controls wherever you need them, with unified visibility and consistent policy management and enforcement.
As a worldwide leader in networking and security, Cisco is better positioned than any other vendor to incorporate effective firewall controls into your infrastructure — anywhere your data and applications reside. According to a study conducted on behalf of Cisco by Forrester Research, Cisco Secure Firewall customers can:
Cisco Secure Firewall delivers on several key aspects necessary for security resilience: visibility, flexibility, intelligence, integration, and unified controls. Together, they enable organizations to close gaps, see and detect threats faster, and adapt quickly to change.
Watch video: Cisco Secure Firewall Overview
With most of today’s internet traffic being encrypted, security measures can become obsolete without the ability to see into all traffic, encrypted or not. While decryption is commonplace, it is simply not feasible in many cases, and can have serious impacts on network performance. With its Encrypted Visibility Engine, Cisco Secure Firewall leverages deep packet inspection (DPI) to identify potentially malicious applications in encrypted traffic without offloading to another appliance and degrading performance.
Due to a highly distributed network and workforce, as well as constantly maturing attacks, the ability to see into every corner of your ecosystem is crucial. Cisco Secure Firewall blends multiple technologies to detect and block more threats in more places. By combining traditional firewall capabilities with URL filtering, application visibility and control, malware defense, and Snort 3 intrusion prevention, organizations gain robust protection against even the most sophisticated threats.
Cisco offers a wide variety of firewalls for defending the different areas of your network — including physical, virtual, and cloud-native — as well as cloud-delivered. We can secure businesses and offices of all types and sizes, from the data center to the cloud.
Cisco Secure also provides flexible firewall management options, enabling you to deploy and operate your security architecture in a way that is tailored to the unique requirements of your NetOps, SecOps, and DevOps teams. No matter which firewall models you choose or environments you operate in (physical or virtual), you can use a single, simplified application to manage all your firewalls from one place.
The threat landscape changes every day, and our defenses must change with it. Cisco Talos is one of the largest and most trusted threat intelligence groups in the world. Its in-depth insight into global threats, and advanced research and analysis, enable us to quickly incorporate protections for new threats into our products via hourly updates. That way, Cisco customers are continuously safeguarded from both known and unknown threats.
“When the Log4j vulnerability was discovered, we were protected before we even completed our patching,” said Paul Smith, network administrator at Marian University. “As a result of automated hourly updates from Talos, Cisco Secure Firewall had an early detection signature, so it was already blocking the concerning traffic from infiltrating our network.”
Another differentiator for Cisco Secure Firewall is that it’s part of an integrated security ecosystem. With Cisco SecureX, organizations can correlate data from multiple technologies and unleash XDR capabilities for a centralized, automated response to threats.
“At the end of the day, it’s about protecting the data, and we do that with the integration of [Cisco] Secure Endpoint, Umbrella, and Secure Firewall, which combine to protect the networks, endpoints, workstations, and servers — and all of this can be correlated easily within SecureX.”
– Elliott Bujan, IT Security Manager, Marine Credit Union
The new Cloud-delivered Firewall Management Center leverages the cloud to facilitate agile, simplified operations for a distributed, hybrid network. It provides efficiency at scale by allowing security teams to swiftly deploy and update policies across their environment with just a few clicks, as well as take coordinated actions to prioritize, investigate, and remediate threats within a single pane of glass. And with a cloud-delivered management center, Cisco regularly updates its software behind the scenes, which reduces risk, maintains compliance, and gives your team more time to focus on other priorities.
Additionally, Cisco Secure Firewall dynamically shares policies driven by intelligence from Cisco Secure Workload, which uses microsegmentation to prevent lateral movement of attackers throughout a network. This allows security policies to be harmonized across both the network and application environments, boosting efficacy and fostering collaboration between teams.
These are just some examples of what makes up a comprehensive, modernized firewall. But Cisco is not stopping there. We continue to innovate to meet evolving business needs. For example, the new enterprise-class 3100 Series firewalls are specially designed for hybrid work, supporting more end users with high-performance remote access for increased organizational flexibility.
Additionally, Cisco Secure Firewall serves as a key component of advanced security strategies including XDR, SASE, and zero trust, helping businesses keep pace with accelerating digital transformation. According to Cisco’s most recent Security Outcomes Report, organizations with mature XDR, SASE, and zero trust implementations all boast significantly higher levels of security resilience.
Fuel and energy retailer, Ampol, uses a variety of Cisco technologies, including Secure Firewall, to segment and safeguard its network. “Cisco was an integral part of our success during COVID-19 as we were able to serve customers without interruption in stores,” said Amir Yassa, senior project specialist at Ampol. “Deploying our retail resilience project, mostly comprised of Cisco products, enabled us to reduce our IT-related incidents by 90%, thus enabling us to serve our customers better now and into the future.”
Is your firewall keeping up with future demands, or is it still stuck in the 80s teasing its hair? If it’s the latter, we can help. Visit cisco.com/go/firewall and learn how to refresh your firewall.
We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!
Cisco Secure Social Channels
Think outside the (gift) box. Here are a few ideas for security and privacy gifts to get for your relatives – or even for yourself. Some don’t cost a penny!
The post Top tips for security‑ and privacy‑enhancing holiday gifts appeared first on WeLiveSecurity
Payment applications make splitting restaurant bills, taxi fares, and household expenses so much easier. Without having to tally totals at the table or fumble with crumpled bills, you and your companions can spend less stress and more time on the fun at hand.
There are various payment apps available, and the company that may first come to mind is PayPal. PayPal is regarded as a safe platform where security and strong encryption are a priority; however, a recent and advanced phishing scam is putting PayPal users at risk of giving up large sums of money and their personally identifiable information (PII).1
Let’s look at this “triple-pronged” PayPal phishing scam and review some tips to help you identify and proceed should you encounter it.
The typical part of this three-sided scam is the phishing email component. According to one source, the phishing email comes from a legitimate-looking PayPal service email address. Luckily, the typos, odd punctuation, extra spaces, and grammar errors in the body of the email give away that it is a phishing attempt. Remember, phishing emails are often worded poorly or have errors. Large companies, especially ones like PayPal, have teams of content experts vetting all automated messages for such mistakes, so several mistakes in an email should set off your alarm bells. Proceed with caution and do not click on any links in the message.
The email also included wording that encouraged the user to act quickly or be charged a lot of money. That’s another trademark of phishing emails: urgency. Take a deep breath and make sure to reread carefully all emails that “require” a quick response. Don’t be scared by dire consequences. Phishers rely on people to rush and not give themselves time to listen to their better judgement.
The PayPal phishing email included a support phone number that claimed it was toll free. In actuality, it was an international phone number. So, if the recipient of the phishing email didn’t quite believe the message but wanted to follow up, the scam could catch them with what’s called a one-ring phone scam.2 This occurs when someone unknowingly calls an international phone number and then gets charged by their phone company for the long-distance call.
The best way to avoid one-ring phone scams is to never call a number you don’t recognize. Always go to an organization’s official website to find their contact information.
The third dimension of this PayPal scam was the international phone number in the phishing email connected the caller directly with the scammer who posed as the PayPal fraud department. The “customer service representative” then asked prying personal and financial questions to glean enough PII to break into a PayPal account or compromise the caller’s identity. This is the most damaging part of the scam. An excellent customer support team may be able to reimburse you your lost money; however, once your personal details are in nefarious hands, you can’t take them back.
In addition to never calling numbers you haven’t verified, never give out passwords and never give out more personal information than you need to. Even in legitimate customer service calls, it’s not rude to ask why the representative requires the information they’re asking for. In a fake call, questions like that may fluster the scammer, so keep an ear tuned to their tone.
Overall, our best advice for handling suspicious emails is to delete them. If it’s truly important, the sender will contact you again. And if a thief somehow stole money from one of your payment apps, the customer service team should be able to walk you through the steps to recover it.
The transfer and handling of large sums of money would make anyone nervous. To give you peace of mind, consider partnering with a service that can help you recover should you ever fall for a scheme and compromise your PII. McAfee+ Ultimate helps you live your best life in private, and the service includes credit monitoring with all three credit bureaus, security freeze, and expert online support to help you navigate any scams you encounter.
Having McAfee+ can protect you from email phishing scams like this. Here are some of the top agencies to report this scam to, if it happens to you: Paypal Fraud Department, Federal Trade Commision , Cybersecurity & Infrastructure Security Agency USA.gov IC3
“Report it. Forward phishing emails to reportphishing@apwg.org (an address used by the Anti-Phishing Working Group, which includes ISPs, security vendors, financial institutions, and law enforcement agencies). Let the company or person that was impersonated know about the phishing scheme.” – FTC.gov
1ZDNET, “Watch out for this triple-pronged PayPal phishing and fraud scam.”
2Federal Communications Commission, “‘One Ring’ Phone Scam.”
The post A PayPal Email Scam Is Making the Rounds: Here’s How to Identify and Avoid It appeared first on McAfee Blog.
FreshRSS 