Johnson Controls hit by Dark Angels Ransomware

The Dark Angels ransomware gang, active since May 2022, has reportedly set its sights on VMware ESXi servers within the premises of Johnson Controls International (JCI). The cyberattack initially targeted JCI’s Asian offices and subsequently spread to several subsidiary brands, including York, Tyco, Luxaire, Coleman, Ruskin, Grinnel, and Simplex.

Johnson Controls, a renowned manufacturer of industrial equipment such as fire safety and security systems, has launched an investigation into the extent of the attack’s impact on its network. The company has assured stakeholders that it will provide more comprehensive details early next week.

As a result of the disruption, a portion of JCI’s systems is currently offline, and the company is actively exploring strategies to mitigate associated risks. Frustrated customers of York have taken to Twitter to express their discontent, as they are unable to access the status of their booked HVAC equipment and processing systems.

Notably, the Dark Angels ransomware group is infamous for demanding a minimum ransom of $51 million and is recognized for offering a VMware ESXi encryptor, sourced from the Babuk and Ragnar ransomware variants.

In the case of Johnson Controls, Dark Angels reportedly exfiltrated approximately 27 terabytes of corporate data, setting the stage for a double extortion attack in the future. The company acknowledged this breach in its Form 8-K filing with the SEC and disclosed its collaboration with its cyber insurance provider and experts to address the situation.

The course of action Johnson Controls will ultimately take in response to the hackers’ demands remains uncertain. However, the company’s website warns that certain customer-accessed applications may experience downtime, and those affected will receive formal notifications.

The post Johnson Controls hit by Dark Angels Ransomware appeared first on Cybersecurity Insiders.

September 28, 2023 at 10:02AM

Read More

Lawsuit against MGM and Ceasars Entertainment Ransomware Attack

A lawsuit has been initiated against two prominent gaming entities due to their failure to safeguard the personal identifiable information of their customers, resulting in a substantial potential penalty, possibly amounting to millions of dollars. The legal action revolves around MGM Resorts International and Caesars Entertainment, both of which fell victim to a highly sophisticated file-encrypting malware attack towards the end of last week.

Currently, it has come to light that two separate lawsuits have been filed in connection with the MGM cyber-attack, while Caesars Gaming company is contending with three legal actions, one of which was freshly filed just last Friday.

The identity of the culprits behind the security breaches at both companies remains shrouded in mystery. However, a hacking group known as “VX-Underground” has made allegations that the ALPHV, also known as the BlackCat ransomware group, played a role in the incident, managing to exfiltrate a portion of data from the compromised servers.

Collaborating closely, the Nevada Gaming Control Board and the FBI have launched an investigation into this cyber incident. Their findings are expected to be presented in a report due early next month.

In a positive turn of events, MGM Resorts and Hotels have successfully resolved the situation, restoring their systems to normalcy after a 10-day shutdown. It remains unclear whether they acquiesced to the hackers’ demands or relied on their business continuity plan to restore applications and data to their usual state.

As for Caesars, the company has not yet issued an official statement regarding the matter.

It’s important to note that in both incidents, the attackers gained access to the systems by obtaining network login credentials through a Vishing attack perpetrated against an unsuspecting employee. Consequently, businesses are urged to adopt a comprehensive approach to cybersecurity, emphasizing the importance of awareness training for their staff to guard against such threats, which can potentially target any organization at least once a year.

The post Lawsuit against MGM and Ceasars Entertainment Ransomware Attack appeared first on Cybersecurity Insiders.

September 27, 2023 at 08:20PM

Read More

Cyber Attacks Arising from Microsoft Office Software

In today’s digital age, Microsoft Office has become a staple in offices and homes worldwide, facilitating communication, productivity, and document management. However, this widespread usage has also made MS Office software a prime target for cyber-criminals.

Cyber attacks arising from Microsoft Office software have gained prominence in recent years, posing significant threats to individuals, organizations, and governments alike. This article delves into the evolving landscape of cyber attacks associated with MS Office software and explores ways to mitigate these threats.

The Microsoft Office Suite Vulnerabilities

Macro-Based Attacks: One of the most common methods used by cyber criminals is the exploitation of macros within Office documents. Macros are scripts that automate tasks, but they can also be used maliciously to deliver malware. Users are often tricked into enabling macros, unknowingly infecting their systems.

Malicious Email Attachments: Cyber criminals frequently send phishing emails with malicious Office attachments. These attachments may contain malware or lead to malicious websites designed to steal sensitive information.

Malicious Links: MS Office documents can include embedded links that direct users to malicious websites. Clicking on these links can result in drive-by downloads or the installation of malware.

Fileless Attacks: Modern cyber attacks often exploit vulnerabilities in MS Office applications themselves. These fileless attacks don’t rely on traditional malware files, making them harder to detect.

 Zero-Day Exploits: Cybercriminals search for and exploit vulnerabilities in Office software that haven’t yet been patched by Microsoft. These zero-day exploits are highly sought after and can be used to compromise systems before patches are available.

Mitigating MS Office Software Cyber Threats

Keep Software Updated: Regularly update Microsoft Office software to patch known vulnerabilities and reduce the risk of falling victim to zero-day exploits.

Disable Macros: Disable macros by default in Office documents and only enable them from trusted sources. Educate users on the risks associated with enabling macros.

Beware of Email Attachments: Exercise caution when opening email attachments, especially if they come from unknown or unexpected sources. Verify the legitimacy of the sender before opening any Office files.

Email Filtering: Implement robust email filtering systems that can identify and quarantine suspicious emails containing Office attachments.

User Education: Educate employees, family members, or colleagues about the dangers of phishing emails and the importance of safe email and document handling practices.

Security Software: Install reputable antivirus and anti-malware software to detect and mitigate threats arising from MS Office documents.

 Network Segmentation: Implement network segmentation to isolate critical systems from potential threats originating from Microsoft Office software.

Conclusion

Microsoft Office software remains an essential tool for productivity and collaboration, but its widespread use has made it a prime target for cyber-criminals. To safeguard against cyber attacks originating from MS Office, users and organizations must stay vigilant, keep software up to date, and educate themselves about the evolving threat landscape. By adopting a proactive approach to cybersecurity, individuals and organizations can minimize the risks associated with this ubiquitous software suite and protect their valuable data from cyber threats.

The post Cyber Attacks Arising from Microsoft Office Software appeared first on Cybersecurity Insiders.

September 27, 2023 at 11:20AM

Read More

Indian government reports Security Vulnerabilities in Apple devices

The Indian government has released a report highlighting security vulnerabilities in Apple devices. The Computer Emergency Response Team of India (CERT-IN) has issued an urgent alert, identifying security threats affecting a range of Apple products, including iPhones, iPads, Apple Watches, iMacs, MacBooks, and the Safari Browser. These vulnerabilities stem from software flaws.

CERT-IN, operating under the Ministry of Electronics and Information Technology (MeitY), previously exposed vulnerabilities in the Google Android Operating System.

On CERT-India’s official website, a CIVN-2023-0275 notification warns that hackers can exploit a security validation certificate flaw in the Security Code Component. This allows them to execute malicious code and gain privileged access control, bypassing all security protections through crafted requests.

Additionally, a flaw was discovered in Apple’s Kernel, enabling the execution of instruction code between the device’s software and hardware.

Regarding the Safari browser, errors in Apple’s WebKit left browsers exposed to multiple vulnerabilities.

The following software versions have been identified as vulnerable to these threats:

    1. Apple macOS Monterey Versions released before 12.7
    2. Apple macOS Ventura Versions released before 13.6
    3. Apple WatchOS Versions released before 9.6.3
    4. Apple WatchOS Versions released before 10.0.1
    5. Apple iOS Versions before 16.7 and iPadOS Versions before 16.7
    6. Apple iOS Versions before 17.0.1 and iPadOS Versions before 17.0.1
    7. Apple Safari versions before 16.6.1

In response to this news, Apple has stated that all the vulnerabilities identified by CERT have already been addressed. It now falls upon users to ensure their devices are updated with the latest software fixes.

Furthermore, Apple has issued emergency security patches for iOS/iPadOS 17 and WatchOS 10 to address zero-day vulnerabilities that could potentially expose devices to spyware. While Apple hasn’t provided detailed information about the spyware or the extent of the damage it may have caused, it acknowledged Maddie Store of Google’s Threat Analysis Group and Bill Marczak of Citizen Lab, based at the University of Toronto’s Munk School, for discovering the vulnerabilities.

Note: According to a Telegram resource, the fix was issued to counter the ‘Predator’ spyware developed by Intellexa of Egypt.

The post Indian government reports Security Vulnerabilities in Apple devices appeared first on Cybersecurity Insiders.

September 27, 2023 at 11:13AM

Read More

Top 3 Priorities for Today’s CISO: Safeguarding the Digital Frontier

Jaye Tillson, Field CTO at Axis Security

In an era where cyber threats are evolving at an alarming pace, the role of a Chief Information Security Officer (CISO) has never been more critical. Today, CISOs are the guardians of an organization’s digital assets, and in this role are facing a very daunting task–they are being called to protect sensitive data, maintain customer trust, and ensure business continuity. With an ever-expanding threat landscape, the ability to deliver on these three fronts has never been more challenging. As a result, it’s essential for CISOs to establish clear priorities to navigate these turbulent waters successfully.

In my role, I have the opportunity to meet regularly with security professionals from a variety of businesses all over the globe. Over the past six months in particular, that includes some extremely informative discussions with a sizeable group of CISOs. In this article, I wanted to share what I believe are the top three priorities that are at the forefront of their agenda.

Cyber Resilience

Today we are all operating in an interconnected world and many of the CISOs I spoke to believe that it’s not a matter of ‘if’ but ‘when’ a cyberattack will occur. It’s hard to argue with their view. Taking that viewpoint into account, their focus was on building cyber resilience within their organizations. For them, this meant preparing for, responding to, and recovering from cyber incidents effectively. Here are some key strategies that they are considering:

• Incident Response Plan: Develop and regularly update a comprehensive incident response plan. Once this has been shared throughout the organization, make sure that all employees are aware of their roles and responsibilities during a cyber incident. From there, it’s imperative to put this plan to the test. This includes conducting regular drills and simulations to gauge the plan’s effectiveness and, if necessary, adjusting it as needed.
• Data Backups and Recovery: Even with the best plan, data loss is always a possibility, especially since it is no longer housed in a single, central location. These CISO’s touched on the need to implement a robust data backup and recovery processes to minimize any data loss in case of a breach. This includes verifying the integrity of backups regularly and storing them securely offline to prevent ransomware attacks.
• Threat Intelligence: Invest in threat intelligence tools and services to stay informed about emerging threats and vulnerabilities. These CISOs widely agreed that having regular access to this information would help them proactively defend against attacks.
• Employee Training: No matter how many solutions you invest in and the simulations you conduct, human error still remains a significant factor in security breaches. In fact,  Verizon’s 2022 Data Breaches Investigations Report (DBIR) found that 82 percent of data breaches involve a human element. According to the DBIR, this includes incidents “in which employees expose information directly (for example, by misconfiguring databases) or by making a mistake that enables cyber criminals to access the organization’s systems.” Findings like this reinforce why these CISOs state it’s essential to conduct regular cybersecurity awareness training for all employees. The goal of these efforts is simple–ensure that everyone across the businesses fully understands the importance of security best practices.

Zero Trust

Many of the CISOs felt that the traditional perimeter-based security model is no longer sufficient to protect their business against modern threats. These solutions were effective when their we focused on protecting everyone within a castle and moat (i.e., the corporate office)/ But we don’t work in castles anymore.

For this group there is widespread agreement that the answer is to adopt a Zero Trust approach to secure their organization’s digital assets. Zero Trust operates on the principle of “never trust, always verify,” and it requires a fundamental shift in how security is implemented. Their priorities were:

• Identity and Access Management (IAM): Implement strict IAM policies to ensure that users and devices are authenticated and authorized before accessing any resources. This includes the use multi-factor authentication (MFA) wherever possible.
• Micro-Segmentation: Divide the network into micro-segments to limit lateral movement for potential attackers. With micro-segmentation, each individual segment should have its own access controls and monitoring mechanisms.
• Continuous Monitoring: Because security threats never sleep, businesses must employ continuous monitoring solutions that track user and device behavior, detect anomalies, and trigger alerts for suspicious activities in near real-time.
• Application Security: Ensure that all applications, whether on-premises or in the cloud, are secure by design. In addition, regularly assess and update the business’s security posture to mitigate vulnerabilities.

Regulatory Compliance

As data privacy regulations continue to evolve worldwide, compliance is a significant concern for many of the CISOs, and with good reason. Non-compliance often leads to hefty fines and reputational damage. Just ask Amazon which in 2021 incurred an $877 million fine for breaches of the GDPR.  To address this priority, the CISOs intended to:

• Stay Informed: Stay up-to-date with the latest data privacy regulations, such as GDPR, CCPA, NIS2, or any other relevant laws based on their organization’s geographic footprint and industry.
• Data Protection: Implement robust data protection measures, including encryption, access controls, and data retention policies, to ensure compliance with regulatory requirements.
• Third-party Risk Management: Evaluate and monitor the security practices of third-party vendors and partners to ensure they meet compliance standards, as their actions can impact their organization’s compliance status.
• Documentation and Reporting: Maintain thorough records of security measures, audits, and compliance activities and be prepared to provide documentation to regulatory authorities if required.

Conclusion

As the digital landscape becomes increasingly complex and volatile, these CISOs knew they would be facing the formidable challenge of safeguarding their organizations against a barrage of cyber threats.  What was clear through my conversations is they all felt that by prioritizing cyber resilience, adopting Zero Trust, and ensuring regulatory compliance, they could build a robust security posture that not only protects their organization’s sensitive data but also strengthens customer trust and ensures business continuity in an ever-changing cybersecurity landscape. They also acknowledged that their role was seen as pivotal in the modern business world and that these top priorities should be their guide in securing the digital frontier.

Image by gpointstudio on Freepik

The post Top 3 Priorities for Today’s CISO: Safeguarding the Digital Frontier appeared first on Cybersecurity Insiders.

September 26, 2023 at 09:18PM

Read More

Top Five Steps to Elevate Your Data Security Posture Management and Secure Your Data

By Karthik Krishnan, CEO of Concentric.ai

October is Cybersecurity Awareness Month, and every year most tips for security hygiene and staying safe have not changed. We’ve seen them all – use strong passwords, deploy multi-factor authentication (MFA), be vigilant to spot phishing attacks, regularly update software and patch your systems. These are great recommended ongoing tips and are as relevant today as they’ve ever been. But times have changed and these best practices can no longer be the bare minimum.

The sheer number of threats to your data — both external and internal — are increasing exponentially, so maintaining a robust data security posture is paramount. From a data protection standpoint, perhaps the most difficult challenge to address is that business-critical data worth protecting now takes so many different forms. Intellectual property, financial data, business confidential information, PII, PCI data, and more create a very complex environment. 

Traditional data protection methods, like writing a rule to determine what data is worth protecting, are not enough in today’s cloud-centric environment. And think about how easy it is for your employees to create, modify and share sensitive content with anyone. Your sensitive data is constantly at risk from data loss, and relying on employees to ensure that data is shared with the right people at all times is ineffective.

In fact, according to the 2023 Verizon Data Breach Investigations report, 74% of all breaches involve the human element — either via social engineering error, privilege misuse, or use of stolen credentials. Concentric AI’s own 2023 Data Risk Report research reports that, on average, each organization had 802,000 data files at risk due to oversharing — that’s 402 files per employee. The risk to data is enormous.

As Cybersecurity Awareness Month approaches, it’s is a good reminder that data security posture management (DSPM) is  critical for organizations to implement for visibility into actionable insights on how to mitigate data security risk. DSPM empowers organizations to:

•   Identify all sensitive data

•   Monitor and identify risks to business-critical data

•   Remediate and protect that information

The following Data Security Posture Management (DSPM) checklist elements combined with new initiatives for Cybersecurity Awareness Month can help you create a comprehensive five-step guide through Awareness, Action and What You Need to Know:

1. Data Sensitivity: The Foundation of Security

Awareness: It is critical to be able to discover and identify your at-risk data. Knowing where your sensitive data resides is the first step in securing it. 

Action: Host workshops and webinars to educate employees about the types of sensitive data (PII, IP, etc.) in your organization, and why it’s crucial to protect them.

What You Need to Know: Understanding the types of data you’re handling can make a huge impact. Employees should be aware of what constitutes sensitive data and the risks associated with mishandling it. Workshops can cover topics like data classification, secure handling of PII, and the importance of data encryption.

2. Contextual Awareness: More Than Just Data Types

Awareness: Organizations must be able to understand the context of their data. Data is not just about types but also about the context around it.

Action: Use real-world examples to show how data can be misused if taken out of context. Encourage employees to think before they share.

What You Need to Know: Context matters. Data that seems harmless can become a security risk when placed in a different context. Employees need to be aware of and trained to consider the broader implications of the data they handle, including how it interacts with other data and systems.

For example, consider an employee’s first name. On its own, a first name like “John” seems harmless. But combined with other pieces of data such as a last name, email address, or office location, it can be used to craft a convincing phishing email. Imagine if you receive an email that addresses you by your full name and references your specific office location or recent company activities. It would appear legitimate and could trick an unsuspecting employee into revealing sensitive information or clicking on a malicious link.

3. Risk Assessment Drills: Preparing for the Worst

Awareness: Organizations need to understand where there is risk to sensitive data in order to protect it. Knowing the vulnerabilities can help in crafting better security policies.

Action: Conduct mock drills to simulate scenarios where sensitive data might be at risk due to inappropriate permissions or risky sharing. This happens far more often than you think.

What You Need to Know: Mock drills can help employees understand the real-world implications of data breaches. These drills can simulate phishing attacks, unauthorized data sharing, and even insider threats. The key is to help employees understand the importance of following data security protocols. Hint: while employees need to know these implications, your organization should be leveraging solutions that reduce the burden on employees.

4. Permission Audits: Who Has Access? 

Awareness: It is very important for organizations to be able to track and understand data lineage and permissions. Knowing who has access to what data is crucial.

Action: Dedicate a week to auditing and correcting data permissions across all platforms. Make it a company-wide initiative.

What You Need to Know: Regular audits of data permissions can prevent unauthorized or risky access to sensitive information. During Cybersecurity Awareness Month, make it a point to review and update permissions, ensuring that employees have access to only the data necessary to do their jobs. The principles of least privilege and zero trust are applicable here.

5. Actionable Insights: The Path Forward

Awareness: Finally, organizations need to be able to take action and remediate any risk. Proactive measures can significantly reduce the risk of a data breach.

Action: Share weekly insights on the company’s data risk posture. Highlight any successful remediations as well as areas that need attention.

What You Need to Know: Transparency is key. Sharing insights about the company’s data risk posture can empower employees to take individual actions that contribute to the organization’s overall security. Celebrate the wins, but also highlight any underlying risks that need to be mitigated.

Cybersecurity Awareness Success: Combining security awareness with robust DSPM

Cybersecurity is a shared responsibility, and Cybersecurity Awareness Month is the perfect time to reinforce this message. Combining data security awareness with robust DSPM is key for keeping data secure.

All organizations can achieve a strong level of data security via a solid cybersecurity awareness program, and by following tips and best practices in order to minimize the impact of a data breach. Having the best of both worlds is achievable with a security-aware workforce and a robust DSPM solution.

 

Image by Freepik

The post Top Five Steps to Elevate Your Data Security Posture Management and Secure Your Data appeared first on Cybersecurity Insiders.

September 26, 2023 at 09:04PM

Read More

Obtain career boost in 2024 with these 10 cybersecurity certifications

The software industry is in a constant state of flux, and staying competitive requires continuous skill enhancement through the acquisition of the latest and most sought-after certifications. To elevate your career prospects in 2024, consider pursuing one or more of the following certifications, ensuring your pay scale continues to rise:

1.) Systems Security Certified Practitioner (SSCP): This certification validates your advanced technical skills in monitoring and administering an organization’s IT infrastructure. ISC2 issues this intermediate-level security certificate, and the exam fee is $263, plus additional costs. To sit for this exam, you must have at least 18 months of prior experience in the IT security field.

2.) CompTIA Security+: This certification provides fundamental knowledge for IT professionals in cybersecurity, covering laws and regulations related to cyber risks and compliance, as well as incident response in cloud, mobile, and IoT environments. To be eligible for this $400+ exam, you need IT admin or system admin experience.

3.) GIAC Security Certification: Tailored for individuals with information systems and networking backgrounds, this certification costs between $1000 and $1300. Prerequisites include completing a GIAC Security course and having three years of experience in Information Security.

4.) CISSP (Certified Information Systems Security Professional): This advanced certification from ISC2 is essential for roles such as security executive, security manager, and security practitioner. To qualify for this certification, you must have five years of experience in security and risk management, asset security, security architecture and engineering, communication and network security, security assessment and testing, software development security, and identity and access management. The cost is approximately $800.

5.) CISA (Certified Information Systems Auditor): Offered by ISACA, this certification is ideal for those aspiring to become cybersecurity auditors. CISA equips you to evaluate security vulnerabilities, assess the authenticity of the security framework, and report compliance irregularities. Candidates must have five years of experience in information security auditing, control, and assurance, with an exam cost of around $760.

6.) Certified Ethical Hacker (CEH): EC-Council offers this certification, which validates skills related to penetration testing, attack detection, and prevention. CEH candidates will lawfully learn how to identify security flaws by simulating organization hacking. Completing this certification costs approximately $1200, and you must have at least five years of experience in information security and obtain training from a reputable institution.

7.) CompTIA Advanced Security Practitioner: This certification is designed for experienced security professionals such as security engineers and senior security architects. It covers topics like governance, risk management, compliance, architecture, security engineering, and cryptography. The exam fee is around $512.

8.) Certified Information Security Manager (CISM): Offered by ISACA at a cost of about $760, this certification is particularly beneficial for moving into team lead positions. Previous experience is required.

9.) System Security Certified Practitioner (SSCP): This ISC2 certification is geared towards individuals who want to manage IT security systems and controls. It costs $260, and candidates should have a master’s degree in cybersecurity to take the exam.

10.) GIAC Certified Incident Handler: This certification assesses a candidate’s ability to resolve cybersecurity incidents using their skills, knowledge, and experience. It’s beneficial for those looking to qualify for digital crime investigations and costs approximately $960.

These certifications are your gateway to staying competitive in the ever-evolving software industry. Choose the ones that align with your career goals and current skill set to ensure your career continues to thrive in 2024 and beyond.

The post Obtain career boost in 2024 with these 10 cybersecurity certifications appeared first on Cybersecurity Insiders.

September 26, 2023 at 08:28PM

Read More