Not only is the People’s Republic of China (PRC) a threat with its use of TikTok, but it also supports threat actors that have for years attacked U.S. based companies as well as the governments of the U.S. and Japan. According to a Joint Advisory published on September 27, 2023, by the National Security Agency
Cybersecurity
AI and Cybersecurity
By Linn Foster Freedman on
Posted in Artificial Intelligence, Cybersecurity
There is a lot of chatter out there around the uses of artificial intelligence (AI) for cybersecurity. For example, Applied Sciences published a paper on how AI can be used for mobile malware detection, and Gartner has published on AI Security Management.
According to an article published in Forbes, entitled “A Primer on Artificial Intelligence…
Joint Advisory Warns of Snatch Ransomware
By Linn Foster Freedman on
Posted in Cybersecurity
The FBI and CISA issued a Joint Cybersecurity Advisory “#StopRansomware: Snatch Ransomware” on September 20, 2023. The Advisory outlines the indicators of compromise and observed tactics, techniques, and procedures of Snatch so organizations can identify, mitigate, and respond to an attack using the Snatch ransomware variant.
Snatch has been hitting the Defense Industrial Base (DIB)…
Joint Commission Issues Alert on Patient Safety After a Cyber-Attack
By Linn Foster Freedman on
Posted in Cybersecurity
On August 15, 2023, the Joint Commission issued a Sentinel Event Alert entitled “Preserving patient safety after a cyberattack,” which provides “tips on what organizations can do to prepare to deliver safe patient care in the event of a cyberattack.”
The Alert outlines the growth of cyber-attacks and information system breaches in the…
CISA Alert: VMware Releases Security Update—Patch VMware Tools Now
By Linn Foster Freedman on
Posted in Cybersecurity
VMware provides multi-cloud services, products, and solutions for its customers, including VMware Tools. On September 1, 2023, VMware released a security update for a vulnerability in VMware Tools. According to the Cybersecurity Infrastructure Security Agency (CISA), “A cyber threat actor can exploit this vulnerability to obtain sensitive information.”
In the alert, CISA “encourages users…
CISA Issues Four More Industrial Control Systems Advisories
By Linn Foster Freedman on
Posted in Cybersecurity
On August 22, 2023, the Cybersecurity and Infrastructure Security Agency (CISA) issued four more advisories related to industrial control systems. The advisories are applicable to four different industrial control products, explain the risk of the vulnerability (e.g., “successful exploitation of these vulnerabilities could allow an attacker to compromise availability, integrity, and confidentiality of the targeted…
CISA Issues Two Industrial Control Systems Advisories
By Linn Foster Freedman on
Posted in Cybersecurity
The Cybersecurity and Infrastructure Security Agency (CISA) recently issued “timely information about current security issues, vulnerabilities, and exploits surrounding” Industrial Control Systems (ICS).
The Advisories provide background on the vulnerabilities, and the manufacturers’ releases for remediation and mitigation to implement to protect against the vulnerabilities, which Industrial Control Systems operators may wish to consult. The…
CISA Issues 2022 Top Routinely Exploited Vulnerabilities
By Linn Foster Freedman on
Posted in Cybersecurity
In its continued effort to keep the industry apprised of threats facing companies in the U.S., CISA recently issued a Cybersecurity Advisory: 2022 Top Routinely Exploited Vulnerabilities that is helpful to get up to speed on top threats, emerging threats, and intelligence of vulnerabilities being exploited by threat actors. It also provides recommendations to…
SEC Adopts New Cybersecurity Rules for Public Companies
By Linn Foster Freedman on
Posted in Cybersecurity
In a 3-2 vote, the Securities and Exchange Commission (SEC) adopted new cybersecurity rules yesterday (July 26, 2023) applicable to public companies.
The rules, which will become effective thirty days after publication in the Federal Register, require public companies to “disclose material cybersecurity incidents they experience and to disclose on an annual basis material information…
Patch Adobe ColdFusion Vulnerabilities Being Exploited in the Wild ASAP
By Linn Foster Freedman on
Posted in Cybersecurity
Adobe has issued alerts on three vulnerabilities affecting its ColdFusion product. The first alert, issued on July 11, 2023, announced patches for CVE-2023-29298, an improper access control issue that can lead to a security feature bypass, and CVE-2023-29300, a deserialization issue that can be exploited for arbitrary code execution.
On July 14, Adobe announced patches…