#cybersecurity news

[drnic1]

Beyond Change Healthcare

The continued onslaught of cybersecurity attacks which if anything are only getting worse have impacted the healthcare system in dramatic fashion with the payment network brought down by the attack on Change Healthcare. Healthcare under Cyber Attack I keep hoping that we all get better at combatting these attempts to breach our data and that overall vigilance rises as we become more wary of…

[uinferno]

Love Under the Red Hood as a story but this always stood out to me.

Quick doodle to reacquaint myself with drawing.

[sayruq]

And allegedly the war cabinet went into bomb shelters

[molagboop]

Ok I'll talk more about Raven Beak's suit.

You know how Samus' suit just up and explodes if you get her killed? At least in Mawkin powersuits, that's an intended feature for specific warrior classes.

If you were to kill Raven Beak in some way other than allowing a Metroid to juice him like a lemon, his suit would explode. That's a security feature: the Mawkin are very proud of their technology, and firmly believe that their secrets of warfare should never fall into the hands of Others: partly because they're so proud, but also for the good of the galaxy. They don't want their secrets being used by bad actors to wreak havoc.

Raven Beak is the Mawkin Warlord: as such, his suit is juiced up to the nth degree. If he were to fall in battle and his suit didn't explode, the Mawkin would be waist-high in the swamp. If, for example, the Space Pirates were to get ahold of his suit and reverse engineer it, the Mawkin would be held responsible for unleashing the means for the Pirates to create devastating weapons based on their designs.

Mawkin suits are highly optimized and possess combat capabilities and weapons that far exceed most other tribes. Raven Beak's suit has custom "firmware". His suit and the suits of a number of high echelon warriors and intelligence agents are designed to combust in a very particular way.

When the wearer's vitals fall below critical levels, the suit cannibalizes its own upgrades. The excess matter that accumulates as a result of this reaction is highly volatile, and the speed at which this all occurs helps to catalyze a fantastic explosion that ensures no technological footprint is left behind. No user data, no biometrics, no upgrades, no suit. Typically, the more upgrades you have, the grander the explosion is: that's more matter for the dying suit to push together like a play-doh ball made of dynamite.

Upon death, the Shrouded Talons' suits are designed to destroy not just the tech, but the body as well. If a unit is decommissioned, the intelligence wing of the tribe logically does not want the agent's identity to be discerned. Leave no trace and there's no trail to follow, as it were. There's a reason the Talons aren't common knowledge in intergalactic intelligence circles: they take cleaning up after themselves very seriously.

[allthecanadianpolitics]

Canadian residents whose personal data was compromised in a 2019 LifeLabs data breach can now apply for up to $150 in compensation from a multi-million dollar class action settlement approved in October.  The private medical diagnostics company and its subsidiaries were the target of a cyberattack on Dec. 17, 2019, that compromised patient data for around 15 million customers, mostly in British Columbia and Ontario. Hackers accessed personal information, including health numbers and test results, according to the claim. LifeLabs has denied claims of negligence brought in the class action lawsuit. The company will now pay at least $4.9 million in the negotiated settlement — and up to $9.8 million — depending on the number of claims made.

Continue Reading

Tagging @politicsofcanada

[cyberegypt]

Cyberpunk Aesthetic + Ancient Egypt + A Hacker Girl

[dontmeantobepoliticalbut]

Maryland’s top utility regulator was watching the news one February morning when a headline blindsided him: Two suspects with neo-Nazi ties had been charged with plotting to take down Baltimore’s power grid.

Jason Stanek, the then-chair of the state’s Public Service Commission, said Maryland regulators were “caught flat-footed,” not hearing a word from law enforcement before the news broke — or in the months afterward. Federal prosecutors have alleged the defendants were driven by “racially motivated hatred” to try to cut power to hundreds of thousands of people in the state’s largest city, which has a predominantly Black population.

The FBI declined to comment on its communications with the Maryland commission. But Stanek’s experience is not uncommon.

A POLITICO analysis of federal data and interviews with a dozen security, extremism and electricity experts revealed that despite a record surge in attacks on the grid nationwide, communication gaps between law enforcement and state and federal regulators have left many officials largely in the dark about the extent of the threat. They have also hampered efforts to safeguard the power network.

Adding to the difficulties, no single agency keeps a complete record of all such incidents. But the attacks they know about have regulators and other power experts alarmed:

— Utilities reported 60 incidents they characterized as physical threats or attacks on major grid infrastructure, in addition to two cyberattacks, during the first three months of 2023 alone, according to mandatory disclosures they filed with the Department of Energy. That’s more than double the number from the same period last year. DOE has not yet released data past March.

— Nine of this year’s attacks led to power disruptions, the DOE records indicate.

— The U.S. is on pace to meet or exceed last year’s record of 164 major cyber and physical attacks.

— And additional analyses imply that the true number of incidents for both 2022 and 2023 is probably even higher. POLITICO’s analysis found several incidents that utilities had reported to homeland security officials but did not show up in DOE data.

According to a report on grid security compiled by a power industry cyber clearinghouse, obtained by POLITICO, a total of 1,665 security incidents involving the U.S. and Canadian power grids occurred last year. That count included 60 incidents that led to outages, 71% more than in 2021.

While that report does not break down how many of those incidents occurred in which country, the U.S. has a significantly larger grid, serving 145 million homes and businesses, with nearly seven times Canada’s power-generating capacity.

Law enforcement officials have blamed much of the rise in grid assaults on white nationalist and far-right extremists, who they say are using online forums to spread tactical advice on how to shut down the power supply.

Concerns about the attacks have continued in recent months, with incidents including a June indictment of an Idaho man accused of shooting two hydroelectric stations in the state.

But law enforcement officers investigating alleged plots against the grid don’t necessarily alert the Energy Department or other regulatory bodies.

“We have no idea” how many attacks on the grid are occurring, said Jon Wellinghoff, a former chair of the Federal Energy Regulatory Commission, which regulates the U.S. electric grid. “It looks like they’re escalating if you look at the data. But if you don’t have enough data, you can’t discern patterns and proactively work to stop these things from happening.”

Wellinghoff was FERC’s chair when an unknown sniper attacked a Pacific Gas and Electric substation in San Jose, Calif., in 2013 — an incident regulators have described as a “wake-up call” on the electricity supply’s vulnerability to sabotage.

Last year’s record number of physical and cyber disruptions to the U.S. power system included several incidents that captured public attention, such as a December shooting attack against two North Carolina substations that left 45,000 people without power for four days. The state’s medical examiner has blamed the attack for the death of an 87-year-old woman who died after her oxygen machine failed, ruling it a homicide. Nobody has been charged.

“There is no doubt there’s been an uptick over the last three years in the amount of incidents and also the severity of the incidents,” said Manny Cancel, senior vice president at the North American Electric Reliability Corp., the nonprofit body in charge of setting reliability standards for the bulk power system. He is also CEO of its Electricity Information Sharing and Analysis Center, which gathers and analyzes data from power companies.

Cancel said NERC has “seen two pretty substantial increases” in incidents coinciding with the 2020 and 2022 election cycles.

Grid attacks that led to power outages increased 71% from 2021 to 2022, totaling 55 incidents in 2022, according to a NERC briefing to utilities that POLITICO obtained. That increase was primarily due to a rise in gunfire assaults against critical infrastructure.

The largest outage reported from a physical attack early this year — which occurred in March in Clark County, Nev. — affected more than 11,000 people, according to DOE data.

But the state Public Utilities Commission was not aware of any outage due to an attack occurring that day, spokesperson Peter Kostes told POLITICO by email. That’s even though state regulations require utilities to contact the commission within four hours of a significant outage.

The state’s largest utility, NV Energy, said in a statement that it had reported the incident to local law enforcement “as soon as we learned about this incident ... so we can continue to increase our resilience against ongoing threats to the energy industry.” A spokesperson for the utility did not respond to multiple requests for comment on whether it had informed the commission.

Federal regulations also require utilities to report cyber or physical attacks to DOE, including physical attacks that cause “major interruptions or impacts” to operations.

They must also tell the department about disruptions from weather or other causes that meet certain criteria, such as those that cut off service to more than 50,000 customers for at least an hour, an uncontrolled loss of more than 200 megawatts of power, or a utility voluntarily shutting more than 100 megawatts, according to an Energy Department spokesperson. The spokesperson provided the information on the condition that they not be identified by name.

The Energy Department’s records don’t include at least seven reported physical assaults last year and this year that the Department of Homeland Security and the affected utilities said caused substantive economic damage or cut off power to thousands of customers. POLITICO found these incidents by cross-checking the department’s data against warnings issued by DHS and the FBI’s Office of the Private Sector.

DOE said the incidents may not meet its reporting thresholds.

Several of the incidents missing from DOE’s data involved clear physical attacks, based on other agencies’ descriptions. But the utilities involved said they did not report the incidents to the department because the attacks did not affect the kind of major equipment that could lead to widespread, regional power failures.

One of the incidents not found in DOE’s records cut off power to about 12,000 people for roughly two hours in Maysville, N.C., after a shooting damaged a substation in November, according to a DHS report. The FBI’s investigation into the incident is ongoing, according to the intelligence agency.

The utility affected by the incident, Carteret-Craven Electric Cooperative, reported the incident to NERC’s Electricity Information Sharing and Analysis Center, but didn’t report the attack to DOE because it was a “distribution-level” incident, said Melissa Glenn, a spokesperson for the utility. That means the outages caused by the damage would have been limited to local power customers and not lead to the wider blackouts federal regulators are most concerned with.

In another case unreported to the Energy Department, a substation owned by the East River Electric Cooperative serving the Keystone oil pipeline in South Dakota was attacked by gunfire late at night in July 2022, according to DHS. The incident caused more than $1 million in damage and forced the pipeline to reduce operations while repairs were underway.

East River co-op spokesperson Chris Studer said the utility reported the incident to local law enforcement, which brought in the FBI. East River also reported the incident to NERC and its E-ISAC, along with regional grid agencies, but said it did not report it to DOE because the attack did not affect the bulk power system.

Brian Harrell, a former assistant secretary for infrastructure protection at DHS, said in an email that utilities have too many competing agencies to report to, and suggested reporting be streamlined to NERC’s E-ISAC.

“This lack of consistency, by no fault of the utility, suggests that the numbers may not paint a complete picture,” he said.

Grid experts said these data gaps clearly indicate a lack of understanding about which agencies utilities need to report to and when.

Utilities may be using a “loophole” based on definitions of what constitutes “critical infrastructure,” said Jonathon Monken, a grid security expert with the consulting firm Converge Strategies. He was previously senior director of system resilience and strategic coordination for the PJM Interconnection, the nation’s largest power market.

There are “lots of ways” to work around DOE requirements, Monken added, but as he reads the regulation, utilities are required to report any operational disruptions caused by a physical attack.

“[I]t appears the information you collected shows that companies are still missing the boat when it comes to mandatory reporting,” he said. “Not good.”

One former FERC official who was granted anonymity to speak about a sensitive security issue said the commission also received no alerts from law enforcement officials about the planned and actual attacks that took place last year. That omission hinders agencies’ ability to respond to these kinds of events, the person said.

A spokesperson for FERC declined to comment on the commission’s communications with law enforcement.

But Cancel defended government agencies’ response to these incidents, and said federal investigators may have had specific intelligence reasons for keeping FERC and state utility agencies out of the loop.

“I’m not a lawyer or a law enforcement professional, but you had an active criminal investigation going on,” he said. “I don’t think they wanted to sort of blow the horn on that and compromise the integrity of the investigation.”

An FBI spokesperson offered no direct response to these criticisms in an email, but said the agency “views cybersecurity as a team sport.” The person commented on the condition that the remark be attributed to the bureau.

The FBI urged utility executives last month to attend security training hosted by intelligence agents in order to ensure they are up to speed on the threats posed by bad actors.

“We can’t do it without you,” Matthew Fodor, deputy assistant director of the FBI’s counterterrorism division, said during an all-day FERC technical conference on Aug. 10. “The challenges that we have — and DOE can probably speak to this better than anybody — is limited resources.”

People attacking the electricity supply have thousands of potential targets, including power substations and smaller but critical pieces of utility infrastructure. The smaller pieces often go unprotected because federal standards do not require utilities to secure them.

Nearly half of the 4,493 attacks from 2020 to 2022 targeted substations, according to the NERC briefing from February, making them the most frequent targets for perpetrators over that period.

Details on how to carry out these kinds of attacks are available from extremist messaging boards and other online content, researchers and federal security officials say. These include maps of critical entry points to the grid, along with advice that extremists have gleaned from incidents like the assault in North Carolina.

Stanek, the Maryland electricity regulator, said he was “disappointed with the level of coordination and communication” that federal and state law enforcement displayed in handling the alleged plot in Baltimore. No trial date has been announced for the case, which is in U.S. District Court in Maryland.

Maryland’s Public Service Commission is in charge of ensuring that the state’s power system keeps the lights on. Regulators need to be kept informed of threats to the system so they can coordinate with other agencies in case an attack succeeds, Stanek said.

At the same time, he quipped, maybe he was better off in the dark after all.

“There’s a lot of colorful details in [the FBI report],” Stanek said. He paused, thinking. “And honestly, as a regulator, had I received these details in advance and shared the information with trusted sources within state government, I would have had sleepless nights.”

“So perhaps the feds did a favor by only sharing this information after everything was all said and done,” he added.

[norever]

when im blue i am not with you

there are people in this world who live such grandiose and surreally absurd lives, how do they evade the law as they do..?

[nyancrimew]

new blog post:

[sunshinel3mon]

Cisco's Game-Changing Acquisition of Splunk: What It Means for the Cybersecurity Landscape

Cisco, the networking giant, recently made headlines with its eye-popping acquisition of cybersecurity software company Splunk, a deal that’s said to be worth around $28 billion. To say this is significant would be an understatement; the acquisition serves as a linchpin in Cisco’s ongoing strategy to expand its cybersecurity capabilities. Cisco’s Cybersecurity Evolution For Cisco, a company…

[whatshappeningintheworlds-blog]

A bill that President Joe Biden approved mandates that ByteDance, the parent company of TikTok, give out its assets within nine months to a year in order to prevent the applicability of an effective ban in the US.

What You Think🤔 About It Tell Me In Comment💬

[allthecanadianpolitics]

With a widespread cybersecurity breach into its second week, Global News has a key confirmation from Hamilton City Hall. City Manager Marnie Cluckie confirmed, during a media briefing late Monday afternoon, that the city was recently hit by a ransomware attack. She did not expand on the source of the cyberattack, or the demands, adding that she is “limited” in what she can share about the ongoing situation.

Continue Reading

Tagging @politicsofcanada

[dontmeantobepoliticalbut]

Russia, China and Iran remain the country's most significant foreign election threats, though the U.S. has seen an "increasing" number of threats from other actors, Director of National Intelligence Avril Haines told the Senate Intelligence Committee on Wednesday.

THE BIG PICTURE: The most concerning threat to this year's election are those against election workers which often stem from false narratives about the 2020 election, Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency (CSIS) told lawmakers.

• Both Haines and Easterly said the federal government's ability to protect elections has increased in recent years and that it has never been more prepared.

• Easterly said election workers have resigned over threats they received.

• "Such claims are corrosive to the sacred foundations of our democracy," Easterly said, "and they have led to harassment and threats of violence against election officials of both parties and their families."

ZOOM OUT: Haines said Russia remains the most active foreign threat to elections with the goals of eroding trust in U.S. institutions, exacerbating societal divides and reducing American support for Ukraine.

• She said China has a sophisticated influence apparatus but it did not deploy it in the 2020 presidential election and there has been no indication it will do so this election.

• China has targeted candidates from both political parties in previous elections to generate support for its foreign policy initiatives, like its territorial claims in Taiwan and Tibet.

THE BIG PICTURE: The intelligence community said earlier this week that threats against election workers have been "supercharged" by new technologies, including artificial intelligence.

• This election, generative AI has also been used to damage campaigns, including a fake robocall campaign using President Biden's voice to discourage votes in New Hampshire's primary in February.

• The Senate Rules Committee on Wednesday passed three bills to protect elections against deceptive AI, while a bipartisan group of senators unveiled a roadmap for how Congress should regulate AI that same day.

GO DEEPER: The split reality of election threats on Capitol Hill

[head-post]

Cybercrime threat in Germany is higher than ever before

The German Federal Office for Information Security reports a significant increase in cyber threats in Germany. The risk of ransomware attacks is considered to be extremely high, according to the Office’s latest report.

On Thursday (2 November), Germany’s Office for Information Security (BSI) issued a report on the state of IT and cybersecurity in the country for the period from June 2022 to June 2023. The agency’s experts noted that the threat level was “higher than ever before.” It also recorded the highest average increase in malware types – 332,000 new variants per day over the period observed. The number of German ransomware victims whose names and captured data were published on leak sites also reached a record high of 65 people in the second quarter. German Interior Minister Nancy Faeser said:

“The BSI report on the state of IT security in Germany in 2023 proves that the threat situation in cyberspace remains tense.”

Ransomware remains the top threat, according to the agency’s report. Government agencies are seeing a dramatic increase in advanced persistent threats (APTs) – cyber espionage or sabotage carried out over a long period of time to gain information or manipulate.

Read more HERE

[govindhtech]

Decoding CISA Exploited Vulnerabilities

Integrating CISA Tools for Effective Vulnerability Management: Vulnerability management teams struggle to detect and update software with known vulnerabilities with over 20,000 CVEs reported annually. These teams must patch software across their firm to reduce risk and prevent a cybersecurity compromise, which is unachievable. Since it’s hard to patch all systems, most teams focus on fixing vulnerabilities that score high in the CVSS, a standardized and repeatable scoring methodology that rates reported vulnerabilities from most to least serious. 

However, how do these organizations know to prioritize software with the highest CVE scores? It’s wonderful to talk to executives about the number or percentage of critical severity CVEs fixed, but does that teach us anything about their organization’s resilience? Does decreasing critical CVEs greatly reduce breach risk? In principle, the organization is lowering breach risk, but in fact, it’s hard to know. 

To increase cybersecurity resilience, CISA identified exploited vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) initiative was created to reduce breaches rather than theoretical risk. CISA strongly urges businesses to constantly evaluate and prioritize remediation of the Known Exploited Vulnerabilities catalog. By updating its list, CISA hopes to give a “authoritative source of vulnerabilities that have been exploited in the wild” and help firms mitigate risks to stay ahead of cyberattacks.

CISA has narrowed the list of CVEs security teams should remediate from tens-of-thousands to just over 1,000 by focusing on vulnerabilities that: 

Been assigned a CVE ID and actively exploited in the wild

Have a clear fix, like a vendor update.

This limitation in scope allows overworked vulnerability management teams to extensively investigate software in their environment that has been reported to contain actively exploitable vulnerabilities, which are the most likely breach origins. 

Rethinking vulnerability management to prioritize risk

With CISA KEV’s narrower list of vulnerabilities driving their workflows, security teams are spending less time patching software (a laborious and low-value task) and more time understanding their organization’s resiliency against these proven attack vectors. Many vulnerability management teams have replaced patching with testing to see if: 

Software in their surroundings can exploit CISA KEV vulnerabilities.

Their compensatory controls identify and prevent breaches. This helps teams analyze the genuine risk to their organization and the value of their security protection investments.

This shift toward testing CISA KEV catalog vulnerabilities shows that organizations are maturing from traditional vulnerability management programs to Gartner-defined Continuous Threat Exposure Management (CTEM) programs that “surface and actively prioritize whatever most threatens your business.” This focus on proven risk instead of theoretical risk helps teams learn new skills and solutions to execute exploits across their enterprise.  

ASM’s role in continuous vulnerability intelligence  

An attack surface management (ASM) solution helps you understand cyber risk with continuous asset discovery and risk prioritization.

Continuous testing, a CTEM pillar, requires programs to “validate how attacks might work and how systems might react” to ensure security resources are focused on the most pressing risks. According to Gartner, “organizations that prioritize based on a continuous threat exposure management program will be three times less likely to suffer a breach.”

CTEM solutions strengthen cybersecurity defenses above typical vulnerability management programs by focusing on the most likely breaches. Stopping breaches is important since their average cost is rising. IBM’s Cost of a Data Breach research shows a 15% increase to USD 4.45 million over three years. As competent resources become scarcer and security budgets tighten, consider giving your teams a narrower emphasis, such as CISA KEV vulnerabilities, and equipping them with tools to test exploitability and assess cybersecurity defense robustness.

Checking exploitable vulnerabilities using IBM Security Randori

IBM Security Randori, an attack surface management solution, finds your external vulnerabilities from an adversarial perspective. It continuously validates an organization’s external attack surface and reports exploitable flaws.

A sophisticated ransomware attack hit Armellini Logistics in December 2019. After the attack, the company recovered fast and decided to be more proactive in prevention. Armellini uses Randori Recon to monitor external risk and update asset and vulnerability management systems as new cloud and SaaS applications launch. Armellini is increasingly leveraging Randori Recon’s target temptation analysis to prioritize vulnerabilities to repair. This understanding has helped the Armellini team lower company risk without affecting business operations.

In addition to managing vulnerabilities, the vulnerability validation feature checks the exploitability of CVEs like CVE-2023-7992, a zero-day vulnerability in Zyxel NAS systems found and reported by IBM X-Force Applied Research. This verification reduces noise and lets clients act on genuine threats and retest to see if mitigation or remediation worked. 

Read more on Govindhtech.com