Forescout Cyber Weekly Roundup February 15, 2019

The Forescout Cyber Roundup is a weekly blog series that highlights some of the major cyber headlines, as well as some of the more obscure stories from the week. The purpose of this curation is to raise cyber awareness, provoke thought and encourage discussion among cyber professionals at all levels. Articles are categorized by industry, not necessarily priority.

Twitter: @proffitt_colby

Public Sector
1. Unplug-and-play Protocol: Russia’s plans to ‘unplug’ may result in internet censorship for its citizens and millions of dollars in short-term economic losses – but what most are worried about is long-term cyber superiority.
   https://www.npr.org/2019/02/11/693538900/russia-is-considering-an-experiment-to-disconnect-from-the-internet
2. And then they ATT&CKed: Understanding the root cause of an attack is key to preventing future damages, but it’s also one of the most difficult tasks facing cyber professionals across all enterprises; however, MITRE’s ATT&CK framework and knowledge base can help explain the ‘why’ behind adversary tactics.
   https://federalnewsnetwork.com/strategic-threat-intelligence/2019/02/mitres-new-attck-tool-an-encyclopedia-of-cyber-threats/

Defense

3. Bigger guns are only better when they work: The new weapons on the Army’s Stryker Infantry Carrier vehicle are apparently just as susceptible to cyber compromise as U.S. weapons systems. https://taskandpurpose.com/army-stryker-vehicles-cyber-vulnerabilities
4. Deterrence done right: The aftermath of an offensive cyberattack is usually easier to see than the veiled months of planning, espionage and deception; defensive tactics such as deterrence require a similar covert strategy, but unlike an attack, the net effect of cyber defense can be harder to see and take much longer to realize.
   https://www.defenseone.com/ideas/2019/02/coordinated-actions-against-huawei-are-cyber-deterrence-done-right/154870/

Retail

5. Don’t Fall Prey on Cyber V-Day: Much like Black Friday and Cyber Monday, Valentine’s Day is another busy day for consumers, retailers, and cyber thieves.
   https://securitytoday.com/articles/2019/02/14/the-3-greatest-valentines-day-cyber-threats.aspx
6. “Don’t worry – I’m sure they just write it off”: When retailers want to make a profit and consumers want a frictionless, convenient user experience, hackers win.
   https://www.forbes.com/sites/danpitman1/2019/02/12/cyber-security-risk-in-retail-and-how-to-handle-it/

Healthcare

7. Time for your annual checkup: Breaches may have decreased, but the attacks are getting more personal and creative.
   https://www.databreaches.net/2019-data-breach-barometer-report-shows-massive-increase-in-exposed-healthcare-records/
8. Bluebloods isn’t just a TV series anymore: The question is, can these bioelectric breakthroughs be hacked?
   https://www.nextgov.com/emerging-tech/2019/02/pentagon-researching-bioelectric-implants-help-troops-heal-catastrophic-wounds/154720/

Financial Services

9. More Power? How about No Power? When killing the power becomes step one in your cyber defense playbook, it’s probably a sign that you need a new playbook.
   https://www.maltatoday.com.mt/news/national/92964/bank_of_valletta_shuts_down_operations_following_cyber_attack_#
10. Too big to blockchain? Blockchain and bitcoin naysayers beware, digital currency is now backed by JP Morgan—but, did JPM just become more secure, or a bigger target?
    https://www.bbc.co.uk/news/business-47240760

Operational Technology / Industrial Control Systems

11. Work smarter, not harder: Company focuses on velocity, scalability, adaptability and sustainability to future proof critical infrastructure.
    https://datacenterfrontier.com/aligned-energy-critical-infrastructure/
12. Things are about to get physical: The convergence of traditional IT, operational technology (OT) and Internet of Things (IoT) devices is exposing new threat vectors across U.S. critical infrastructure.
    https://www.infosecurity-magazine.com/infosec/securing-critical-infrastructure/

State, Local & Education

13. What? You’re cutting after-school robot wars? As part of the increase in Science, Technology, Engineering, Arts, and Math (STEAM) programs, many schools are now offering cyber-specific coursework, although the future of some cyber charter schools is uncertain.
    http://www.witf.org/news/2019/02/the-death-of-cyber-charter-schools-in-pa.php
14. New kid on the block: While healthcare and financial services remain prime targets for cyber criminals, K-12 is the new sector garnering more and more attention.
    https://www.campussafetymagazine.com/safety/k-12-cybersecurity-resource-center-cyber-attacks/

Editor’s Choice

15. Critical ICS Flaw: The Siemens CERT issued 16 advisories, including a 10/10 critical RCE security bug that allows remote, unauthenticated attackers to tinker malicious TCP packets destined for 22347. “The affected SICAM 230 process control system is used as an integrated energy system for utility companies, and as a monitoring system for smart-grid applications.”
    https://threatpost.com/siemens-critical-remote-code-execution/141768/
16. Android PNG Parser Fail: A picture may be worth a thousand words, but in this case it might be malware and simply opening the image could unleash malicious code on Android devices.
    https://gadgets.ndtv.com/mobiles/news/google-fixes-critical-png-security-bug-but-millions-of-android-smartphones-still-vulnerable-1990062

Share This: Share on Linkedin Share on Twitter Share on Facebook