Category: Organisation Types

Organisation Types for membership

NCSC releases cyber security advice for agriculture sector

Agency News, Cyber Security CII sector, Industry News
Farmers will for the first time have access to tailor-made cyber security advice published in response to the growing use of technology in the agriculture sector.
The new Cyber Security for Farmers guidance from the National Cyber Security Centre – a part of GCHQ – and the National Farmers’ Union (NFU) will provide the farming community with the tools and information it needs to protect itself from the most common cyber attacks, including scam emails and malicious software.
Businesses in the agricultural sector are increasingly taking advantage of the benefits modern farming technology can provide, such as GPS, remote sensors, and farm management software.
But with official statistics showing a rise in reports of cyber attacks against the farming community, and in the wake of well-documented incidents such as spoof farm machinery adverts leaving farmers thousands of pounds out of pocket, the NCSC and NFU are urging the sector to act on the new guidance.
Sarah Lyons, NCSC Deputy Director for Economy and Society, said: “Technology plays a huge role in modern farming and offers many benefits that will help the industry to thrive in the 21st century.
“We are teaming up with the NFU to share best online practice to the sector, as an increased use of technology also sees an increased risk of being targeted by cyber criminals.
“Staying safe online might seem daunting, but the actionable advice in ‘Cyber Security for Farmers’ will help the sector to stay as safe as possible while embracing the latest technology.”
The advice, which can be found in full on the NCSC’s website, includes guidance on
- protecting your farm against malware;
- keeping devices up to date;
- where to go for help;
- backing up data, and;
- dealing with scam emails, text messages, and phone calls.
Stuart Roberts, Deputy President at the NFU, said: “Rural crime is a huge issue for farm businesses and we rightly look to protect our farm buildings, machinery and our livestock. However, we all live and work in a digital world and we must be conscious of the threats this can bring to our businesses.
“It’s incredibly important that farmers take this seriously, which is why we’ve teamed up with the experts in the National Cyber Security Centre to help produce this guidance. I would urge all farmers to read this advice and take the necessary steps to reinforce their cyber security and protect their farm business.”
The NCSC is committed to raising cyber security and resilience across every part of the UK, and this includes supporting businesses, academia, and the charity sector, as well as the public through the Cyber Aware campaign.
Leave a comment ,

NSA Cybersecurity Advisory: Malicious Actors Abuse Authentication Mechanisms to Access Cloud Resources

Agency News, Cyber Security CII sector, Industry News
In response to ongoing cybersecurity events, the National Security Agency (NSA) released a Cybersecurity Advisory Thursday “Detecting Abuse of Authentication Mechanisms.” This advisory provides guidance to National Security System (NSS), Department of Defense (DoD), and Defense Industrial Base (DIB) network administrators to detect and mitigate against malicious cyber actors who are manipulating trust in federated authentication environments to access protected data in the cloud. It builds on the guidance shared in the cybersecurity advisory regarding VMware with state-sponsored actors exploiting CVE 2020-4006 and forging credentials to access protected files, though other nation states and cyber criminals may use this tactic, technique, and procedure (TTP) as well.
This advisory specifically discusses detection and mitigation of two TTPs to forge authentications and gain access to a victim’s cloud resources. While these TTPs require the actors to already have privileged access in an on-premises environment, they are still dangerous as they can be combined with other vulnerabilities to gain initial access, then undermine trust, security, and authentication. Initial access can be established through a number of means, including known and unknown vulnerabilities. The recent SolarWinds Orion ® code compromise is one serious example of how on-premises systems can be compromised, leading to abuse of federated authentication and malicious cloud access.
Mitigation actions include hardening and monitoring systems that run local identity and federation services, locking down tenant single sign-on (SSO) configuration in the cloud, and monitoring for indicators of compromise. NSA remains committed to providing provide timely, actionable and relevant guidance, and is partnering across the public and private sectors in ongoing incident response efforts. Releasing this advisory with further technical guidance allows NSA’s customers to apply preventative measures to the fullest extent along with the detection and mitigation actions.
Summary
Malicious cyber actors are abusing trust in federated authentication environments to access protected data. An “on premises” federated identity provider or single sign-on (SSO) system lets an organization use the authentication systems they already own (e.g. tokens, authentication apps, one-time passwords, etc.) to grant access to resources, including resources in “off premises” cloud services. These systems often use cryptographically signed automated messages called “assertions” shared via Security Assertion Markup Language (SAML) to show that users have been authenticated. When an actor can subvert authentication mechanisms, they can gain illicit access to a wide range of an organizations assets.
In some cases, actors have stolen keys from the SSO system that allow them to sign assertions and impersonate any legitimate user who could be authenticated by the system. On 7 December, NSA reported on an example where a zeroday vulnerability was being used to compromise VMware Access®1 and VMware Identity Manager®2 servers, allowing actors to forge authentication assertions and thus gain access to the victim’s protected data. In other cases, actors have gained enough privileges to create their own keys and identities such as “service principals” (cloud applications that act on behalf of a user) or even their own fake SSO system. According to public reporting, in some cases, the SolarWinds Orion code compromise provided actors initial access to an on-premises network which led to access within the cloud.
Note that these techniques alone do not constitute vulnerabilities in the design principles of federated identity management, the SAML protocol, or on-premises and cloud identity services. The security of identity federation in any cloud environment directly depends on trust in the on-premises components that perform authentication, assign privileges, and sign SAML tokens. If any of these components is compromised, then the trust in the federated identity system can be abused for unauthorized access.
To defend against these techniques, organizations should pay careful attention to locking down SSO configuration and service principal usage, as well as hardening the systems that run on-premises identity and federation services.
Monitoring the use of SSO tokens and the use of service principals in the cloud can help detect the compromise of identity services. While these techniques apply to all cloud environments that support on-premises federated authentication, the following specific mitigations are focused on Microsoft Azure federation. Many of the techniques can be generalized to other environments as well.
Leave a comment , ,

ENISA AI Threat Landscape Report Unveils Major Cybersecurity Challenges

Agency News, Cyber Security CII sector, Industry News
The European Union Agency for Cybersecurity (ENISA) released its Artificial Intelligence Threat Landscape Report, unveiling the major cybersecurity challenges facing the AI ecosystem. ENISA’s study takes a methodological approach at mapping the key players and threats in AI. The report follows up the priorities defined in the European Commission’s 2020 AI White Paper. The ENISA Ad-Hoc Working Group on Artificial Intelligence Cybersecurity, with members from EU Institutions, academia and industry, provided input and supported the drafting of this report.
The benefits of this emerging technology are significant, but so are the concerns, such as potential new avenues of manipulation and attack methods. The technology takes many steps across the supply chain and requires vast amounts of data to function efficiently. The AI Threat Landscape report underlines the importance of cybersecurity and data protection in every part of the AI ecosystem to create trustworthy technology for end-users.
Executive Director of the EU Agency for Cybersecurity Juhan Lepassaar said: “Cybersecurity is one of the bases of trustworthy solutions for Artificial Intelligence. A common understanding of AI cybersecurity threats will be key to Europe’s widespread deployment and acceptance of AI systems and applications.”
This new work by ENISA aims to serve as a baseline for initiatives to secure AI: both in terms of policies, as it frames the problem and provides guidance on cybersecurity threats, as well as in terms of technical controls, as it highlights specific threats for which action may be needed. The report is directed to policy makers when developing future guidance on secure AI deployments, to technical experts to support customised risk assessments and to standardisation bodies to support upcoming AI security standards.
The main highlights of the report include:
Definition of AI’s scope in the context of cybersecurity by following a lifecycle approach. The ecosystem of AI systems and applications is defined by taking into account the different stages of the AI lifecycle -- from requirements analysis to deployment.
- Identification of assets of the AI ecosystem as a fundamental step in pinpointing what needs to be protected and what could possibly go wrong in terms of the security of the AI ecosystem.
- Mapping of the AI threat landscape by means of a detailed taxonomy. This serves as a baseline for the identification of potential vulnerabilities and attack scenarios for specific use cases.
- Classification of threats and listing of relevant threat actors. The impact of threats to different security properties is also highlighted.
The ENISA AI Threat Landscape identifies the challenges and opportunities to deploy secure AI systems and services across the Union. The report highlights the need for more targeted and proportionate security measures to mitigate the identified threats, as well as the need for an in-depth look into AI’s use in sectors such as health, automotive and finance.
The EU Agency for Cybersecurity continues to play a bigger role in the assessment of Artificial Intelligence (AI) by providing key input for future policies.
Earlier this year, the Agency set up the ENISA Ad Hoc Working Group on Cybersecurity for Artificial Intelligence, which supports ENISA in the process of building knowledge on AI Cybersecurity. The group includes members from the European Commission Directorate-General Communications Networks, Content and Technology (DG CONNECT), the European Commission Directorate-General Joint Research Committee (DG JRC), Europol, the European Defence Agency (EDA), the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), the European Telecommunications Standards Institute (ETSI), as well as academics and industry experts.
One comment , ,

ENISA 5G Threat Landscape Report Updated to Enhance 5G Security

Agency News, Cyber Security CII sector, Industry News
The European Union Agency for Cybersecurity (ENISA) published an updated version of its 5G threat assessment report to address advancements in the areas of fifth generation of mobile telecommunications networks (5G) and to contribute to the implementation of the EU 5G toolbox cybersecurity risk mitigating measures.
The new ENISA Threat Landscape for 5G Networks report is a major update of the previous edition as it captures recent developments in 5G standardisation. The publication includes a vulnerability analysis, which examines the exposure of 5G components. The analysis explores how cyber threats can exploit vulnerabilities and how technical security controls can help mitigate risks.
European Union Agency for Cybersecurity Executive Director Juhan Lepassaar explained: “By providing regular threat assessments, the EU Agency for Cybersecurity materialises its support to the EU cybersecurity ecosystem.  This work is part of our continuous contribution to securing 5G, a key infrastructure for the years to come.”
The New Threat Landscape includes:
- An updated system architecture of 5G, indicating introduced novelties and assessed security considerations;
- A detailed vulnerability analysis of all relevant 5G assets, including their exposure to threats;
- A mapping of related security controls aiming at the reduction of threat surface;
- An update of the relevant threats in accordance with their exploitation potential of the assessed vulnerabilities;
- The consideration of implementation options – migration paths from 4G to 5G infrastructures;
- The development of a process map showing the contribution of operational, life cycle and security assurance processes to the overall security of 5G infrastructures;
- A new inventory of critical components.
The information produced for this report is based on publicly available content published by 5G market players (operators, vendors, and national and international organisations), standardisation groups and bodies (for example: 3rd Generation Partnership Project (3GPP); International Telecommunications Union (ITU); European Telecommunications Standardisation Institute (ETSI); International Organisation for Standardisation (ISO); the Global System for Mobile Communications (GSMA)).
One comment , ,

Asia-Pacific resolves to move from crisis to resilience

Agency News, Industry News, Power/Energy/Oil & Gas sector, Transport sector, Water sector
In 2019, the United Nations Office for Disaster Risk Reduction’s (UNDRR) Global Assessment Report called on countries to abandon “hazard-by-hazard” risk management, in favour of a holistic approach that examines risk in the context of its impact in systems, including cascading impacts.
A year later, the COVID-19 pandemic presented the world with an unfortunate case study of how systemic risk, if left untreated, can snowball into a disaster and a global crisis.
However, the pandemic was not the only disaster of the year, as 2020 saw countries in Asia-Pacific deal with a perfect storm of dual and multiple disasters, including droughts, floods and typhoons.
For countries in the region to guard against future disasters and mitigate the compounded impact of disasters, a fundamental shift in risk governance at national and local levels is required.
The post-COVID recovery process is one avenue to embed this new approach in socio-economic development processes, to avoid the creation of new risks while risk-proofing development gains.
However, some preconditions need to be met to facilitate this transformation, including committed leadership, investments, engagement of all sectors and stakeholders, and an embrace of science-based multi-hazard risk reduction. All of these elements are in line with the commitments that countries made in the adoption of the Sendai Framework for Disaster Risk Reduction 2015-2030.
The 2021 Asia-Pacific Ministerial Conference for Disaster Risk Reduction (APMCDRR), as the first major UNDRR regional platform since the onset of COVID-19, offers countries and stakeholders an opportunity to determine how these conditions can be met to achieve a transformation in risk governance.
With that goal, UNDRR and Australian Government, as the convener and host of the APMCDRR respectively, completed this week a major step in the roadmap to the ministerial conference, the organizing of the Asia-Pacific Partnership for Disaster Risk Reduction (APP-DRR) Forum.
The APP-DRR was organized on 1-2 December as a virtual meeting with 175 participants from 30 Asia-Pacific governments, over 10 intergovernmental organisations, several UN and international organizations, and stakeholder groups.
The Forum was kicked off with a statement by Ms. Mami Mizutori, Special Representative of the UN Secretary-General for Disaster Risk Reduction, who exhorted the participants to “think big and out of the box”. Opening remarks were made by the Australian Government:
"This forum is an important opportunity to take stock of how we're progressing against our Sendai commitments and to work together to accelerate this process," said Ms. Rebecca Bryant, Assistant Secretary at the Australian Department of Foreign Affairs and Trade, adding:
"Australia is firmly committed to working with countries to further enhance our region's resilience to disasters and to learn from each other's experience."
Of importance to the APMCDRR is building the disaster resilience of small island developing states in the Pacific. These countries are often the most vulnerable countries to extreme weather events, and still have to mobilize resources to counter a global pandemic.
Speaking on both aspects, the Honorable Dr. Ifereimi Waqainabete, Minister of Health and Medical Services in Fiji, said:
“Our coordinates cannot change... we need to understand as a nation that we are prone to disasters. We are prone to cyclones, droughts and other extreme weather events, almost every year,” emphasizing that “as leaders in our own right, we must continue to make better decisions in building resilience to ensure that the devastating impacts of disasters are mitigated and reduced.”
To make the right decisions, countries need to strengthen their data collection systems and understanding of risk, which in turn contributes to the development of sound national and local disaster risk reduction strategies.
On that front, UNDRR noted that the region was making progress in reporting on several Sendai Framework indicators, as 67% of countries in Asia-Pacific have reported some data as of October 2020.
However, challenges remain around the collection of data that is disaggregated by sex, age and disability, which hinders the effectiveness of planning to ensure no one is left behind.
Moreover, countries continue to face challenges in adopting integrated approaches that combine climate change adaptation with disaster risk reduction and expanding their risk governance mechanisms to other sectors.
As the availability of funding is often a hindrance to the implementation of risk reduction strategies, UNDRR presented recommendations on how countries could finance risk prevention.
Green investment offers a particularly effective way to fund climate change adaptation and risk reduction measures, as is highlighted in a report that was launched by UNDRR at the APP-DRR, titled ‘Ecosystem-Based Disaster Risk Reduction: Implementing Nature-based Solutions for Resilience.’
However, as a result of the downturn in economic activity caused by the COVID-19 crisis, it might be necessary for governments to increase their support for green investments as part of their recovery efforts.
“Financially constrained firms have weaker environmental performance and COVID-19 could be detrimental to environmental investments. Going forward, there will be a need for some forms of public support to encourage green recovery,” said Dr. Hiroko Oura from the International Monetary Fund.
The APP-DRR was also an opportunity for countries and stakeholder groups to voice their priorities and concerns. These reflections were posted on the event page and will help inform planning for APMCDRR.
Leave a comment , , ,

NIS Directive has Positive Effect, though Study Finds Gaps in Cybersecurity Investment Exist

Agency News, Cyber Security CII sector, Industry News
The European Union Agency for Cybersecurity (ENISA) released a new report on information security spending for network and information services (NIS) under the NIS Directive, the first EU-wide legislation on cybersecurity. The NIS Investments report is based on a survey of 251 organisations of operators of essential services (OES) and digital service providers (DSP) from France, Germany, Italy, Spain and Poland. Eighty-two percent of those surveyed reported the NIS Directive had a positive effect on their information security.
The new ENISA study examining cybersecurity spending states that 82% of Operators of Essential Services and Digital Services Providers find that the NIS Directive has a positive effect. However, gaps in investment still exist. When comparing organisations from the EU to those from the United States, data shows that EU organisations allocate on average 41% less to cybersecurity than their US counterparts.
NIS Directive Implementation
The report provides input to the European Commission’s review of the NIS Directive on the 16th of December, four years after the Directive entered into force and two years after the transposition into national law.
Challenges remain after the implementation of the Directive -- the lack of clarity of the NIS Directive expectations after transposition into national law was a common issue. More than 35% of organisations surveyed believe the NIS Directive expectations are unclear. Twenty-two percent of respondents listed limited support from national authorities as one of their top challenges when implementing the Directive.
Cybersecurity Investments: EU vs. US
When comparing organisations from the EU to organisations from the United States, the study shows that EU organisations allocate on average 41% less to information security than their US counterparts.
Key findings about the NIS Directive implementation in the NIS Investment report
- The average budget for NIS Directive implementation projects is approximately €175k, with 42.7% of affected organisations allocating between €100k and €250k. Slightly less than 50% of surveyed organisations had to hire additional security matter experts.
- Surveyed organisations prioritised the following security domains: Governance, Risk & Compliance and Network Security.
- When implementing the NIS Directive, 64% of surveyed organisations procured security incident & event log collection solutions, as well as security awareness & training services.
- “Unclear expectations” (35%)  and “Limited support from the national authority” (22%) are among the top challenges faced by surveyed organisations when implementing the NIS Directive.
- 81% of the surveyed organisations have established a mechanism to report information security incidents to their national authority.
- 43% of surveyed organisations experienced information security incidents with a direct financial impact to up to €500k, while 15% experienced incidents with over half a million euro.
Leave a comment ,

CISA Issue Emergency Directive to Mitigate Compromise of Solarwinds Orion Network Management Products

Agency News, Cyber Security CII sector, Industry News
The Cybersecurity and Infrastructure Security Agency (CISA) has issued Emergency Directive 21-01, in response to a known compromise involving SolarWinds Orion products that are currently being exploited by malicious actors. This Emergency Directive calls on all federal civilian agencies to review their networks for indicators of compromise and disconnect or power down SolarWinds Orion products immediately.
“The compromise of SolarWinds’ Orion Network Management Products poses unacceptable risks to the security of federal networks,” said CISA Acting Director Brandon Wales. “This directive is intended to mitigate potential compromises within federal civilian networks, and we urge all our partners—in the public and private sectors—to assess their exposure to this compromise and to secure their networks against any exploitation.”
This is the fifth Emergency Directive issued by CISA under the authorities granted by Congress in the Cybersecurity Act of 2015. All agencies operating SolarWinds products should provide a completion report to CISA.
Leave a comment ,

ITU Forum addresses opportunities and challenges of 5G implementation in Europe

Industry News, Telecomms sector
“Just as 4G deployment was carried out across Europe with a strong focus on leaving no one behind, it is now our duty to ensure that an enabling regulatory environment sustains the deployment of 5G in a way that connectivity is leveraged by all and for all,” said Doreen Bogdan-Martin, Director of the Telecommunication Development Bureau at the ITU, as she welcomed participants of the ITU Regional Forum for Europe on 5G strategies, policies, and implementation.
The event was one of several milestones of the ITU Regional Initiative for Europe on broadband infrastructure, broadcasting and spectrum management.
Organized with the support of the Chancellery of The Prime Minister (KPRM) of the Republic of Poland, the Forum was opened by H.E. Mr. Marek Zagórski, Poland’s Secretary of State Government Plenipotentiary for Cybersecurity, who called for “connecting the unconnected” and “bridge the digital divide” as priorities in the context of Sustainable Development Goal (SDG) 10 on reducing inequality. Mr. Zagórski went on to highlight Poland’s achievements in the provision of high-quality connectivity towards an Internet Society by 2025, and called for the urgent need to address misinformation around 5G in Europe and beyond.
5G strategies and implementation dynamics
More than 50 speakers provided participants with a comprehensive overview of the status of 5G rollout, focusing on regional and national strategies and policies as well as other ongoing implementation challenges relevant to stakeholders in the Europe region.
The first day of proceedings saw context-setting interventions from the ITU Telecommunication Standardization Bureau (TSB) and the ITU Radiocommunication Bureau (BR), both of whom recognized excellent ITU cross-sectoral collaboration. Regional organizations and industry associations followed by discussing key priorities for the region, including the importance of international cooperation, industry collaboration, and regulation creating the necessary incentives for 5G deployment to deliver social and economic impact as well as the challenge of radiofrequency electromagnetic fields (RF-EMF).
Sessions 2 and 3 offered a detailed picture of the status of 5G implementation both in EU and non-EU countries. Administrations and National Regulatory Authorities recognized the importance of the transition to 5G converging towards the notion of “connecting everyone and everything” and reiterated how international cooperation must ensure a consistent deployment of 5G across the region, especially in context of the post-COVID economic recovery.
In his second day keynote, 2020 BEREC Vice-chair Jeremy Godfrey highlighted the importance of sustainability and resilience in the post-COVID-19 world.
From the 5G commercialization and market development perspective, industry representatives from satellite, mobile and equipment providers noted in Session 4 that efforts and expectations should be placed in the business-to-business (B2B) rather than in the business-to-customer (B2C) segment, and should focus on innovation-driven public-private partnerships as well as on the industrial IoT environment enabling emergence of 5G applications and ecosystems.
During the Forum’s final session on the challenge of increasing public concern about RF-EMF, it was widely agreed that the focus should shift from the scientific evidence, which is already there, to elaborating new strategies for 5G and EMF risk communication, as some countries have already undertaken.
New publications, upcoming priorities and next steps
In the context of the Forum, and to prioritize topics for future consideration at the regional level, the ITU Office for Europe announced the publication of two background papers.
One includes a series of country profiles on 5G implementation dynamics in 18 non-EU countries in the Region, featuring the implementation of 5G strategies, frequency allocation, EMF regulation as well as private sector trials and commercialization at the country level. The country profiles are designed to act as a reference for decision-makers and as a platform to monitor progress in reducing intra-regional gaps.
The other background paper on 5G and electromagnetic fields (EMFs) responds to concerns of administrations observed across Europe by referencing scientific evidence and recommendations as well as outlining key challenges and open questions, including misinformation and the social and economic cost for societies resulting from holding back 5G. The paper aims to support administrations in their efforts to elaborate communications on 5G at the national level.
The virtual meeting also hosted representatives of international and regional organizations such as the World Health Organization (WHO), International Commission on Non-Ionizing Radiation Protection (ICNIRP), the European Broadcasting Union (EBU), the Nordic Council of Ministers, Eastern Partnership Electronic Communications Regulators Network (EaPeReg), the Body of European Regulators for Electronic Communications (BEREC) and a number of National Regulatory Authorities and ICT Ministries from both EU and non-EU countries as well as important industry associations such as the European Telecommunication Network Operators’ Association (ETNO), the EMEA Satellite Operators Association (ESOA), the European Competitive Telecommunications Association (ECTA), DIGITALEUROPE, and GSMA.
3 comments , ,

New community benchmark on water infrastructure resilience released

Industry News, Water sector
The Alliance for National and Community Resilience (ANCR) released the third of its Community Resilience Benchmarks—the water benchmark, which addresses resilience of drinking water, wastewater and stormwater systems.
ANCR’s Community Resilience Benchmarks (CRBs) support communities in assessing their resilience and developing strategies for improvement. These benchmarks take a coordinated, holistic look at the people, services and processes that make communities work.
The water benchmark was developed by a committee of subject matter experts co-chaired by Andy Kricun, Managing Director at Moonshot Missions and Senior Fellow at the U.S. Water Alliance, and Jennifer Adams, an emergency management consultant. Committee members included representatives from the American Chemistry Council, American Water Works Association, Codes and Standards International, Denver Water, Ductile Iron Pipe Research Association, Dupont Water Solutions, McWane, New York City Department of Environmental Protection, North Carolina Department of Environmental Quality, and the U.S. Environmental Protection Agency.
“Water is such an essential aspect of communities. We’re grateful for the contributions made by committee members to help capture the policies and practices that support resilience in this sector,” said Evan Reis, Executive Director of the U.S. Resiliency Council and Chair of the ANCR Board of Directors.
“We look forward to working with communities to integrate the Community Resilience Benchmarks into their current resilience initiatives,” commented ANCR Executive Director Ryan Colker. “Not only does the Water Benchmark provide an excellent enhancement to the provisions contained the Buildings and Housing Benchmarks, but it also helps communities determine how their water systems and utilities contribute to their resilience goals to inform future investments that help protect residents and businesses from disaster.”
Communities are encouraged to pilot the benchmark and provide feedback to ANCR to support updates. For communities interested in piloting the water benchmark.
ANCR is a joint initiative of the International Code Council and the U.S. Resiliency Council that brings together representatives from the public and private sectors to advance a holistic approach to community resilience.
Leave a comment , ,

CISA Highlights Theft of FireEye Red Team Tools

Agency News, Cyber Security CII sector, Industry News

The Cybersecurity & Infrastructure Security Agency (CISA) has advised FireEye has released a blog addressing unauthorized access to their Red Team’s tools by a highly sophisticated threat actor. Red Team tools are often used by cybersecurity organizations to evaluate the security posture of enterprise systems. Although the Cybersecurity and Infrastructure Security Agency (CISA) has not received reporting of these tools being maliciously used to date, unauthorized third-party users could abuse these tools to take control of targeted systems. The exposed tools do not contain zero-day exploits.

CISA recommends cybersecurity practitioners review FireEye’s two blog posts for more information and FireEye’s GitHub repository for detection countermeasures:

Leave a comment ,
1 … 37 38 39 40 41 … 48