This Week in Security News – September 10, 2021 VP, Threat Intelligence
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, read about Biden’s partnership initiative to develop a new cybersecurity framework. Also, learn about the US’s new draft zero trust strategy.
Read on:
Biden Announces Cybersecurity Initiative Partnership
Biden’s announcement marks the US’s extensive collaboration with various private and education sector leaders to address the rising cyber threats in the country. The White House announced that the National Institute of Standards and Technology (NIST) would work with industry and other partners to develop a new framework, enhancing the security and integrity of the technology supply chain.
US Gov Seeks Public Feedback on Draft Federal Zero Trust Strategy
The U.S. government’s Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) announced they are seeking public feedback on draft zero-trust strategic and technical documentation. The draft strategy clarifies zero trust priorities for civilian agencies’ enterprise security architecture to be changed based on zero trust principles.
AT&T, GM Make 5G Connected Car Deal
The collaboration aims to enhance various features on GM’s connected cars, with the hope of having millions of vehicles with 5G connectivity on the road by 2024. Over the next decade, GM and AT&T hope to have millions of GM vehicles with 5G connectivity. However, before this happens, both companies plan to ensure there is backbone connectivity that can support GM’s plan for next-gen connected cars—and even autonomous vehicles.
‘Azurescape’ Kubernetes Attack Allows Cross-Container Cloud Compromise
A critical security vulnerability allowing attackers to perform cross-account container takeover in Microsoft’s public cloud, dubbed “Azurescape”, has been uncovered by researchers. The issue exists in Azure Container Instances (ACI), which is Microsoft’s container-as-a-service (CaaS) offering.
Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability (designated as CVE-2021-40444) is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger.
Hackers Leak VPN Account Passwords From 87,000 Fortinet FortiGate Devices
Network security solutions provider Fortinet confirmed that a malicious actor had unauthorizedly disclosed VPN login names and passwords associated with 87,000 FortiGate SSL-VPN devices. The disclosure comes after the threat actor leaked a list of Fortinet credentials for free on a new Russian-speaking forum called RAMP that launched in July 2021 as well as on Groove ransomware’s data leak site.
Analyzing SSL/TLS Certificates Used by Malware
In the past six years Trend Micro has seen both commodity and targeted attack malware make heavy use of encryption. This is done to evade detection as well as to blend in with normal encrypted traffic. Trend Micro’s technical brief, The State of SSL/TLS Certificate Usage in Malware C&C Communications, goes over the certificates used by various malware families.
91% of IT Teams Have Felt ‘Forced’ to Trade Security for Business Operations
A new survey suggests that the majority of IT staff have felt pressured to ignore security concerns in favor of business operations. In total, 91% of respondents said that they have felt “pressured” to compromise security due to the need for business continuity during the COVID-19 pandemic. 76% of respondents said that security had taken a backseat, and furthermore, 83% believe that working from home has created a “ticking time bomb” for corporate security incidents.
After a summer marked by big ransomware attacks from suspected Russian gangs, some of those same groups went quiet. National Cyber Director Chris Inglis said this week that it’s too early to tell if the trend will hold.
What do you think about the US government’s Zero Trust strategy? Share in the comments below or follow me on Twitter to continue the conversation: @JonLClay.
Read More HERE
