Michael Kan

In court filings posted Friday NSO Group says all high-ranking military and govt are appropriate Pegasus targets and appears to say minority oppositions should be treated the same as majority politicians in terms of targeting, a noteworthy statement in light of what is unfolding in Poland. Key sections of the story are below. *********** The manufacturers of the powerful commercial spyware Pegasus argued in a Friday court filing that it is appropriate for its global clients to target any high-ranking government or military official with the technology because their jobs categorically make them “legitimate intelligence targets.” The statement is a revelatory admission from the typically tight-lipped Pegasus manufacturer, NSO Group, regarding who it believes can justifiably be targeted with its zero-click and all-seeing surveillance product. It surfaced in court documents related to a lawsuit WhatsApp has brought against NSO Group for allegedly infecting about 1,400 of its users’ devices with the technology. The hacks were discovered in 2019..... NSO says the list of individuals Citizen Lab classified as VIPs includes 93 people the company describes as “high-ranking government or military officials.” “The VIP list is almost entirely comprised of persons who, by virtue of their positions in government or military organizations, are the subject of legitimate intelligence investigations,” an attorney for NSO Group wrote in the filing. “All the VIPs are legitimate intelligence targets.”.... NSO Group also appeared to suggest in court filings that opposition politicians can be legitimately surveilled with Pegasus. This assertion comes as Polish officials investigate what they have described as a Pegasus-enabled coordinated campaign by the country’s former majority to track hundreds of opposition party politicians and those aligned with them. “Citizen Lab appears to have drawn a distinction between politicians whose parties are in power (VIPs) versus politicians belonging to opposition parties (civil society),” the NSO Group lawyer wrote. “For purposes of determining whether an individual was legitimately surveilled (eg, as part of an intelligence operation) using Pegasus, defendants submit that this distinction is unjustified and all senior political operatives should be classified as VIPs.” Poland is far from the only country where Pegasus has targeted minority party officials and civil society leaders. In 2022, Citizen Lab published a report documenting that Pegasus was used to target at least 63 Catalan government officials and activists following a 2017 bid for independence.

13

4 Comments

The U.S. National Security Agency (NSA) published on Wednesday a cybersecurity information sheet (CSI) to help organizations secure applications from unauthorized users and ensure continuous visibility of the workload at any given time. The document provides recommendations for achieving progressive levels of application and workload capabilities under the ‘never trust, always verify’ #ZeroTrust (ZT) paradigm. It discusses how these capabilities integrate into a comprehensive ZT framework. ZT implementation efforts are intended to continually mature #cybersecurity protections, responses, and operations over time. Titled ‘Advancing Zero Trust Maturity Throughout the Application and Workload Pillar,’ the guidance outlined that granular #accesscontrols and integrated #threatprotections can offer enhanced situational awareness and mitigate application-specific threats. The application and workload pillar depends on various capabilities, including application inventory; secure software development and integration; software #riskmanagement; resource authorization and integration; and continuous monitoring and ongoing authorizations. https://lnkd.in/gk2k3ha2

13

1 Comment

The U.S. National Security Agency (NSA) published a Cybersecurity Information Sheet (CSI) that details the infrastructure, tools, data, and techniques of this cornerstone pillar of the #ZeroTrust (ZT) framework. Organizations are urged to utilize the guidance in the report to systematically mitigate risks and rapidly identify, detect, and respond to emerging #cyberthreats. The document offers guidance under the United States Department of Defense (DoD) ZT RA maturity scale of preparation, baseline, intermediate, and advanced. It also complements the ZT Portfolio Management Office (PfMO) guidance of ‘target’ and ‘advanced’ levels. Titled ‘Advancing Zero Trust Maturity Throughout the Visibility and Analytics Pillar,’ the guidance follows the May 22 release of the CSI, ‘Advancing Zero Trust Maturity Throughout the Application and Workload Pillar,’ and expands on NSA’s previously released CSIs on zero trust. The capabilities described in this CSI are intended to continually mature #cybersecurity protections, responses, and operations over time. Progression of capabilities in each of the ZT framework’s seven pillars should be seen as a cycle of continuous improvement based on evaluation and monitoring of threats. https://lnkd.in/gv2rzSX2

35

1 Comment

The U.S. National Security Agency (NSA) released a Cybersecurity Information Sheet (CSI) on Monday, offering guidance on enhancing the security of #AIsystems. This initiative introduces a fresh set of best practices to assist organizations in bolstering their #security measures. The aim is to aid National Security System (NSS) owners and Defense Industrial Base (DIB) companies as they prepare to deploy and manage AI systems created by external entities. Titled, ‘Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems,’ the document is the initial release from the NSA’s Artificial Intelligence Security Center (AISC), in partnership with the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security, the New Zealand National Cyber Security Centre (NCSC-NZ), and United Kingdom National Cyber Security Centre (NCSC-UK). Targeted at organizations deploying and operating AI systems designed and developed by another entity, these best practices may not apply to all environments, so the mitigations should be adapted to specific use cases and threat profiles. https://lnkd.in/gFg2vD4c

28

1 Comment

Researchers at Forescout Technologies Inc.‘s #VedereLabs discovered 90,000 unknown vulnerabilities and risk blind spots in standard vulnerability guidance. These vulnerabilities, not included in the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities (KEV) catalog, pose potential risks that cyber adversaries could exploit. The analysis also revealed inconsistencies in scoring vulnerabilities across databases, a process typically conducted using CVSS scores within the CVE ecosystem. The data indicates that the most exploited #OT and #IoT devices include network attached storage (NAS) at 21 percent, IP cameras at 17 percent, building automation devices at 12 percent, and VoIP equipment at 11 percent. “Vulnerabilities are being found, weaponized, and exploited in the wild faster than ever before, with 97 0-days exploited in 2023 and already 27 this year,” Elisa Costante, vice president of research at Forescout Technologies Inc. Research – Vedere Labs, said in a media statement. “Current methodologies for cataloging issues such as MITRE’s Common Vulnerabilities and Exposures (CVE) system and NIST’s National Vulnerability Database (NVD) are critical tools but have significant limitations." https://lnkd.in/gKgVyBEx

11

New FRTalks by Christina Catenacci: Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act https://lnkd.in/gzZ26nWj via @firstreference #internalcontrols #business #cybersecurity #security #privacy #management #risk #riskmanagement #internalcontrol #law #legal #cdnlaw #internetlaw #government #governance #Informationtechnology #PublicSector

4

New Post: #CISA and @FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory #Traversal Vulnerabilities - https://lnkd.in/dAir6seU CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities 05/02/2024 02:00 PM EDT Today, CISA and the Federal Bureau of Investigation (FBI) released a joint Secure by Design Alert, Eliminating Directory Traversal Vulnerabilities in Software. This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708, CVE-2024-20345) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector. Additionally, this Alert highlights the prevalence, and continued threat actor exploitation of, directory traversal defects. Currently, CISA has listed 55 directory traversal vulnerabilities in our Known Exploited Vulnerabilities (KEV) catalog. Approaches to avoid directory traversal vulnerabilities are known, yet threat actors continue to exploit these vulnerabilities which have impacted the operation of critical services, including hospital and school operations. CISA and the FBI urge software manufacturer executives to require their organizations to conduct formal testing to determine their products’ susceptibility to directory traversal vulnerabilities. For more information on recommended principles and best practices to achieve this goal, visit CISA’s Secure by Design page. To catch up on the publications in this series, visit Secure by Design Alerts. Robert Williams#News247WorldPress

1

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) facilitated the federal government’s inaugural #tabletopexercise with the private sector, focused on crafting effective, coordinated responses to AI security incidents. Held at Microsoft Corp.’s facility in Reston, Virginia, the exercise gathered over 50 AI (artificial intelligence) experts from various government agencies and industries. The simulation supports the creation of an AI Security Incident Collaboration Playbook led by JCDC.AI—a specialized division within the Joint Cyber Defense Collaborative (JCDC) that aims to foster an operational community among AI providers, AI security vendors, and key infrastructure stakeholders. Participants included Amazon Web Services (AWS), Cisco, Cranium, HiddenLayer, IBM, Microsoft, NVIDIA, OpenAI, Palantir Technologies, Palo Alto Networks, Protect AI, Robust Intelligence, Scale AI, Federal Bureau of Investigation (FBI), National Security Agency (NSA), Office of the Director of National Intelligence (ODNI), United States Department of Defense (DOD), and U.S. Department of Justice (DoJ), and other technology firms. #AISecurity #ArtificialIntelligence https://lnkd.in/gVGH99VG

29

The Cybersecurity and Infrastructure Security Agency launches 'vulnrichment' program to address NVD challenges Almost 3 months after the National Institute of Standards and Technology (NIST)'s National Vulnerability Database started facing challenges in vulnerability enrichment, CISA announced it was starting a new software vulnerability enrichment program called ‘Vulnrichment.’ Designed to fill the NVD's vulnerability enrichment backlog, the program will will focus on adding metadata to CVEs, including: ✳️ Common Platform Enumeration (CPE) numbers ✳️ Common Vulnerability Scoring System (CVSS) scores ✳️ Common Weakness Enumeration (CWE) nametags ✳️ Known Exploited Vulnerabilities (KEV) entries According to its own data, NIST has analyzed only 4523 of the 14,228 CVEs received so far this year. 📰 Read my story here: https://lnkd.in/dRNmUX4x ------ 🔙 Read more about the NVD backlog of vulnerability analysis: ▪️ NIST National Vulnerability Database Disruption Sees CVE Enrichment on Hold: https://lnkd.in/dr8WC-9H ▪️ NIST Unveils New Consortium to Operate National Vulnerability Database: https://lnkd.in/eQtJ2r9B ▪️ Cybersecurity Pros Urge US Congress to Help NIST Restore NVD Operation: https://lnkd.in/ebTYDp-3 💡 Learn more about vulnerability management: ▪️ Navigating the Vulnerability Maze: Understanding CVE, CWE, and CVSS: https://lnkd.in/d2uEWVq6 --- #NVD #NIST #CVE #CPE #CWE #CVSS #KEV #CISA #MITRE #CNA #vulnerability #softwarevulnerability #vulnerabilitydisclosure #vulnerabilitymanagement

56

2 Comments

Join the discussion on Crowdcast (https://lnkd.in/gZekwqtQ) "Hacking Your Cybersecurity Career"

12

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

NVD Leaves Exploited Vulnerabilities Unchecked 📆 It has now been over 1️⃣0️⃣0️⃣ days since the National Institute of Standards and Technology (NIST) started facing challenges enriching software vulnerabilities. In a new report, VulnCheck found that 30 out of 59 known exploited vulnerabilities (KEVs) registered since February 12 have not yet been analyzed by the NVD team. ⚠️ In total, 50.8% of KEVs are missing critical metadata. 📊 Also in the report: ▪️ 55.9% of weaponized vulnerabilities have not been analyzed by the NVD since February 12 ▪️ 82% of vulnerabilities with a proof-of-concept exploit have not been analyzed by the NVD since February 12 ▪️ 93.4% of all vulnerabilities have not been analyzed by the NVD since February 12 📰 Read my full story here: https://lnkd.in/eqsBrk89 #NVD #NIST #CVE #CVEs #KEV #KEVs #CWE #CPE #CVSS #MITRE #CISA #Vulnrichment #pURL #CNA #vulnerability #enrichment #patch #exploit

39

3 Comments

Read our new publication on the People's Republic of China's (PRC) Taiwan cyber strategy. The report shows how the PRC integrates cyber power into its plans to isolate and weaken Taiwan in political, military, and economic spheres.

1

Constantly evolve your policies regarding your email authentication and your email setup. (The adversaries definitely are) Setting up DMARC to p=none while you are ensuring that you have properly configured all of your SPF and DKIM is something that companies have to do when trying to wrangle in their email infrastructure. But remember it does not stop there..... strive for a world where you are p=reject. (I know quarantine exists but really if DMARC fails throw it back at them). Be careful out there. Oh and read the advisory.

10

1 Comment

Following up on its request for information (RFI) on cybersecurity regulatory harmonization and regulatory reciprocity, the Office of the National Cyber Director, The White House (ONCD) released a summary on Tuesday of the 86 responses received and the key findings. These came from representatives of 11 out of 16 #criticalinfrastructure sectors, alongside trade associations, nonprofits, and research bodies. Collectively, these respondents, many of whom are membership organizations, represent more than 15,000 businesses, state entities, and other organizations. Three key findings from the responses include that lack of #harmonization and #reciprocity harms cybersecurity outcomes while increasing compliance costs through additional administrative burdens. Many respondents noted that compliance spending drew resources from cybersecurity programs. It also found that challenges with #cybersecurity regulatory harmonization and reciprocity extend to businesses of all sectors and sizes and that they cross jurisdictional boundaries. Respondents highlighted inconsistent or duplicative requirements across international and state regulatory regimes. https://lnkd.in/gJjV_KKW

12

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published Tuesday an #ICS (industrial control systems) advisory with timely information about current security issues, #vulnerabilities, and exploits surrounding ICS. The agency informed the sector of a path traversal vulnerability across all RAD DATA COMMUNICATIONS LIMITED #SecFlow-2 equipment versions. Deployed across the #communications sector, CISA identified in its advisory that “Successful exploitation of this vulnerability could allow an attacker to obtain files from the operating system by crafting a special request.” #ICSCyber #ICSCybersceurity #OTCyber #OTCybersecurity #Industrialcontrol #Controlsystem #Criticalinfrastructure https://lnkd.in/g2jPeadZ

27