January 26, 2021

Good morning, everyone!

This week’s critical vulnerabilities: SonicWall released an urgent security notice on its NetExtender VPN Client 10.x, SMA 100 Series products. Windows RDP servers are being used to amplify DDoS attacks Network operators are urged to move RDP servers that provide remote access via UDP behind VPN concentrators; if that is not possible, then RDP via UDP/3389 should be disabled. Amazon has fixed severe flaws in Kindle devices that could have allowed attackers to spend money using the credit card on file for book purchases. You need to install the update. Patch all the things!!

An Ounce of Prevention is Worth a Pound of Cure

ZDNet recently reported a new trend in ransomware:

Ransomware attacks are proving more lucrative for cyber criminals as even organisations that can restore from backups are paying ransom demands to prevent further damage.

This started about a year ago with the Maze ransomware gang, but now 18 gangs are known to start publishing data if ransom isn’t paid. This is seriously bad. In the beginning, ransomware attackers just encrypted your data. Now they steal a copy first, then encrypt your copy. If you don’t pay up, they start releasing data to the public.

I know you've heard (and many of you have heard me say) "an ounce of prevention is worth a pound of cure" – right? How do you prevent becoming the victim of a ransomware attack? Back to Basics! Good cyber hygiene and quality employee training.

CISA warns that cloud attacks are on the rise

Last week, the US Cybersecurity and Infrastructure Security Agency (CISA) put out a warning that cyber criminals are taking advantage of the rush to remote working, and have ramped up their attacks on cloud services – successfully.

The federal agency states that much of the risk stems from remote workers using insecure devices to access the cloud.

(smacking forehead) Remember my “3 free ways to protect yourself online” from a couple months ago? Now is a good time to refresh your memory, and to remind all your employees as well. Basic cyber hygiene is neither difficult nor expensive, and yet it can prevent a LOT of different types of attacks.

You can’t secure it if you don’t know it’s there

Y'all have heard me say this before, but I cannot stress enough how important it is to have accurate information about what you have on your network (and elsewhere in your facilities, for that matter). This recent tweet from well-known infosec professional Lesley Carhart caught my eye:

Weeks into formal and informal response to Solarwinds Orion IR, and the biggest hurdle to IR I am still seeking is that organizations do not know if they have *found* all of their Solarwinds Orion installations, and what versions they are actually running.”

Seriously? Yes, seriously. Organizations both large and small have this problem. We find previously-unknown devices on networks all the time. That’s why “Inventory of hardware” and “Inventory of software” are literally #1 and #2 on the 20 CIS Controls (which I discussed in my August 18 newsletter … and which I’ll be talking about on Thursday)!

The Alabama Small Business Development Center Network has sponsored a series of free webinars for small businesses, the Small Business Survival Series. I will be the final speaker, talking about basic cyber hygiene. There is still time to sign up! Visit http://asbdc.org/survival-series/

And that’s a wrap for this week!

Remember, you can read past editions of this newsletter on our website, along with tons more information under the Resources tab.

Talk to you again soon!

Glenda R. Snodgrass
grs@theneteffect.com
(251) 433-0196 x107
https://www.theneteffect.com
For information security news & tips, follow me!

Security Awareness Training Goes Virtual

Thanks to COVID-19, lots of things are going virtual, and that includes my employee Security Awareness Training. I've set up a small studio in our conference room (nobody there but me) so I can provide live training (almost) just like before! You can see me wave my hands and make faces while a wall of fascinating facts and practical tips slideshow across your screens, wherever you and your employees may be.

Contact me to schedule your employee training sessions. They're fun! ☺