January 26, 2021
Good morning, everyone!
|This week’s critical vulnerabilities:
Patch all the things!!
An Ounce of Prevention is Worth a Pound of Cure
ZDNet recently reported a new trend in ransomware:
Ransomware attacks are proving more lucrative for cyber criminals as even organisations that can restore from backups are paying ransom demands to prevent further damage.
This started about a year ago with the Maze ransomware gang, but now 18 gangs are known to start publishing data if ransom isn’t paid. This is seriously bad. In the beginning, ransomware attackers just encrypted your data. Now they steal a copy first, then encrypt your copy. If you don’t pay up, they start releasing data to the public.
I know you've heard (and many of you have heard me say) "an ounce of prevention is worth a pound of cure" – right? How do you prevent becoming the victim of a ransomware attack? Back to Basics! Good cyber hygiene and quality employee training.
CISA warns that cloud attacks are on the rise
Last week, the US Cybersecurity and Infrastructure Security Agency (CISA) put out a warning that cyber criminals are taking advantage of the rush to remote working, and have ramped up their attacks on cloud services – successfully.
The federal agency states that much of the risk stems from remote workers using insecure devices to access the cloud.
(smacking forehead) Remember my “3 free ways to protect yourself online” from a couple months ago? Now is a good time to refresh your memory, and to remind all your employees as well. Basic cyber hygiene is neither difficult nor expensive, and yet it can prevent a LOT of different types of attacks.
You can’t secure it if you don’t know it’s there
Y'all have heard me say this before, but I cannot stress enough how important it is to have accurate information about what you have on your network (and elsewhere in your facilities, for that matter). This recent tweet from well-known infosec professional Lesley Carhart caught my eye:
Weeks into formal and informal response to Solarwinds Orion IR, and the biggest hurdle to IR I am still seeking is that organizations do not know if they have *found* all of their Solarwinds Orion installations, and what versions they are actually running.”
Seriously? Yes, seriously. Organizations both large and small have this problem. We find previously-unknown devices on networks all the time. That’s why “Inventory of hardware” and “Inventory of software” are literally #1 and #2 on the 20 CIS Controls (which I discussed in my August 18 newsletter … and which I’ll be talking about on Thursday)!
The Alabama Small Business Development Center Network has sponsored a series of free webinars for small businesses, the Small Business Survival Series. I will be the final speaker, talking about basic cyber hygiene. There is still time to sign up! Visit http://asbdc.org/survival-series/
And that’s a wrap for this week!
Talk to you again soon!
Security Awareness Training Goes Virtual
Thanks to COVID-19, lots of things are going virtual, and that includes my employee Security Awareness Training. I've set up a small studio in our conference room (nobody there but me) so I can provide live training (almost) just like before! You can see me wave my hands and make faces while a wall of fascinating facts and practical tips slideshow across your screens, wherever you and your employees may be.
Contact me to schedule your employee training sessions. They're fun! ☺