One of the most frustrating things is to sit in on a C-Suite meeting and hear the lofty strategic goals presented for the company and for cybersecurity only to have them torn to pieces when you explain what those goals will actually take and cost. The sticker shock that comes from understanding the moving pieces of a “Risk Intolerant” stance can be amusing, but in the end, it is more of an annoyance than anything. So, with that in mind I am going to discuss how to turn breakdown strategic goals into realistic tactical and logistical steps. I will not be focusing on anything specific but will follow some common guidelines and practices that can help bride the gap between ideals and reality It might also help inform future strategic statements by understanding the moving pieces involved in making them.

One of the most commonly asked questions in cybersecurity is “where do I start?” This common question shows just how overwhelmed many organizations are when faced with the reality of the threats that are out there. From ransomware to business email compromise, the threat actors certainly seem to be ahead of the implementations when it comes to securing the data that organizations are responsible for. So where should an organization start when it comes to building or optimizing their cybersecurity program?

Last week Microsoft, the FBI, and CISA made disclosed several attacks on Federal Civilian Executive Branch agencies and other targets of a campaign that appeared to be driven by a new threat group out of China. The attack we detected and tracked down using internal logging available to the GCC low-side tenants and with the help of Microsoft. Fortunately, GCC (Government Cloud Computing) Low Side is not supposed to contain or pass any classified information. It is intended to be used by government agencies and contractors that do not need or have authorization to access anything more than routine sensitive information. This does not reduce the seriousness of the attack and does beg the question on how well the tenants were secured by the cybersecurity teams involved, but at least nothing National Security related was compromised.

The UEFI (Unified Extensible Framework Interface) was the replacement for the old BIOS (Basic Input Output System). It was intended as an improvement to the underlying systems on a motherboard (also called mainboard) the motherboard controls communication between all components connected to it from CPUs, to memory, to GPUs, disk or solid-state drives, network cards… you get the picture. The old BIOS was limited and also susceptible to compromise in a number of rather simple ways. By moving to UEFI systems could become more complex without issues potential hardware conflicts, the UEFI structure was also much faster than the BIOS system meaning that as overall computing increased in speed the underlying controls for different components was up to the task.

It seems that an unnamed FCEB agency had their Outlook Web Access (Exchange Online) environment compromised by a new threat group that is current being attributed to China. The attack and the group were disclosed by CISA and the FBI. With the detection of the FCEB email compromise, Microsoft also identified a much larger espionage campaign involving the newly identified group which includes some 20+ organizations. The timing of the attack is concerning due to it coinciding with a recent NATO meeting.

If I have said it once, I have said it a thousand times; attackers are cunning. The adage that attackers are lazy has nothing to do with strategic, tactical, or technical knowledge. They understand the landscape and, in many cases, better than the organizations they are attacking do. Because of this deep understanding of their target environment, they also know to be on the lookout for special purpose entities. In this case we are talking about Security Researchers. Security researchers are a special target for attackers and when they can leverage an existing opportunity to target and potentially compromise them, they are going to take it.

Diver Signing requirements in Windows is a feature that is intended to help prevent the Windows Operating system from being compromised through malicious software posing as legitimate drivers. The policy was implemented way back in early versions of the 64-bit flavor of Windows XP and became a defacto security policy very quickly after that. Since its implementation and enforcement threat groups have found multiple ways around this policy including the use of compromised certificate issuing groups, purchasing actually legitimate certificates, and certificate theft.

It seems the Judge in the case involving the FTC, Microsoft and Activision Blizzard thinks that the FTC failed to reach a sufficient threshold to prove harm in a request for a preliminary injunction. To some this is cause for celebration although most people who have followed Microsoft’s history of anti-competitive behavior, in any market they play in, will know this is not a good thing. What makes this decision even more suspect is the fact that the judge precising over the case, U.S. District Judge Jacqueline Scott Corley, has a direct family member working at Microsoft.

Social engineering efforts via voice calls (Vishing) is nothing new. The use of phone calls for malicious activity is pretty old and include such popular scams as extended car warranties, IRS collection attempts, and the ever popular “there is a complaint against you”. These are just a few of the consumer scams that have been in play and are still in play. On the corporate side there are even more which target general employees and support personnel to either gain entry or enable some form of financial fraud. Sadly, this pivot is also seriously under managed by most organizations, with few providing any preventative training and most not testing this attack vector to determine exposure.

Last week Progress Software, the company behind MOVEit file transfer software, announced another SQL injection flaw had been identified and patched. This flaw is just the latest in a series of vulnerabilities that have been identified in the application after the Cl0p ransomware group was found to have exploited a different SQL injection flaw to steal data from multiple MOVEit users. The attacks started in late 2022, but the Cl0p group might have been testing different entry points as far back as June 2022.