Cloud Hosting

The Office of Inspector General (OIG) says the Cybersecurity and Infrastructure Security Agency (CISA) made limited progress improving the overall quality of threat information but has addressed basic information sharing requirements.

OIG recently published the findings of its evaluation of CISAs progress in meeting the Cybersecurity Act of 2015s requirements for 2019 and 2020. The Act requires the Department of Homeland Security (DHS) to establish a capability and process for Federal entities to receive cyber threat information from non-Federal entities. The Act also requires Inspectors General from the Intelligence Community and appropriate agencies to submit a joint report to Congress every two years on Federal Government actions to share cyber threat information.

CISA created an Automated Indicator Sharing (AIS) capability in 2016 to enable the real-time exchange of unclassified cyber threat information and defensive measures to participants of the AIS community. According to OIG, in 2019 and 2020 CISA continued to leverage its AIS capability to share cyber threat information between the Federal Government and the private sector. During that time, CISA reportedly increased the number of Federal participants by more than 15 percent and increased the number of non-Federal participants by 13 percent. CISA asserted it increased the overall number of cyber threat indicators it shared and received by more than 162 percent, but it could not validate this number.

OIG determined that the quality of information shared with AIS participants was not always adequate to identify and mitigate cyber threats.

Cyber threat information must contain enough contextual information to help decision makers take necessary and appropriate actions. Examples of contextual information may include Internet Protocol addresses, domain names, hash files, uniform resource locators, or anomalies in the network traffic. Real-time access to the right information is critical for mitigating risks. For example, recent sharing of cyber threat indicators, including malware information, related to the 2021 SolarWinds Orion supply chain compromise led CISA and the Department of Defense Cyber National Mission Force to analyze these malware variants and trace their origins to prevent future cyber incidents.

However, according to the Federal and private sector entities the watchdog interviewed, most of the cyber threat indicators did not contain enough contextual information to help decision makers take action.

Stakeholders also stated that the cyber threat indicators contained false positives, which could mislead entities into believing threats were malicious, resulting in unnecessary upgrades or security protocols. Federal agency officials also noted that some participants had shared unconfirmed malware cyber threat indicator information, or low confidence threat information, that resulted in false positive alerting within security tools. Additionally, private sector feedback identified concerns with AIS customers experiencing false positives from the AIS Public Feed that were later identified as known good indicators. CISA responded to this by improving the AIS allow list to ensure that these types of known good indicators are not distributed via AIS to stakeholders. Federal stakeholders can filter out some of these lower confidence indicators while others may not have the expertise or intermediate tools to further refine relevant cyber threat indicators and defensive measures.

OIG has attributed the shortcomings to limited AIS functionality, inadequate staffing, and external factors challenges it previously reported on in its Cybersecurity Act evaluation for 2017 and 2018.

Following this most recent evaluation, OIG made four recommendations to CISA: improve information quality by increasing participants sharing of cyber information, complete AIS upgrades, conduct additional training and outreach, and hire the staff needed to improve the AIS programs operational effectiveness.

DHS concurred and reminded OIG that since the watchdogs fieldwork CISAs Cybersecurity Division launched its next generation version of AIS, AIS 2.0, which created the capability to apply a CISA opinion score to cyber threat indicators. This score provides an assessment of whether the information can be corroborated with other sources available to the entity submitting the opinion to AIS. AIS 2.0 addresses some of the weaknesses found in OIGs evaluation. In addition, DHS told OIG that during the past 18 months, CISAs Cybersecurity Division has added additional contractual resources to better support its efforts and is also assessing a longer-term approach to allocate resources to fully support the cyber risk mission area.

Read the full report at OIG

Follow this link:
OIG Wants More Progress from CISA on Cyber Threat Information Sharing - HS Today - HSToday

Spam is unavoidable: It clutters your phone call history and chokes your email inbox. Like spam, scareware is another annoyance that seems to go hand-in-hand with internet access. Its why you should never click pop-ups that say your system is at risk.

Most cybersecurity experts say scareware has been around since 1990 when programmer Patrick Evans designed a program called NightMare to attack computers. A creepy image of a bloody skull took over victims screens and an echoing shriek assaulted the ears.

The aptly-named NightMare set a disturbing precedent. Cybercriminals have since used scareware to wrestle millions of dollars from unsuspecting victims. In this article, youll learn how to prevent falling victim to scareware.

Picture this: Youre surfing the web, minding your own business. Then a random pop-up says your computer has a virus. It looks legitimate, with a technical design similar to that of Apple or another trustworthy brand.

Since it looks like it came from a reliable source, you fall for the pop-ups claims. You immediately feel stressed out. After all, your whole system could be in danger.

Privacy, security, the latest trends and the info you need to live your best digital life.

Most scareware pop-ups urge you to click it or else.

For example, theyll say to click here to remove the viruses. Since you dont want your device infected with malware, you might do what the pop-up asks. Unfortunately, clicking on the link will download viruses onto your device.

Thats right: You didnt have any viruses on your phone or computer. The pop-up was lying. Cybercriminals manipulated your emotions so they could scare you into action.

Famous scareware attacks came in many different forms. You can encounter these nasty scams on your phone, tablet or computer. This is why you need antivirus protection on all your devices. Heres how to set up cybersecurity programs on your iPhone or Android.

Here are some scareware attack examples you may have heard of:

As you can tell, scareware social engineering schemes are incredibly dangerous. They can steal a ton of money. Now that you know some scareware history, lets move on to the more critical part. How to prevent it.

Not sure how to spot a scareware scam? First, ask yourself if the pop-up is hard to close. Scammers make it difficult for you to shut down the box, so even if you hit X or close, it might not disappear immediately.

You might also see icons you cant click on. Thats because scareware designers will spoof icons from reputable companies. Theyre mooching off those companies good reputations to trick you into thinking they work together.

So if you cant click through to the sites, take that as a red flag. Of course, the best way to protect yourself from scareware is to protect your device with robust and up-to-date antivirus software. Kim recommends our sponsor, TotalAV.

TotalAVs industry-leading security suite is easy to use and offers the best protection in the business. In fact, its received the renowned VB100 award for detecting more than 99% of malware samples over the last three years.

Not only do you get continuous protection from the latest threats, but its AI-driven Web Shield browser extension blocks dangerous websites automatically, and its Junk Cleaner can help you quickly clear out your old files.

Right now, get an annual plan of TotalAV Internet Security for only $19 at ProtectWithKim.com. Thats over 85% off the regular price.

Smishing is spreading How to spot it

5 types of cybersecurity threats you should know about

Best free Windows and Mac security downloads for your computer

More:
Scareware: One of the scariest cybersecurity attacks in 2022 - Komando

Russia has long been regarded as notorious for international cyber threats, and this has only accelerated during 2022, as Ukraine has received an onslaught of online attacks ahead of a physical invasion.

In todays geopolitical climate, however, theres more than one nation state player where cyber threats will emerge.

Ultimately, for Western Five Eyes organisations those in the UK, US, Australia, Canada, and New Zealand the state actors most likely deemed as threats are Russia, China, Iran and North Korea.

Whilst we often focus on the individual capabilities of states themselves, we should be reminded that many criminal organisations carry out attacks either on behalf of nation states or under the protection of them.

The aims of these malicious actors are wide-ranging from the theft of intellectual property, intelligence gathering or even the disruption of another nations critical infrastructure.

But the bottom line is they will be looking to gain an upper hand, whether to develop technology, increase their countrys financial leverage or disrupt another nations means of defending itself.

Where cyber criminal organisations are used, their aim is almost always to profit financially but a nation state may specify the targets theyll turn a blind eye to, or which should be a priority. In some cases where there are economic sanctions on the nation state, they may also demand some of the profit be redistributed to the state itself.

Whilst we often talk about large-scale cyber attacks against critical national infrastructure, we shouldnt ignore one of the most common aims of nation states in the past few years to spread misinformation.

This has recently been demonstrated as a means of disrupting the democratic process in a way that favours that state, or once again enables them to profit financially.

These types of attacks are much harder to measure in terms of the scale and impact

These types of attacks are much harder to measure in terms of the scale and impact, but we cant overlook the potential influence these assaults have had on the world over the last several years.

Large organisations considered critical national infrastructure are at risk of being targeted by state actors (often referred to as advanced persistent threats) but, as seen in recent years, any organisation can be a victim of a nation state attack even if they arent targeted.

It may be that they become collateral damage after being vulnerable to a particular attack vector that the state is using, or that part of their supply chain has been compromised.

The proliferation of tools used by criminal groups will have a big impact, not just as a result of professional attacks, but due to smaller and less skilled hackers having more accessibility to the same methods. As such, the number of organisations that might be attacked will increase.

It should be made clear theres no single biggest threat in terms of the nation state because the landscape, objectives and capabilities of each actor change so quickly.

Focusing on one single nation state when its far more likely to be attacked by a criminal organisation will only create a false sense of security. Organisations must assess their own risk against the main threat actors and, in calculating the threats, they can prioritise defences against them accordingly.

Enabling protections such as firewalls and endpoint security are key for all organisations to maintain

Getting the basics right will go a long way in creating a foundation of cyber threat protection, no matter whether thats an attack from criminals or a state. The strategy should ensure that security and IT teams patch regularly alongside good identity and password management, and configuration of endpoints and networks against best practices. Enabling protections such as firewalls and endpoint security are also key for all organisations to maintain.

Additionally, ensuring your organisation can react quickly and sensibly if its compromised is essential. This means its important to have good backups that have been tested and are resilient to malware such as ransomware, as well as implementing good incident response and crisis management procedures.

Looking ahead at the cyber threat landscape, we should expect to experience more of the same as this approach has proved highly successful. Theres no need for a nation state to reveal their capabilities, or use a capability that once revealed can no longer be used if they can continue to impact other nations by proxy through criminal cyber organisations.

Instead, they focus their attacks on things that are less obvious gaining persistent access to an organisations networks to gather intelligence or steal intellectual property for example.

Weve seen a recent increase in supply chain attacks and thats likely to increase as more organisations seek to benefit from larger offerings, whether that be software or services, as the impact of compromising a single organisation can have a much wider impact.

In particular, weve seen an increase in attacks against vulnerable infrastructure such as routers and other internet-facing infrastructure that havent been maintained or are effectively end of life. Whilst many organisations have vulnerable internet-facing infrastructure or networks that are insecure once an attacker achieves initial entry, attackers need not necessarily use their advanced capabilities.

Criminal activity by its nature seeks to exact profit and the use of cryptocurrency may help to circumvent sanctions and other restrictions

We may very well see an increase in attacks by actors associated with Russia if economic sanctions continue. Criminal activity by its nature seeks to exact profit and the use of cryptocurrency may help to circumvent sanctions and other restrictions.

Whatever the future may present, organisations must remain as vigilant, collaborative and agile as possible working as a secure unit internally and with external partners in order to protect against cyber threats from nation states and their accomplices.

This piece was written and provided bySteve Forbes, a government cyber security expert at Nominet.

Editor's Recommended Articles

Follow this link:
Protecting against cyber threats from nation states - Open Access Government

2022 AUG 19 (NewsRx) -- By a News Reporter-Staff News Editor at Insurance Daily News -- A patent application by the inventor Hatch, Thomas S. (Lehi, UT, US), filed on April 18, 2022, was made available online on August 4, 2022, according to news reporting originating from Washington, D.C., by NewsRx correspondents.

This patent application has not been assigned to a company or institution.

The following quote was obtained by the news editors from the background information supplied by the inventors: Recent years have seen rapid development in software products and electronic devices. For example, software products can affect functionality related to communication of data to and from electronic devices as well as operation of operating systems and/or individual applications installed on the electronic devices. As software and hardware become more complex, it becomes increasingly difficult to effectively secure information contained on electronic devices as well as information transmitted to and from electronic devices (e.g., over the Internet). Indeed, in an attempt to gather information, many individuals use viruses, spyware, malware, and other threatening tools to gather sensitive and/or valuable information.

While many tools exist for avoiding potential threats in cybersecurity of electronic devices, conventional cybersecurity systems often fail to adequately address potential security issues. For example, conventional cybersecurity systems typically utilize dedicated diagnostic tools for identifying whether a personal computer is compliant with a known security standard. Conventional diagnostic tools, however, are limited to providing a report of settings or configurations on a device that are out of compliance with a known set of standards. The report is then generally provided to an information technology (IT) administrator who manually addresses issues identified by the report or, alternatively, utilizes a separate software tool to facilitate remediation of various issues identified by the diagnostic tool.

In addition to failing to enable effective diagnosis and remediation of potential security issues, conventional cybersecurity systems can be inflexible and computationally prohibitive. For example, conventional cybersecurity systems are often limited to scanning a device for compliance with a specific security standard (e.g., Center for Internet Security (CIS) standards, Standard Technical Implementation Guide (STIG) standards, Payment Card Industry (PCI) standards, and Health Insurance Portability and Accountability Act (HIPAA)). As a result, conventional systems may provide an effective tool for identifying potential security threats for a select group of devices or programs uniquely tailored to a particular security standard. However, conventional cybersecurity systems may fail to effectively identify potential security threats for other devices or programs not specifically tailored to the security standard. Furthermore, while a device may simply run different security checks based on multiple security standards, running comprehensive checks based on multiple standards can be expensive and can utilize significant computing resources.

These along with additional problems and issues exist with regard to conventional cybersecurity systems.

In addition to the background information obtained for this patent application, NewsRx journalists also obtained the inventors summary information for this patent application: Embodiments of the present disclosure provide benefits and/or solve one or more of the foregoing and other problems in the art with systems, methods and computer-readable media that enforce security policies on a client device (or other computing device). In particular, in one or more embodiments, the disclosed systems enforce security policies by performing operations that enable an agent on the client device to both scan and fix security issues. For example, the disclosed systems can enforce a security policy by performing an idempotent operation in which a check and a fix of a security policy are the same operation (e.g., a check operation is the fix operation). In this way, the systems described herein can effectively identify and remediate configuration settings of a client device out of compliance with security standards using a single software agent.

In addition, in one or more embodiments the disclosed systems provide a policy-driven approach to enforcing security policies applicable to a wider range of client devices and applications. Indeed, by providing a policy-driven approach to enforcing security policies, the disclosed systems can enable a client device to comply with multiple security standards while performing a fewer number of operations than conventional systems, thereby improving performance of the client device without sacrificing substantial processing resources. In addition, by enforcing security policies using a policy-driven approach, the disclosed systems provide more effective security across a wider range of client devices and applications for which different security standards may be better suited to address potential security issues.

Additional features and advantages of one or more embodiments of the present disclosure are outlined in the description which follows, and in part will be obvious from the description, or may be learned by the practice of such example embodiments.

The claims supplied by the inventors are:

1. An apparatus comprising: at least one memory; instructions in the apparatus; and processor circuitry to execute the instructions to: enforce a first security policy of a first security standard; audit for a first compliance level with the first security standard; audit for a second compliance level with a second security standard; determine an overlap between the first security standard and the second security standard, the overlap associated with a second security policy; enforce the second security standard; and determine an update of the first compliance level based on the overlap.

2. The apparatus of claim 1, wherein the processor circuitry is to execute the instructions to enforce at least one of the first security policy or the second security policy with an idempotent operation in which a check and a fix of the security policy are the same operation.

3. The apparatus of claim 1, wherein the processor circuitry is to execute the instructions to: determine whether an exemption applies to at least one of the first or second security policies and in response to a determination that the exemption applies to the at least one of the first or second security policies, bypass enforcement of the at least one of the first or second security policies.

4. The apparatus of claim 1, wherein the processor circuitry is to execute the instructions to generate a compliance report indicating a measure of compliance with at least one of the first security standard or the second security standard.

5. The apparatus of claim 1, wherein the processor circuitry is to execute the instructions to generate mapping information associating a plurality of security policies to a plurality of security standards.

6. The apparatus of claim 5, wherein the mapping information includes information indicating the overlap between the first security standard and the second security standard.

7. The apparatus of claim 1, wherein compliance with a security standard includes configuration settings of an application or operating system on a client device.

8. The apparatus of claim 1, wherein the processor circuitry is to determine the update of the first compliance level based on the overlap before performing an additional audit of the first compliance level.

9. A non-transitory computer readable storage medium comprising instructions which, when executed, cause processor circuitry to at least: enforce a first security policy of a first security standard; audit for a first compliance level with the first security standard; audit for a second compliance level with a second security standard; determine an overlap between the first security standard and the second security standard, the overlap associated with a second security policy; enforce the second security standard; and determine an update of the first compliance level based on the overlap.

10. The non-transitory computer readable storage medium of claim 9, wherein the instructions, when executed, cause the processor circuitry to enforce at least one of the first security policy or the second security policy with an idempotent operation in which a check and a fix of the security policy are the same operation.

11. The non-transitory computer readable storage medium of claim 9, wherein the instructions, when executed, cause the processor circuitry to: determine whether an exemption applies to at least one of the first or second security policies; and in response to a determination that the exemption applies to the at least one of the first or second security policies, bypass enforcement of the at least one of the first or second security policies.

12. The non-transitory computer readable storage medium of claim 9, wherein the instructions, when executed, cause the processor circuitry to generate a compliance report indicating a measure of compliance with at least one of the first security standard or the second security standard.

13. The non-transitory computer readable storage medium of claim 9, wherein the instructions, when executed, cause the processor circuitry to generate mapping information associating a plurality of security policies to a plurality of security standards.

14. The non-transitory computer readable storage medium of claim 13, wherein the mapping information includes information indicating the overlap between the first security standard and the second security standard.

15. The non-transitory computer readable storage medium of claim 9, wherein compliance with a security standard includes configuration settings of an application or operating system on a client device.

16. The non-transitory computer readable storage medium of claim 9, wherein the instructions, when executed, cause the processor circuitry to determine the update of the first compliance level based on the overlap before performing an additional audit of the first compliance level.

17. A method comprising: enforcing, by executing an instruction with a processor, a first security policy of a first security standard; auditing, by executing an instruction with the processor, for a first compliance level with the first security standard; auditing, by executing an instruction with the processor, for a second compliance level with a second security standard; determining, by executing an instruction with the processor, an overlap between the first security standard and the second security standard, the overlap associated with a second security policy; enforcing, by executing an instruction with the processor, the second security standard; and determining, by executing an instruction with the processor, an update of the first compliance level based on the overlap.

18. The method of claim 17, further including enforcing at least one of the first security policy or the second security policy with an idempotent operation in which a check and a fix of the security policy are the same operation.

19. The method of claim 17, further including: determining whether an exemption applies to at least one of the first or second security policies; and in response to determining that the exemption applies to the at least one of the first or second security policies, bypassing enforcement of the at least one of the first or second security policies.

20. The method of claim 17, further including generating a compliance report indicating a measure of compliance with at least one of the first security standard or the second security standard.

21. The method of claim 17, further including generating mapping information associating a plurality of security policies to a plurality of security standards.

22. The method of claim 21, wherein the mapping information includes information indicating the overlap between the first security standard and the second security standard.

23. The method of claim 17, wherein compliance with a security standard includes configuration settings of an application or operating system on a client device.

24. The method of claim 17, further including determining the update of the first compliance level based on the overlap before performing an additional audit of the first compliance level.

URL and more information on this patent application, see: Hatch, Thomas S. Scanning And Remediating Configuration Settings Of A Device Using A Policy-Driven Approach. Filed April 18, 2022 and posted August 4, 2022. Patent URL: https://appft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1&f=G&l=50&s1=%2220220247793%22.PGNR.&OS=DN/20220247793&RS=DN/20220247793

(Our reports deliver fact-based news of research and discoveries from around the world.)

Read the original post:
Scanning And Remediating Configuration Settings Of A Device Using A Policy-Driven Approach in Patent Application Approval Process (USPTO 20220247793):...