https://www.cisa.gov/uscert/ics ICS-CERT released the following 3 advisories today, February 22, 2022. Click on the links below for more detailed information on these Industrial Control Systems vulnerabilities. GE Proficy CIMPLICITY-IPM GE Proficy CIMPLICITY-Cleartext WIN-911 2021
https://www.cisa.gov/uscert/ncas/current-activity/2022/02/22/cisa-adds-two-known-exploited-vulnerabilities-catalog CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below. These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and pose significant risk to Read more…
https://www.cisa.gov/uscert/ncas/current-activity/2022/02/18/ncsc-nz-releases-advisory-cyber-threats-related-russia-ukraine The New Zealand National Cyber Security Centre (NCSC-NZ) has released a General Security Advisory (GSA) on preparing for cyber threats relating to tensions between Russia and Ukraine. The advisory recommends organizations review their security posture and monitor for cyber incidents and provides additional resources to help protect against potential threats. CISA Read more…
https://www.cisa.gov/uscert/ncas/current-activity/2022/02/18/cisa-insights-foreign-influence-operations-targeting-critical CISA has released CISA Insights: Preparing for and Mitigating Foreign Influence Operations Targeting Critical Infrastructure, which provides proactive steps organizations can take to assess and mitigate risks from information manipulation. Malicious actors may use tactics—such as misinformation, disinformation, and malinformation—to shape public opinion, undermine trust, and amplify division, which can Read more…
https://www.cisa.gov/uscert/ncas/current-activity/2022/02/18/cisa-compiles-free-cybersecurity-services-and-tools-network CISA has compiled and published a list of free cybersecurity services and tools to help organizations reduce cybersecurity risk and strengthen resiliency. This non-exhaustive living repository includes services provided by CISA, widely used open source tools, and free tools and services offered by private and public sector organizations across the cybersecurity Read more…
Check out this article from Wordfence regarding the vulnerability they discovered in “Profile Builder – User Profile and User Registration Forms”. Is your website secure and update to date regarding its plug-ins? Do you even know if your website has plug-ins added to it? Do you just pay the monthly Read more…
https://www.theverge.com/2022/1/4/22866687/amd-ryzen-6000-microsoft-pluton-xbox-security-features-ces-2022 AMD is the first to implement Microsoft Pluton
https://www.cisa.gov/uscert/ncas/current-activity/2022/02/17/nsa-best-practices-selecting-cisco-password-types The National Security Agency (NSA) has released a Cybersecurity Information (CSI) sheet with guidance on securing network infrastructure devices and credentials. Cisco devices are used globally to secure network infrastructure devices, including across the Department of Defense, National Security Systems, and the Defense Industrial Base. Credentials within Cisco configuration files could Read more…
https://www.cisa.gov/uscert/ncas/current-activity/2022/02/17/cisco-releases-security-updates-email-security-appliance Cisco has released security updates to address a vulnerability affecting Cisco Email Security Appliance. A remote attacker could exploit this vulnerability to cause a denial-of-service condition. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA encourages users and administrators to review Cisco Advisory cisco-sa-esa-dos-MxZvGtgU and apply the necessary Read more…
https://www.cisa.gov/uscert/ncas/current-activity/2022/02/17/drupal-releases-security-updates Drupal has released security updates to address vulnerabilities affecting Drupal 7, 9.2, and 9.3. An attacker could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Drupal security advisories SA-CORE-2022-003 and SA-CORE-2022-004 and apply the necessary updates.